[Doug]

Hi folks,

I've got a friend here in Chico who has a brand new Sony laptop (just a few days old) running pre-installed Vista.
She has subscribed to a wireless ISP known as DigitalPath. (it's legit. I have known others using it)

She is naive to computing and internet use.

When she logs into her DigitalPath account to gain access to the Internet an alert screen appears:

Tumbleweed Valicert Validation Authority version 4.9 - Done

I have contacted DigitalPath Technical Support.
They have no idea what Tumbleweed is, have never heard of it.

Well, neither have I.

Has she "tumbled" into some sort of Malware?

I actually submitted her machine to a HJT Trusted Advisor yesterday and the machine was found to be absolutely clean.
No surprise, since it was brand new (maybe several hours of use).

I will be submitting a HJT/Combofix report into a Malware Forum elsewhere.

But I was wondering if anyone has ever heard of Tumbleweed Validation Authority.

Google shows Tumbleweed presenting itself as a Certificate Verify service.
Supposedly much like better known services.

Thanks f

[Advertisements]

I don't think it's malware, as it is used by the US Government in things like "smart cards".

The certification qualifies Tumbleweed's public key infrastructure (PKI) validation software and appliances for any Federal agency seeking compliance with Homeland Security Presidential Directive 12 (HSPD-12) and the Federal Information Processing Standard 201 (FIPS 201). HSPD-12 mandates that on October 27, 2006, Federal agencies must start issuing FIPS 201 compliant common identification cards (smart cards) for controlling physical and logical access to government facilities and information systems. The government will eventually roll out the smart cards to millions of Federal employees and contractors, and FIPS 201 requires that each card must contain a unique credential number, a digital certificate and an expiration date.

As for what it is doing on your friend's computer, I have no idea... They wouldn't happen to work for the Department of Defense, would they?

Edited by stettybet0, 28 February 2008 - 07:31 PM.

[stettybet0]

I don't think it's malware, as it is used by the US Government in things like "smart cards".

The certification qualifies Tumbleweed's public key infrastructure (PKI) validation software and appliances for any Federal agency seeking compliance with Homeland Security Presidential Directive 12 (HSPD-12) and the Federal Information Processing Standard 201 (FIPS 201). HSPD-12 mandates that on October 27, 2006, Federal agencies must start issuing FIPS 201 compliant common identification cards (smart cards) for controlling physical and logical access to government facilities and information systems. The government will eventually roll out the smart cards to millions of Federal employees and contractors, and FIPS 201 requires that each card must contain a unique credential number, a digital certificate and an expiration date.

As for what it is doing on your friend's computer, I have no idea... They wouldn't happen to work for the Department of Defense, would they?

Edited by stettybet0, 28 February 2008 - 07:31 PM.

[Doug]

Yeah, I read that same stuff about Tumbleweed.
It's just that they have not "invited" Tumbleweed onto their machine.

No they have no relationship with corporate or government offices that would be using it.
And besides, why would it be re-directing them to Go-Daddy(dot)com at http : // (OCSP) dot Go-Daddy (dot) com ????
Interesting read about OCSP ---> http://en.wikipedia....Status_Protocol

They've been doing some online real estate shopping and have a MySpace account.
Other than that, their online use is rather "tame".

I suspect they opened one too many unsolicited Credit Check, Real Estate Offer, or other unsolicited email.

Thanks for looking in on this topic.

[Doug]

Here's the browser Re-Direct that I get when I try to put in the URL for GeeksToGo Forums

http://[goog-black-enchash 1.45624 update][mac=CQ9q9KBzh95ZQ6qdYNxG8w==] -02E0004760BF93D73B51657F14597278 +0752099D603AEC9511969D97A8E09306 MnMxYXJlcUsvofULa76ZnP+HvzLwnrsxpjPR3hU61q8vXsw77Q+HKPRcD8kwNMdqzs+OPUDXvTFGis/nzA== -17163F4212398B09214BC3056269E189 -17267F0811158F69DE3C106A78ACF3AE +17F3DC5E93C5348C87858C4E9C062B64 dDFSMTJ3Z0TB2R3/ r8fNDJR3T5Rjw4dDAES6VTu911k9YqRCEp3BxH5Sz5tad5M15ngBnqnv5zfQAq+z9s4T7oWgiXhTqOpN
iHEYdsqEFHGvqnnP7CqMQCCQZaVbsb0r5EpW+dyrpp5DZdqZy+3ADlozAf3FrEg+kRQhob9p+2cI10ip
XYRFGvvO/7gGutPRQ1bBZA4cyGOmenQD9iy3Umn7YXVIsuRhZFOFrR7Rt4t/HWWv/AngPBUYXviIzOwcxm2hQie4V3zfBKmKx9xX+qPI5p0WnBZsVjHLfCsGAE1CUwaHQ/31NcYu50LbvOPkTD7eChtPBxKJ1yEohP1At/SNlhZBNCwgT6SXWbusnCy+QUnCx9LMntJwFV76WmZJs/OQxuOp6+aCanOrOsEv7sQ= -1DD0E1B3252BA7D4923190CADD1C7ECC +1E8A564E458016029A3F5704184EB179 Uk5nTTRzd02/ tVQqoVt7K4BN+dL9DlNpujvbpvHba05D1gs9RXXTRsxkElDqp8Shp1TrLKS5x7KhxZWmULLMCcszB0H8
9ucGpQJw1SHmsXNmi+w3NnEg1vSKmGeKVWBc/5lGc1ziV0eM5KCIoFJ5ogj2FKm157ytTUPovQ4wgnbvpBMLG7SVg9e/ABD/u//cATp45l2ay1lcAopQ/yLMT2ghARt5 +220197F22833D8BC51131F3A892185D4 N21BOFBPMEJOosCBbhdbQR1fmx44eGjZiqWd9xMqGUM8bL0XuMq1RXPY0XN9fcXr0DuiTSAqesGJL301
wgeQC8NVdPJzsroOiN9Ulzt9gqdPR+ilgs8Jramf31JU80+3xOcW2COUprdaK0e1IZhP8sM28vOV14o7
mwQIF2Prqnbqgkiui/nJ8mmKhv7xAU+UNxOAEz3sjHJQDIQ/avtEkRfpQHLwWW4U5zbAjBBVR3NF7lk0uFpoRHJg/X8L+SHbwULZPWnC8CdNli/NLvy7e7ydPD+/IY4A7ZGuxEKExQf9q0dgMhY/ b+KahfgVkEu8ExW3RFrSq1D1nmTT0wKWgjpbojr0cqDC3LzVXfGTkJN9rNrc1F71sAqa7Cg+XeOr5lmE
zGLrhYAJGOwATNJKeApiSwZRr6KBNhmhM/7k46lpnpsYZeq6NyZ7mobD1ksSvMaYZeKBMe9T7CXXEvnCUpaXpEKHL13S/a/ D6DvHk9upDYmuSAFew8yQCyYSjFcZ2ID9OKIJqWQmyeFUXFe6x6S1Oqw6wWL7tfEASS0OwgPo5UCx8sv
MogBBkOsD1Q16R6nS/C0jAgrw/ s3hOO3HQI4T6PNbCZnaCZnZBUgELS1oQ3izmcQ02CjRuCGYw+i43Na0h5a2uokle64WuP9x4XXa3YbfB
Zmprz+6eF5wpnz2L5HX/XUMyGDWJJ77ztkrb8L/hF8F73JtnTorf8KBXEdXeMoti+Qgpz5zGd/z1g+B6co59etE0V9PnaHL6JhA3HF2G3oPc3zWu/pov7MpCoaqEZDqUVSjjo4b7VS86kT+oMODSlMnNDs93eXDnoVXjHGzJCKY432Reu5hYI3h1hFmMMwY/G4XXmJY1QfM/uZOfiPpYSSt4ggZbL7qQiCgGFatZ84HL0jnEoYPVWqs81prPVuW8+V5iEuR1gZ2T7eQ+vmT7E/dd49pefpYGHUyUrxxM/zxZTo4jZCb5UQmlLXIcH2