FF calling home (and elsewhere) on start

[ETcallHome]

FF 37.0.1
Home page set to blank page
Updates turned off
Send info to FF is off

Below is a netstat listing of the connections FF is making on startup. What the hell?

TCP 192.168.2.12:1591 140.211.166.65:80 LAST_ACK 1476
TCP 192.168.2.12:1592 140.211.166.65:80 CLOSING 1476
TCP 192.168.2.12:1593 140.211.166.65:80 CLOSING 1476
TCP 192.168.2.12:1596 140.211.166.65:80 CLOSING 1476
TCP 192.168.2.12:1597 140.211.166.65:80 CLOSING 1476
TCP 192.168.2.12:1605 173.194.43.115:80 TIME_WAIT 0
TCP 192.168.2.12:1606 74.125.226.96:80 TIME_WAIT 0
TCP 192.168.2.12:1626 54.201.3.250:443 ESTABLISHED 1880
TCP 192.168.2.12:1628 93.184.215.191:443 ESTABLISHED 1880
TCP 192.168.2.12:1630 74.125.226.159:443 ESTABLISHED 1880
TCP 192.168.2.12:1633 173.194.43.119:443 ESTABLISHED 1880
TCP 192.168.2.12:1634 74.125.226.151:443 ESTABLISHED 1880
TCP 192.168.2.12:1636 74.125.226.134:443 ESTABLISHED 1880
TCP 192.168.2.12:1638 173.194.43.115:443 ESTABLISHED 1880
TCP 192.168.2.12:1640 54.192.35.241:80 ESTABLISHED 1880
TCP 192.168.2.12:1641 54.192.35.241:443 ESTABLISHED 1880
TCP 192.168.2.12:1643 173.194.43.64:443 ESTABLISHED 1880
TCP 192.168.2.12:1644 54.192.35.241:443 ESTABLISHED 1880
TCP 192.168.2.12:1645 54.192.35.241:443 ESTABLISHED 1880
TCP 192.168.2.12:1647 173.194.43.103:443 ESTABLISHED 1880

1880 = FF
1476 = ?

[therube]

How to stop Firefox from making automatic connections

[ETcallHome]

Thanks for the info. ET

[JayhawksRock]

You may not want to block 140.211.166.65 as it appears to be the address of the Mozillazine server in Oregon....... unless, of course, you are done here. http://140.211.166.65.ipaddress.com/

[ETcallHome]

Following the info in the above link I've managed to reduce the IP list (netstat output) to:

TCP 192.168.2.12:1033 54.192.53.118:80 ESTABLISHED 1080
TCP 192.168.2.12:1034 54.192.53.118:443 ESTABLISHED 1080

1080 = FF
Using ARIN tells me the IP is allocated to Amazon. The ARIN info says Amazon has re-allocated it (to one of their customers?)

I am not a happy camper, I've got a ton of work to do and the list didn't include messing with FF. Thanks all for the help, you've made it a whole lot easier to solve this problem.

ET

[Grumpus]

Here's a partial list for Amazon.
Unfortunately they are more extensive than this but if you block these with your firewall it will be half the battle.
54.0.0.0/8
54.69.0.0/16
54.72.0.0/13
54.80.0.0/12
54.88.0.0/16
54.148.0.0/16
54.192.0.0/12
54.192.0.0/16
54.224.0.0/12
54.224.0.0/16
54.230.0.0/15
54.230.0.0/16
54.239.0.0/16
54.240.0.0/16

Not that it matters but be aware the US government is now stupidly one of Amazon's clients and may at times use IPs which appear to be Amazon.

[JayhawksRock]

And Amazon has become one of the largest cloud servers for websites that need hosting services for their website. http://aws.amazon.com/
http://aws.amazon.com/products/?nc2=h_ql_reinvent

[James]

Yeah Mozilla uses Edgecast, Akamai and also http://aws.amazon.com/cloudfront/ (as needed) for cloud service. Mozilla uses a CDN as they no longer use mirrors as they did before.

93.184.215.191 is Edgecast and the Google IPs could be the Safe browsing.

Bit of a older article but it explains why you may get connections on startup of Firefox like with Fx and Extension updates, blocklist updates, safe browsing etc.
http://kb.mozillazine.org/Connections_established_on_startup_-_Firefox

[patrickjdempsey]

Amazon is the biggest cloud server game in town, with free packages for newcomers. Everyone who needs that power and cannot afford their own server farm uses it. It's actually become one of the great equalizers of the web in recent years.

[Grumpus]

Frankly Amazon is an annoyance and if let un-tethered is going to dictate access and content should the cloud application, already in a scary realm, continue unabated.
The same thing was said about pistols made by Sam Colt, not necessarily the best of conditions as shown by later times.
Sshould an individual not wish to participate in cloud based computing, it's intrusion into an individuals system after blocking, removing and other methods constitutes a form of malware, regardless of purpose.

[ETcallHome]

Honestly this is becoming a huge pain-in-the-ass.
Reset FF
Start in safe mode

And FF is still calling out on startup. Here's the most recent list:

TCP ws1:1492 yyz08s14-in-f0.1e100.net:http TIME_WAIT 0
TCP ws1:1506 a23-194-47-139.deploy.static.akamaitechnologies.com:http TIME_WAIT 0
TCP ws1:1531 a184-84-45-165.deploy.static.akamaitechnologies.com:http TIME_WAIT 0
TCP ws1:1535 ec2-52-11-10-137.us-west-2.compute.amazonaws.com:https ESTABLISHED 1256
TCP ws1:1539 ec2-54-229-148-138.eu-west-1.compute.amazonaws.com:https ESTABLISHED 1256
TCP ws1:1541 93.184.215.191:https ESTABLISHED 1256
TCP ws1:1543 yyz08s10-in-f8.1e100.net:https ESTABLISHED 1256
TCP ws1:1545 yyz08s14-in-f6.1e100.net:http ESTABLISHED 1256
TCP ws1:1547 yyz08s13-in-f9.1e100.net:https ESTABLISHED 1256
TCP ws1:1551 server-54-230-34-6.stl2.r.cloudfront.net:http ESTABLISHED 1256
TCP ws1:1552 server-54-230-34-6.stl2.r.cloudfront.net:https ESTABLISHED 1256

1256 = FF

I'm getting the feeling that FF itself is causing this.

Time to un-install and get a fresh copy.

Arrgh

ET

[patrickjdempsey]

I'm getting the feeling that FF itself is causing this.

Yes... as you've been told.

When you reset Firefox, you created a condition where Firefox needed to check for updates. Firefox checks for application updates, extension updates, extension "blurb" updates, home page "blurb" updates, phishing list updates, etc. All of those "amazon" and "cloudfront" instances are likely Mozilla.

[patrickjdempsey]

Frankly Amazon is an annoyance and if let un-tethered is going to dictate access and content should the cloud application, already in a scary realm, continue unabated.

Only if you don't understand why they are being used. Small companies like Mozilla that cannot afford acres of servers that are only used during updates can have Amazon instances set up just for those times. This way Mozilla servers don't get hammered. You know how every time there's a Firefox update people complain they cannot access addons.mozilla.org for a few days? Or how some people have to wait nearly a week before they get the update? Those are the kinds of situations that letting Amazon's big boxes push out the updates can help avoid.

[ETcallHome]

Maybe Mozilla would like to provide a list of external URLs it connects to? And maybe FF should ask permission before it makes those connections? (I realize FF probably asked permission in it's user agreement, but I didn't see it.)

So now I'm stuck with a piece of software that's basically a big security hole. In order to fix the hole I have to wade through page after page of FF documents.

I ran IE to see if it was affected by this problem. It's not.

Thanks to everyone above for the help and info provided. My next step is an uninstall and a fresh installation. Thanks Mozilla for wasting hours and hours of my time when all you had to do was provide the info up front.

ET

[malliz]

So now I'm stuck with a piece of software that's basically a big security hole.

No you are stuck with a browser that monitors updates and security lists.

I ran IE to see if it was affected by this problem. It's not.

Naturally they have massive servers of their own and they only update IE when yet another security hole is found

My next step is an uninstall and a fresh installation.

That will do nothing. You are asking questions but not reading the answers