1283628 - Get "unauthorized access blocked (terminate process)" re: Norton Security (conathst.exe)

Status: RESOLVED WONTFIX

(Firefox :: Extension Compatibility, defect)

Description

[Dan Pernokis]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160604131506

Steps to reproduce:

Run FF, quit FF.

(Machine needs to be running recent Norton Internet Security.)



Actual results:

Norton Internet Security logs a medium-severity message "Unauthorized access blocked".  Actor is Firefox.exe, and the target is conathst.exe (Norton Identity Safe native host).

I first noticed this right after updating to FF 46 on tower and laptop.  I do have Identity Safe active, not sure when it was turned on but I'm sure it's been on for awhile.

Currently running FF 47.0 on Windows 7/32 Pro (SP1)
NIS: 22.7.0.76 (and previous version 22.6.0.142)


Expected results:

This may be a "normal" process, but FF and NIS should cooperate on how this works.  Should not show as a bunch of significant error warnings every day.

People posting to Norton's forum mention it happening with Google Chrome if Identity Safe is configured, but I don't see it in Chrome, despite my having Identity Safe active there too.  (Perhaps Chrome has solved the issue?)

Comment 1

[Dan Pernokis]

>> Norton Internet Security logs a medium-severity message "Unauthorized access blocked".

The full message is actually "Unauthorized access blocked (terminate process)".

Comment 2

[Daniel Veditz [:dveditz]]

Changing component back to Untriaged because I'm not sure where this goes. This isn't a "Security" issue in Firefox, it's a software compatibility issue. Possibly it's one of the Norton add-ons trying to talk to the Norton executable. 

You could try running Firefox in "safe mode" to disable all the add-ons and see if the messages stop. Not as a "solution" but as a diagnostic test to narrow down where we should be looking.

Comment 3

[Dan Pernokis]

Thanks, Daniel.  I was about to do your test and, as a first step, I wanted to log a message to get its timestamp -- so I would know whether start & quit in Safe Mode made any difference (ie- if there was a newer entry or not).  I launched FF (normal mode), quit, and checked the Norton log.

It turns out the last time the warning appeared was a cluster of several on the evening of 28/07/2016, the last two being at 11:23:18 pm and 11:04:43 pm (EDT) -- just a few hours before you posted.  The message has not appeared since then, even though I launched FF a few times later that evening and of course dozens of times since (both in normal and private modes).

There were several Norton automatic updates after these times (SDS Definitions, Reputation Revocation List, and Web Protection Definitions), plus an update to IPS Definitions less than an hour before.  None of these sound like candidates to change the logging, but maybe.  (The only Norton Add-on in FF is "Norton Identity Safe 2016.7.0.62", dated "June-21-16".)  FF was updated to 47.0.1 on 02-July-2016 but it also gives the issue and is the same I have been running all through until right now.  No changes were made by me to any FF settings, especially not since July 28th.

I suspect something has changed (or been corrected) in the interplay between FF and Norton by one of the Norton updates, but I can't tell what.

I'll leave the status as "Unconfirmed" for now.  (It's probably resolved, but somebody might want to know how it was fixed to prevent a recurrence...)

Comment 4

[Dan Pernokis]

Attachment: FF Troubleshooting Info for TOWER in RAW format

FF Troubleshooting Info for TOWER in RAW format

Comment 5

[Dan Pernokis]

Attachment: FF Troubleshooting Info for TOWER in TEXT format

FF Troubleshooting Info for TOWER in  TEXT format

Comment 6

[Dan Pernokis]

Attachment: FF Troubleshooting Info for LAPTOP in RAW format

FF Troubleshooting Info for LAPTOP in RAW format

Comment 7

[Dan Pernokis]

Attachment: FF Troubleshooting Info for LAPTOP in TEXT format

FF Troubleshooting Info for LAPTOP in TEXT format

Comment 8

[Dan Pernokis]

Attachment: FF Troubleshooting Info for NETBOOK in RAW format

FF Troubleshooting Info for NETBOOK in RAW format

Comment 9

[Dan Pernokis]

Attachment: FF Troubleshooting Info for NETBOOK in TEXT format

FF Troubleshooting Info for NETBOOK in TEXT format

Comment 10

[Dan Pernokis]

I started this comment before adding the trouble-shooting attachments...

WHOA!  Today I checked the logs of our Laptop and Netbook computers (both PCs, Windows 7/32 Pro + SP1, same as Tower).  It turns out that both have been logging the terminate process problem right up until today, and continued to do so throughout my testing.  Tower hasn't logged the message since July 28th.

If I start FF in Normal Mode (click an icon), the error is logged immediately on exit.  If I start FF in Safe Mode (shift + click icon + select "Safe"), then the message is NOT logged.

All machines are running FF 47.0.1 (Release channel) with similar setups.  The Norton AV is Norton Internet Security ("NIS"), same program on all machines, current updates applied.  The only difference is the timing of the updates -- the Laptop and Netbook had been sleeping for much of the past week, so their updates were less frequent and therefore larger (perhaps more consolidated).

So the attachments are the trouble-shooting info from each machine, in raw and text formats.
FYI, all machines are running extensions FF Hello, Multi-process Staged Rollout, Norton Identity Safe, and FF Pocket.  Two are running Awesome Screenshot and WinZIP Courier.  The rest are mixed.  ("Copy to WordPerfect Lightning" isn't even enabled -- I just can't get rid of it.)

Comment 11

[Dan Pernokis]

I did some more testing, the obvious thing being to disable the Norton Identity Safe extension.  No surprise, the message was not logged if the extension wasn't running, and it logged again when re-enabled.

On a whim, I disabled, tested, and re-enabled same on the Tower, thinking it might trigger or shuffle a few things -- but it did not log the problem either before, during, or after the disablement.

My conclusion is -- as the Google Chrome people found  out and Daniel suggested above -- that the Norton Identity Safe extension is the issue.  So I guess the "FF people" have to speak to the "Norton people" again to sort this one out.

Comment 12

[Dan Pernokis]

We had a power failure overnight (01-02 August) which outlasted my UPS on the Tower PC.  The system died but restarted OK.  As a result of the re-boot, Norton NIS suddenly started logging the "Terminate Process" warnings again -- first time since July 28th.

I also upgraded to FF 48.0 today and immediately tested for logging of the warnings -- yes, they still continue (including Tower).

Comment 13

[Dan Pernokis]

Last night (Aug 24), my Norton Security updated its engine on the Tower.  I had to close two FF windows in order for the updates to be applied ("patch", no restart) -- and the log shows two "terminate process" errors at exactly that time (9:24 pm).  The actual update was applied and completed at 9:26 pm.  There have been no further messages of that type logged since.  FYI, I'm running FF 48.0 Release, and NIS is now 22.7.1.32 as just updated.

On the other hand, the Laptop is also now running FF 48.0 and NIS 22.7.1.32 -- don't know when the NIS engine was last updated -- and it just logged an error when I opened and closed FF.  So the issue looks far from resolved... just unpredictable.

Comment 14

[Jorge Villalobos [:jorgev] (he/him)]

Mass-closing old Extension Compatibility bugs that relate to legacy add-ons or NPAPI plug-ins. If you think this bug is still valid, please reopen or comment.

Sorry for the bug spam, and happy Friday!

Comment 15

[Dan Pernokis]

I just checked:  Such an error was last logged in early Jan 2017, so I guess the problem was somehow already resolved anyway.