Covert BT Phorm Trial Report Leaked

stavros-59 writes "An internal BT report on the BT secret trials of Phorm (aka 121Media) Deep Packet Inspection has been revealed on Wikileaks today. The leaked document shows that during the covert trial a possible 18 million page requests were intercepted and injected with JavaScript and about 128 thousand charity ads were substituted with the Phorm Ad Network advertisements purchased by advertisers specifically for the covert trial period. Several ISPs are known to be using, or planning to use, DPI as a means of serving advertising directly through Layer 7 interception at ISP level in the USA and Europe. NebuAd claim they are using DPI to enable their advertising to reach 10% of USA internet users." CT: nodpi has updated their page with a note that says that the charity ads were "purchased and not hijacked"- read there to see what the latest is.

Comments

Ouch

[mrbluze]

That's a big leak and a big privacy breach, but can this realistically lead to legal action against BT?

Re:Ouch

[KnightMB]

That's a big leak and a big privacy breach, but can this realistically lead to legal action against BT? Whether it does or not, someone has already taken the initiative to setup a page to generate fake web pages (or real ones) to pollute the data they collect. So if you can't get them out legally, you can make the data they collect useless, which hits them in the pocketbook and might be more effective than legal countermeasures. You'll find the site here: http://wanip.org/anti-nebuad/ in which every browser becomes a data-mining polluter when it's run. Get enough those on a suspect ISP and watch the CEO's have a heart attack from the "pollution attack".

Re:Ouch

[siddesu]

not sure what the situation in the UK is, but in Japan some mobile phone operators have been doing this for a while with some phones. since probably half of the internet usage here happens over phones, it doesn't look like a small market.

to make it even worse, my current provider not only injects ads while I browse, they also supply the advertiser with a unique ID, which I can't easily turn off. since the image is inserted on the server i also assume the phone is sending referer headers, so the advertiser can collect your browsing history (and, that being a phone, your URL session cookies too) for good measure.

when i complained, i was told to go away, because there was no such thing as "personal" information being disclosed to the advertiser. to me such arrogance calls for more encryption as a kind hint to the ISPs to go and do the job i'm paying em for.

unless, of course, that option is also defeated by the copyright cretins and the gubbermint, working hard together to prevent child pr0n and terrorists.

in which case, thicker tinfoil will also be necessary.

Re:Ouch

[Dark Kenshin]

Of course is won't. If a private person were to develop and test this out, he would likely be spending the next 20 years in prison (looking less and less "exaggerated" as time goes on.) The fact that this is for cooperate gains; it will be largely over looked. Yes, I might be lost in cynicism, but life seems to be supporting my case thus far.

Re:Ouch

[EvilMonkeySlayer]

Looking at the site it appears to be pretty easy for phorm here, all they'd need do is do a simple domain lookup. If it doesn't exist they filter it out.

If it doesn't exist then it's generated by this, since all it does is randomly create addresses. It'd be better if it just loaded random websites. Of course, that'd eat up a lot more of the users bandwidth though.

Re:Ouch

[MindKata]

"realistically lead to legal action against BT"

Legal action strong enough to totally stop them is unlikely, as the power seekers who run a lot of countries unfortunately seem to be rushing towards building their own Big Brother, so as they make the rules, they choose whats considered legal. So they simply need to change the laws, which is what they keep doing. It seems nearly every week now we are getting ever more stories of new grabs for information and/or power over people. At this rate, 2008 should go down in history as the start of a Worldwide Big Brother.

Its ironic that our so called free countries appear to be building Big Brother as fast, if not faster than other countries. Maybe we just have better technology. Its also ironic that the war on terrorists is a war against people who wish to force others into their point of view. Yet now the people already in power are seeking to clamp down and hold control over everyone. Its like all of us who don't seek power are caught up in a power struggle between the different groups of power seekers who do seek to impose their views on everyone.

I guess the ones in power in some way fear some lost of power, as it can't be just about protecting us. Its got to be about seeking more power, which is what they do thoughout their political lives and all of us who don't seek power are not going to be heard by them. Especially as most people don't seem to even see how much harm can be done with so much power and no way to tell them they are behaving unfairly. They are becoming like a machine which is loosing its feedback mechanism and so running towards ever more extremes.

Re:Ouch

[aproposofwhat]

I came up with this as a concept in 2000, when layer 7 switching was just becoming economically feasible for a startup ISP.

It never flew, because the people I was dealing with weren't complete cunts.

From the document: The advertisements were used to replaced [sic] a 'default' charity advertisement (one of Oxfam, Make Trade Fair or SOS Children's Villages) when a suitable contextual or behavioural match could be made by the PageSense system.

So not only are the bastards hijacking our traffic, they are overwriting paid-for charity ads as well.

I repeat, CUNTS!

Re:Ouch

[Janos421]

The browsed pages do not exist, so you never download pictures or js files. It's very easy for an ISP to filter these requests, they can filter the HTTP response code.
Two FF exntensions generate fake queries on search segines to pollute the collected data (at search engine level, but it also pollute ISP data). SquiggleSR and TrackMeNot. Notice that the former also clicks on non-sponsored results and may deceive cookie tracking.

Re:Ouch

[timeOday]

I agree this calls for encryption. ISPs and routers should ONLY be able to see what they need to see - IP routing information. They shouldn't be able to see content, nor port numbers. But I am unsure whether ssl provides this, and how much compute horsepower would be required for big servers to ssl everything.

Re:Ouch

[hasdikarlsam]

SSL doesn't, IPSec does. Sadly, the latter is hardly ever used.

IPv6 is supposed to have IPSec as a required element. I don't know how much this means; whether it'll actually be *used*, and resist MITM attacks.

Re:Ouch

[hostyle]

Say i have my paid-for website with no ads displayed. Are Phorm potentially injecting ads for a competitor of mine into the pages I display to my visitors?

Re:Ouch

[mikael]

By their own admission a leading UK telecoms company has deprived several charities of a legal revenue stream to line their own corporate pockets.

Given the outrage following the several Audiocall staff kept 100K of children in need cash for itself, I hope BT get the same treatment.

Re:Ouch

[hostyle]

To answer my own question: no. Phorm uses ad-replacement techniques. It is replacing already displayed ads with their own, not injecting new ads into ad-less content.

Nothing to see here mods, please carry on along you merry modding way.

Re:Ouch

[mabhatter654]

the EU has already rule against Google for selling ads that do just that in generic Google Ads blocks on sites. I'd say they're already breaking the law.

Re:Ouch

[Lennie]

I thought SSL MITM isn't possible, could you please point me to a page explaining how that works ?

Atleast when certificates are properly checked it shouldn't be possible.

Re:Ouch

[Jellybob]

So if I had an ad-funded website (unlikely in the current climate, but stick with me) Phorm would be screwing me out of the money I'd make for those ads, but replacing them with there own.

Something tells me that if I did the same thing with a billboard - charging customers for me to go out and paste their adverts over the top of paid for adverts at night - Clear Channel would quite quickly be attempting to sue me.

Re:Ouch

[Shakrai]

I thought SSL MITM isn't possible, could you please point me to a page explaining how that works ?

Atleast when certificates are properly checked it shouldn't be possible.

You just explained how it's possible.

Re:Ouch

[hal9000(jr)]

For a SSL MITM to be seamlessly possible, meaning the browser wouldn't pop up a dialog due to some issue with the certificate, the server doing the MITM would have to

1. generate a new certificate with the target webservers host name in the certificates common name
2. get their CA certificate into your browsers trusted certificate store

If they can't do both, at minimum, your browser will pop a dialog about a hostname mismatch or untrusted certificate respectively.

Re:Ouch

[Anonymous Coward]

YOU GONNA BE THE WORMFACE!

Re:Ouch

[Anonymous Coward]

IPv6 has IPSec as part of the spec, but its an incomplete option, and it is ignored by pretty much everyone but the RFC text.

Right now, IPv6 is a highly broken protocol, choking completely on firewalls, NATs, and packet filtering, allowing an attacker in Elbonia to get your network topology and then figure out which hosts to probe from the safety of his/her teepee. If you don't want an attacker sending whatever packets they want to any machine on your private subnets, you have to downshift to IPv4.

Re:Ouch

[XenoPhage]

Something tells me that if I did the same thing with a billboard - charging customers for me to go out and paste their adverts over the top of paid for adverts at night - Clear Channel would quite quickly be attempting to sue me. What an awesome idea. I'm going to develop glasses and windshields that identify billboards and replace them with ads chosen by the car and glasses manufacturers.. I'll make millions!

Re:Ouch

[timeOday]

I think ssl solves MITM about as well as it could be - browsers are hardcoded with public keys for certification authorities, which then distribute keys for other hosts.

Rather my question about ssl was whether it conceals port numbers (and any other information I haven't thought about) that routers don't need.

Re:Ouch

[Anonymous Coward]

I believe you can load random websites. There appears to be a big button at the bottom just for that purpose.

Re:Ouch

[arivanov]

And how exactly will two different websites share the same IP I may ask? The cert is checked at handshake time so you can have only one website running on that IP.

That's one of the many uses of pound or other reverse SSL proxies by the way - to merge multiple websites behind the same IP. In my previous job at one point I had 6 or 7 different sites running on different servers and different OSes merged behind a single SSL frontend.

Re:Ouch

[foobsr]

Yes, I might be lost in cynicism, ...

This is only what they tell you to obfuscate that you are on the way to enlightenment :), which as a consequence renders you useless as a prototypical consumer (if you escape being caught by Prozac&Co.)

CC.

Re:Ouch

[foobsr]

I'll make millions!

You will be sued. It is called Augmented Reality and I bet there are patents.

CC.

Re:Ouch

[flacco]

That's a big leak and a big privacy breach, but can this realistically lead to legal action against BT? Whether it does or not, someone has already taken the initiative to setup a page to generate fake web pages (or real ones) to pollute the data they collect. So if you can't get them out legally, you can make the data they collect useless, which hits them in the pocketbook and might be more effective than legal countermeasures. You're not being cynical/paranoid enough. You assume the motivation is strictly economic, while it actually might be a cover for plain ol' surveillance. "Extra data" isn't as damaging in this scenario, where they are monitoring you for specific behavior.

Re:Ouch

[tagishsimon]

It's always worth reading the document first.

121Media, who ran the trial, placed charity ads (at its own expense) on a number of websites, and then intercepted them and replaced them with commercial or other charity adverts on the fly. Thus they were replacing their own adverts /and/ serving the charity adverts to those who viewed the web pages and were not in the trial.

Thus there is no question of damage to charities, quite the contrary; nor to websites advertising revenues.

There is, though, the privacy issue.

It would be helpful if we could hang them for what they are guilty of, rather than making unsupported allegations.

Re:Ouch

[Anonymous Coward]

From the document: The advertisements were used to replaced [sic] a 'default' charity advertisement (one of Oxfam, Make Trade Fair or SOS Children's Villages) when a suitable contextual or behavioural match could be made by the PageSense system.

So not only are the bastards hijacking our traffic, they are overwriting paid-for charity ads as well.

If you read the Analysis link at NoDPI.org in TFA, you'll see that BT bought and paid for the charity ads themselves to use as test subjects. But it's unclear if the charities knew their names and reputations were being exposed to this sort of experiment.

Re:Ouch

[scatters]

SSL is not a transport protocol and does not conceal any information except the application layer. The IP (network layer) information is needed for routing your packets, and the TCP (transport layer) information is needed to determine to which port on the remote server you are trying to connect. Once you have completed the TCP handshake to create the socket connection, your application can begin to negotiate a secure protocol, such as SSL.

Re:Ouch

[Shimbo]

By their own admission a leading UK telecoms company has deprived several charities of a legal revenue stream to line their own corporate pockets

No: they gave the charities some free advertising. The summary on wikileaks is completely FUBAR. Phorm paid for the space, and ran some targeted ads. If they couldn't find a suitable match they ran charity adverts as a default.

I don't like what Phorm are doing but let's not put up strawman complaints that they can slap down.

Re:Ouch

[mikael]

Thanks for the information - from the document, it looked like they had sold some advertising space, and were replacing charity adverts with the register ed adverts. I guess they bought advertising slots and used the charity adverts when no other adverts were available.

Re:Ouch

[Anonymous Coward]

But making whatever script doing the monitoring do name lookups on every domain would eat tons of bandwidth very quickly.
It's just too expensive.

Re:Ouch

[aproposofwhat]

My reading of the document was that there was no mention of 121edia having placed the charity ads - perhaps you could point out where that was made clear.

Re:Ouch

[tagishsimon]

That would be in section 1.2 on page 7.

The paragraph starting "To trial the Contextual, ..." refers to the purchase of advertising space. The table lists the ad campaigns which were substituted into the web page. The paragraph starting "The advertisements were used to replaced [sic]..." mentions the "default" charity adds.

Advertisement Injection

[TheMeuge]

So let me see - if I am paying for bandwidth (which will soon be metered), and my ISP in injecting its ads into the webpages I am requesting, then the ISP is running down my bandwidth on purpose?

Isn't that sort of like someone from the electrical company who breaks into your house to turn the lights on while you're gone?

I won't even mention the privacy issues, cause those aren't "in" nowadays, nor are they likely to be a sufficient cause to nip this practice in the bud. Cheating people out of money, on the other hand, is always a great way to apply the US tort law to the cause.

Re:Advertisement Injection

[Rhys]

If you're paying for metered bandwidth, why are you accepting ads in the first place? AdBlock+ solves that problem very quickly.

Past that, maybe we can start seeing more "regular" traffic served over https -- DPI or not, it looks like garbage unless you can break the encryption. If someone comes up with a way to do that, there are a lot more serious problems to worry about than ad injection.

Re:Advertisement Injection

[Anonymous Coward]

Well, if you're electric company charged a flat rate and didn't meter your service, it would be different. Since ISP's don't normally do this, it's a gray area.

Re:Advertisement Injection

[QUILz]

They could still hijack SSL/TLS sessions if users aren't paying any attention to warnings.

Re:Advertisement Injection

[Stewie241]

I don't necessarily trust the ISP's JavaScript either... leave my pages alone thank you very much.

Glad I have a small ISP that likely won't do this, but I wonder if this means that random routers across the internet can use this to inject code into web pages.

Re:Advertisement Injection

[Ed Avis]

Doing man-in-the middle attacks on SSL connections is beyond the technical ability of ISPs, even if users don't bother to check certificates. And the potential for them to get in trouble for it is a lot higher (e.g. if they ended up intercepting financial information, and then the ISP's servers got cracked...). So https is still the right answer here.

It's 2008, why aren't most websites just using https by default? A low-volume site can handle the load with today's superfast CPUs, and high-volume sites can afford to buy one of those crypto engine thingies.

Re:Advertisement Injection

[Nursie]

"It's 2008, why aren't most websites just using https by default?"

Because you have to go to a third party and pay them money. That would be the problem. We don't (AFAIK) have a free signer with a widely distributed public certificate at present.

AFAIK, anyway.

Re:Advertisement Injection

[Anonymous Coward]

"Past that, maybe we can start seeing more "regular" traffic served over https -- DPI or not, it looks like garbage unless you can break the encryption. If someone comes up with a way to do that, there are a lot more serious problems to worry about than ad injection."

It would not be that hard to do if the ISP added themselves to the root CA's on the users machine (the setup CD's that nearly all ISPs send out when you subscribe)

1. ISP handles the ssl session with the remote host
2. ISP decrypts traffic (as they are pretending to be the 'client')
3. Inject Adverts
4. ISP encrypts traffic with there key
5. ISP forwards traffic to the real client

Hopefully this is not legal for a ISP to do in the UK! (but I'm sure it could be allowed if they mention it in the TOS)

Re:Advertisement Injection

[Timothy Brownawell]

Perfectly feasible if the users get enough annoying pop-ups that they just click OK on the "invalid certificate" warning, or if they have an installer that adds extra ssl root certificates.

Re:Advertisement Injection

[Ed Avis]

Yeah it sucks that you have to either pay money or endure scary messages from the web browser. There should be a way to label your site as self-signed where it wouldn't get the special secure icon or magic green glowing bar in the web browser, but on the other hand the user wouldn't be pestered about an invalid certificate (unless the cert offered really has changed since last time the user visited the site).

Re:Advertisement Injection

[Anonymous Coward]

> It's 2008, why aren't most websites just using https by default?

You either need an unique IP for each domain or SSL load balancer, SSL cert (the user gets 'confusing' dialogs with self-signed certs), extra bandwidth and there's been no compelling reason to do this. Phorm going live could be just the push we need for IPv6 / HTTPS by default.

I stopped running a HTTPS instance in 2002 due to lack of interest and endless emails about my self signed cert.

Re:Advertisement Injection

[Abcd1234]

Perfectly feasible if the users get enough annoying pop-ups that they just click OK on the "invalid certificate" warning

Which is why FF3 makes it so much more difficult to accept an invalid certificate.

Re:Advertisement Injection

[TheLinuxSRC]

It's 2008, why aren't most websites just using https by default?

Certificates cost money. In order to have an encrypted site that does not pop up a warning about unauthenticated certificates, you have to buy a certificate rather than generate your own. As an example (warning: shameless plug) visit https://pagewash.com/ (in Firefox 3.0 it not only gives a warning, but actually shows an "error" page.

If you do not buy one, many people will view your "safer" site as unsafe and simply not visit it.

Re:Advertisement Injection

[larry bagina]

ssl certs require a dedicated ip address, so most virtual hosted sites can't.

Re:Advertisement Injection

[Albanach]

The CPU requirements of serving large numbers of encrypted pages are massive in comparison to non encrypted pages.

You need to spend CPU cycles encrypting each page for each browser rather than just firing the same data in response to multiple requests,often from a cache.

To make matters worse, browsers for good reason won't cache data received over SSL, so each page view sees much more data having to be served.

Re:Advertisement Injection

[Urban Garlic]

> AFAIK, anyway.

I believe you're right, for normal values of "widely distributed", but I am aware of a promising candidate. Cacert.org provides free authority certificates, and their root certificates are bundled with Debian, and some other Linux distros. If the Firefox guys got on board, this could work.

Re:Advertisement Injection

[Anonymous Coward]

Doing man-in-the middle attacks on SSL connections is beyond the technical ability of ISPs,

WTF? i work at an a reasonably large (3million custs) ISP, and let me tell you, we certainly do have the technical ability to do a MITMA. sure, we couldnt break the encryption, but hey, go buy a valid certificate set up a machine and pass the traffic.

its not _that_ hard.

Re:Advertisement Injection

[Nursie]

I like that idea actually.

A sort of "You probably shouldn't trust me that much, but at least nobody's eavesdropping or screwing with the datastream" setting.

Re:Advertisement Injection

[Nursie]

True, it does up the processing requirements and that could prove costly or even impractical for some high traffic sites. And would increase the bandwidth needed.

But maybe it's a direction we should be heading in when it looks like we are going to have ever-increasing difficulty in trusting that what we're receiving is what the originator actually sent.

Maybe sometime the backbones decide they want a piece of the action, hell, maybe some government decide that company X isn't using any of the infrastructure in MY country to peddle its propaganda and replaces everything that routes through their territory...

Re:Advertisement Injection

[Derosian]

You know, you are right, can a company charge you for something then go out of its way to make that something happen?

I can't think of any ready examples of this in other corporate areas, but this can't really be entirely legal. If your service is metered and you pay for a certain amount then unless you sign a contract stating otherwise the ISP is responsible for the added bandwidth costs which they send you advertisements with. It wouldn't make sense for YOU to pay to be spammed with advertisements. That would be like paying for free TV.

Re:Advertisement Injection

[saigon_from_europe]

We don't (AFAIK) have a free signer with a widely distributed public certificate at present.

I've heard that BT is willing to do that for free...

Re:Advertisement Injection

[v3rgEz]

Hard? No. Extremely unscalable, particularly at the ISP level? Absolutely, plus that's opening another whole can of worms that most ISPs (today) aren't willing to open (see above re: private banking information concerns, for example). Of course, who would have thought they'd have the sheer chutzpah to replace other sites ads and, you know, threaten the very basis of much of the Internet economy? I sure didn't, even knowing it was technically possible.

Re:Advertisement Injection

[VC]

Actually its a terrible idea. SSL only works because you know that the connection is encrypted between you and the person you're talking to. SSL to an untrusted host is just as bad as no ssl because the man-in-the-middle (which is kind of the definition of an ISP) could easily produce a certificate that says, "hey, I'm what ever page you wanted to look at". And the insert ads.

Re:Advertisement Injection

[Albanach]

A possible solution would be opportunistic encryption. It would allow some sites to serve encrypted traffic without changing anything at the apache/squid end of things. No change is needed at the browser level either, and cache's can still be used.

There's still a cpu overhead, but at least we don't lose all the other methods needed to keep http traffic flowing quickly.

Re:Advertisement Injection

[mikael]

Perhaps there could be a way of transparently transferring zip files across as web pages? Any encoding scheme is going to need to calculate a checksum of all the text, script and image data, and store that checksum somewhere.

Perhaps a website could use a advert banner as the decryption key. If Phorm attempt to replace the banner, then the website is unviewable.

Re:Advertisement Injection

[Qzukk]

Doing man-in-the middle attacks on SSL connections is beyond the technical ability of ISPs

What?

It's fairly trivial, you just redirect insert-hostname-here to an IP you control, with a fake certificate for the hostname you're tracking, that in turn connects to the actual website and relays the traffic back and forth. Having a "valid" certificate is also somewhat trivial, the vast majority of subscribers simply follow directions and insert the ISP-provided CD in the drive and let it install whatever it wants, including whatever replacement CA certificates they want to provide (anecdote: I have personally witnessed an AT&T install CD which attempted to install such a certificate as part of the modem/router setup process).

The hard part is doing this for EVERY website, unless "*" is accepted by browsers as a valid CN now (I know *.domain.com is, I use such a cert for work), in which case you'd only need a handful of servers and IPs for load balancing, and the certificates are always valid.

Re:Advertisement Injection

[Anonymous Coward]

Also, some websites do not have dedicated IP addresses.

Re:Advertisement Injection

[Anonymous Coward]

Which is why FF3 makes it so much more difficult to accept an invalid certificate.

Grrr. I had to do that the other day, what a stupid pain in the ass. Sure, I only except invalid certificates once a year, but it was worse than Vista having to answer the same question worded multiple ways over and over. Why the hell JPL can't get a valid certificate is another annoying question.

Re:Advertisement Injection

[Erez.Hadad]

But if you use secure communication, you still lose bandwidth, because of extra packet bits and processing overhead. If this DPI would cause an increase of secure surfing, then ISPs are still to be blamed.

Re:Advertisement Injection

[Casualposter]

Ok, so this is what happens. The Website, let say, Slashdot, makes an agreement with XYZ internet media company to sell ads on the site. Those ads don't pay without a click through. The customer pays the ISP for the upload and download content bandwidth, maybe per gigabit, or "unlimited" bandwidth. The ISP reads all unencrypted packets (and perhaps has to retain such information for some regulated period of time in some country). So when the customer goes to the site, he may or may not get the ads for the site as the ads may be substituted by the ISP so that clicks go to the ISP instead of the site. And the ISP is free to send small or large ads depending upon what is economically advantageous to the ISP.

This is nothing more than the ISP asking for a blank check from the customer, while stealing ad revenue from the visited websites. But it would be very hard to detect from the website. How would you know your ads are being intercepted?

Another scenario. What is to stop the ISP from being paid by a political action group to simply replace all instances of an opposing group's ads with their own? Seems to me that is left up to the integrity of the ISP, which from my experience is not very high. These are the folks who will sell your phone records to the first PI that pretends to be you, and also to the first G-man to merely ask.

Another scenario. NOw that it has been demonstrated that every packet can be read and that this can be used to generate profits, what level of responsibility does the ISP take upon itself for the contents of the websites? ARe they liable for every underage relationship transmitted across their lines while they serve ads for condoms next to the sex talk? What about those instance where websites are serving information that could be used to commit a crime? Shouldn't the ISP, with it ability to completely read the subject's searches KNOW or should know that a crime is being researched? How many times will the internet be blamed for harm to a minor before the ISP gets held partially liable, or required to monitor the internet by the government?

Re:Advertisement Injection

[PTBarnum]

Also, some websites do not have dedicated IP addresses. I'm confused. I thought SSL certs were for domains, not for IP addresses. Is a certificate only valid for a certain IP range, as well as a certain domain?

Re:Advertisement Injection

[zoward]

Once advertisers and web sites see a sizable percentage of their advertising being siphoned off and replaced by ads financially benefitting nobody but the ISP's, you'll start seeing more web sites using https.

Also, if my web page travels across the servers of a half-dozen major ISP's the ads from one ISP may be overwritten by another, etc., with whomever has the last "hop" being the "winner", so even if my ISP isn't replacing ads, all it takes is one ISP using this tactic and I will not see the ads the ads that actually pay the bills for the web service in question.

I find it particularly odious that BT chose to replace charity ads for their test run. Bastards.

Re:Advertisement Injection

[ray-auch]

Roughly (from somwhat vague memory):

With http, multiple sites can share one IP address by using host-header to route the requests. This is very, very common.

With https, this isn't possible (unless you use the same wildcard certificate for all the sites), because the header is encrypted so you don't know which site to send it to (or which certificate to use to decrypt it).

Hence for https / ssl you need a dedicated IP address for the site.

Re:Advertisement Injection

[Shakrai]

Doing man-in-the middle attacks on SSL connections is beyond the technical ability of ISPs, even if users don't bother to check certificates

Doing man-in-the middle attacks on SSL connections is beyond the technical ability of ISPs for now, even if users don't bother to check certificates

Fixed that for you

Re:Advertisement Injection

[fprintf]

Dumb question, but does AdBlock+ stop me from seeing the ads but they are still downloaded, or does it block the download entirely?

Re:Advertisement Injection

[Nursie]

Yeah, you're right.

Perhaps a way to take most of the load off the server would be to have trusted certificate but use an RSA_NULL_SHA1 ciphersuite where secrecy isn't important but authentication and integrity are.

Re:Advertisement Injection

[jonaskoelker]

You could do something almost good enough, though, that's done completely on the client side:

Let's say you're sending index.html. Take a hash of the page, put the hash early on the page.

In the bottom of the page, insert javascript code that removes the hash value, hashes the page, and compares it to the removed hash. If they mismatch, do an alert("warning: the page has been tampered with since it left Foocorp.com's servers."). The hash function doesn't have to be overly secure; here is actually a good time to write your own bad crypto.

The ISP would then have a hard time modifying the page, because they would have to generate the hash value of the modified page before seeing the page they want to modify only slightly.

They could, of course, buffer the whole page (if the server sends it out, or it could spoof your ACKs) and run the javascript on their modified version to compute the hash function. But how are they to know which functions to call? Include an infinite loop and some exploits that you never call yourself if you want to be really disruptive.

Re:Advertisement Injection

[hal9000(jr)]

1) Because certificates cost money to purchase and manage.

2) Because doing SSL on a grand scale would require many sites to invest in SSL acceleration gear to keep up with demand.

3) because the management burden on web server admins from the dudes that manage amazon.com to the lowly mom and pop shop using a shared hosted service would have to engage in a needlessly complex process.

#1 and #2 are the biggest issues though.

Re:Advertisement Injection

[hal9000(jr)]

Ah, but the browser has to accept the wildcard as an acceptable replacement for the sites actual host name. I forget, either Firefox or IE accepts a wildcard cert.

Re:Advertisement Injection

[ray-auch]

> The hard part is doing this for EVERY website,

Not hard. There are proxies (eg. fiddler) which will do ssl MITM and generate certificates on the fly. Normally, these certificates will not be trusted, since they won't be signed by a trusted CA...

If, as you suggest, the attacker / watcher can install a trusted CA cert, then it's game over.

Re:Advertisement Injection

[nuzak]

Once advertisers and web sites see a sizable percentage of their advertising being siphoned off and replaced by ads financially benefitting nobody but the ISP's, you'll start seeing more web sites using https.

No, you will see more lawsuits.

Advertisers paid for their ads to be served. Phorm is theft.

Re:Advertisement Injection

[goodmanj]

If you're paying for metered bandwidth, why are you accepting ads in the first place? AdBlock+ solves that problem very quickly.

Yes, and in the parent post's analogy, I could switch off my electricity and put a padlock on the breaker panel before I leave the house to thwart the electrical company's ninjas....

But should I have to?

Re:Advertisement Injection

[nuzak]

Dumb question, but does AdBlock+ stop me from seeing the ads but they are still downloaded, or does it block the download entirely?

It blocks the download entirely.

Re:Advertisement Injection

[forkazoo]

Most websites are hosted on shared servers, without unique IP's. HTTP is fairly unique in accomodating that sort of a setup, but HTTPS really requires a unique server with a unique IP, so that the whole HTTP session can be conducted within the encrypted tunnel.

When IPv6 becomes common, I hope we can start to expect most shared hosting solutions to give a unique IP to each domain, etc., so that HTTPS will work fine on the run of the mill sort of site. Unfortunately, I wouldn't be at all surprised if such a golden age is still a decade away, given the slow adoption rate of IPv6, and then general momentum both at hosting providers, and with non-expert end users to do things as they are already done. (Why change what works?)

Re:Advertisement Injection

[halcyon1234]

The main strength of a verification like this would have to be genetic diversity. If every page used the same javascript to checksum, then it would be trivial for a monkey at the ISP to figure out that they need to run the script's

if ( ! CheckSum( PageWithoutChecksum(this)) == EmbeddedChecksum(this)) ) {alert("baaaad");)

And replace the checksum block with CheckSum(PageWithoutChecksum(ALTERED PAGE))

Same goes for just stripping out the javascript line altogether, or replacing if (!...) with if(...).

But if every page implemented a different variant of this type of check, with different function names, signatures, structures, if...else blocks, and CheckSum algorithms-- well, at that point it would be darn near impossible for the ISP to keep up with every single possible variant

Re:Advertisement Injection

[Anonymous Coward]

The right answer is not https, it is BTNS. Look it up.

Re:Advertisement Injection

[Anonymous Coward]

Won't stop MITM attacks. The ISP just needs to decrypt with the original ad and encrypt with the new ad.

Re:Advertisement Injection

[XenoPhage]

You can get a free "personal" SSL cert from StartCom... And their root cert is included in Firefox, so no scary dialogs there.. Unfortunately, it's not in IE yet, though...

Re:Advertisement Injection

[Nursie]

Authentication and integrity would be preserved, but you're right, unless the hash was encrypted in an RSA way (expensive) then that still fails as they could just rehash not re-rencrypt, we're talking about authenticated plaintext).

Re:Advertisement Injection

[neongrau]

ssl certs are created for the hostname, ip-adresses are irrelevant. only reason not to is because of the recurring costs and or processing power on the server side.

Re:Advertisement Injection

[bfizzle]

While I agree that HTTPS will solve this issue... there are still many low-volume sites running on crappy hardware. Even worse high-volume sites running on the lowest amount of hardware to meet peek demands. Going to HTTPS isn't free there is a cost associated with it.

Re:Advertisement Injection

[defnoz]

Ditto for Opera's adblocking, AFAIK.

Re:Advertisement Injection

[znerk]

To make matters worse, browsers for good reason won't cache data received over SSL, so each page view sees much more data having to be served. Thus raising the rates for the serving entity... and, now that the ISPs are going to start metering consumer internet usage, raising the costs for consumers. Also, this will increase the amount of traffic on the web exponentially, as every server that wants to be seen as "worth its salt" will begin encrypting their data stream to thwart the spam and misdirection of the internet service providers. This will lead directly to the infrastructure being overwhelmed, since the metering of internet usage is part of the plan to make money with what they already have, rather than improving the infrastructure to support what they've already sold.

And to tie these subjects together, I applaud the ISPs for taking on the spammers directly. See, if the spammers (including the ISP, with this DPI stuff) are sending me unsolicited data, and my bandwidth usage is being monitored so they can charge me for it, then they're literally stealing money from me. Last I checked, theft was still a crime in every country in the world... some of them even consider it a capital offense. Spammers already fear exposure because they annoy the crap out of people... what do you think will happen when their "annoying crap" becomes "expensive, annoying crap"?

With metered internet usage, these injected ads become, if not theft, then at the very least outright fraud. It would be like having a water company guy come to your house and poke a hole in your pipe, causing a leak... and then billing you for the excess water usage. This throws the ball into a whole new court, since you are not legally required to pay for fraudulent claims... and the credit card companies tend to be rather vigilant about tracking down fraudsters. It will make many people very happy to see the CEOs of ISPs getting shoved into the back of a squad car for defrauding customers, I would think. It would certainly bring a smile to *my* face.

I, for one, welcome our metered information supplying overlords... but will not accept them until they can prove to me beyond a reasonable doubt that I intentionally downloaded everything they say I did. And none of their baby-killing (charity-replacing) ads, either!

Imagine if the electric and cable companies showed up, uninvited, at your house with a huge television. They then plug the television into your power, and start showing you their favorite commercials, right on your front lawn... and then they present a bill for this unsolicited "service", in addition to the electric company charging you for the electricity required. The outrage would be immense, and justified. The cry of "Get off my lawn!" would be audible for several city blocks. What makes the internet service providers think it would be any different to do the exact same thing in everyone's browsers?

Re:Advertisement Injection

[dave420]

They can't do that? Not even with a massive version of Cain? :-P

Re:Advertisement Injection

[rgriff59]

It only takes one trusted CA, and that can come from several directions. Here is a artilce describing Blue Coat's SSL proxy, sold specifically to do MITM, although they don't call it that:

http://directorblue.blogspot.com/2006/07/think-your-ssl-traffic-is-secure-if.html

In operation, there are a few clues that one might pick up on, but overall, lots of people will never notice that this is happening. Very slick, but in a very dark and scary sort of way...

Re:Advertisement Injection

[MSZ]

With TLS (which at least some browsers (FF) support) you don't. It will send initial headers (including "Host:") in plain text and then switch on encryption. Or at least it should be able do that - I've never bothered to check which web servers can do it.

Re:Advertisement Injection

[Kadin2048]

> Doing man-in-the middle attacks on SSL connections is beyond the technical ability of ISPs

That seems like a rather dangerous assumption. Just a few years ago, doing wire-speed ad replacement was beyond the technical ability of ISPs. Now, it's clearly not.

There's nothing really that hard about MITMing SSL, if you take on premise that the user is stupid and will ignore certificate-mismatch warnings. The actual MITMing is fairly simple, and I'm sure there are lots of companies who would be more than happy to develop hardware to do it to many connections simultaneously, at the DSLAM level, if you tossed some cash in their direction. It's not really that much more difficult than current DPI, plus the addition of cryptographic offload engines to do the SSL on either side (and those are off-the-shelf hardware items).

If it's legal and profitable -- or even not expressly illegal and profitable -- someone will do put the pieces together and do it.

Re:Advertisement Injection

[Kadin2048]

> SSL to an untrusted host is just as bad as no ssl

Well, I'm not sure I'd go quite that far, although I understand the point you're making.

The whole purpose of having certificates from "Trusted Authorities" is that they're supposed to verify that the people applying for certificates actually control the domain that the cert is issued for.

For example, you or I shouldn't be able to go up to Verisign and get a certificate with a Common Name that includes "slashdot.org", since we're not in control of the domain. It's the responsibility -- actually the sole function -- of the Trusted Authorities to ensure this is the case.

We can argue how good a job they do of this; if they do a crappy job, then SSL and its whole certificate infrastructure is worse than useless.

However, although Verisign et al aren't that great, they're not quite to the point of letting anyone get any certificate they want, either. There's still a (weak) level of authorization checking. (Usually they send some sort of confirmation code to the Technical or Administrative contact for the domain in WHOIS, and require you enter that code to get the cert.)

The net effect of this is that, when you contact a site using SSL, as long as you don't disregard any warnings from the browser, your communications should be protected in transit between you and the site.

There's no real "trust" of the site at the other end of the line required, for security in transit. The person/entity you need to trust is the Certificate Authority backing up their SSL cert.

That's the weakness of SSL.

(Of course, if you're doing business, you need to trust the site at the other end of the line to protect the information you're sending them, once it arrives on their system. And I suppose you could argue that you need to trust them to not expose their private key to the world, letting anyone use it. But the key bit of trust you need as a user is of the CA, not the other host.)

Re:Advertisement Injection

[Bent Mind]

Yeah it sucks that you have to either pay money or endure scary messages from the web browser. There should be a way to label your site as self-signed where it wouldn't get the special secure icon or magic green glowing bar in the web browser, but on the other hand the user wouldn't be pestered about an invalid certificate (unless the cert offered really has changed since last time the user visited the site).

As far as I know, all systems allow you to import a self-signed certificate. There is the initial warning. However, once you tell the computer to trust it, it doesn't complain again.

SSL to an untrusted host is just as bad as no ssl because the man-in-the-middle (which is kind of the definition of an ISP) could easily produce a certificate that says, "hey, I'm what ever page you wanted to look at". And the insert ads.

I've always wondered how this works. You make a self-signed certificate and publish it from your site. The ISP intercepts your certificate and replaces it with theirs. When a client requests a secure page, you transmit an encrypted page to the ISP. The ISP decrypts it using your certificate, inserts an ad, reencrypts it using their certificate, and transmits the modified page to the client. Is that about it?

So the problem isn't that "you have to either pay money or endure scary messages". It's that you need a reliable method of verifying the certificate.

Re:Advertisement Injection

[amorsen]

It's 2008, why aren't most websites just using https by default? You can't host web sites for multiple domains on one IP address with SSL. At least not without warnings popping up, and then you might as well not bother.

Re:Advertisement Injection

[Eil]

It's 2008, why aren't most websites just using https by default? A low-volume site can handle the load with today's superfast CPUs, and high-volume sites can afford to buy one of those crypto engine thingies.

There are a couple good reasons HTTPS isn't more prevalent for "regular" sites.

1) Yes, low-volume sites running on an under-utilized box could handle SSL, but a significant portion of the web, however, is made up of sites which run a lot closer to capacity. Google, Amazon, Ebay, etc. For these guys, their traffic volume is so huge that every byte they add to their main page probably costs more per day than I make all year. No board member is going to stand up one day and say, "You know, we should spend millions encrypting all of our outbound traffic so that our visitors don't get ads injected by their ISP."

2) With HTTPS, you cannot separate authentication and encryption. Which is a shame, because there are a lot of scenarios where I want to encrypt my traffic and am willing to trust that there's not some kind of man-in-the-middle attack going on. Likewise, sometimes I'd like to know for sure that when I type in the URL for a web site, that I'm really getting the intended web site instead of a forgery, even when I don't care if the content is encrypted or not. But as it stands right now, you have to have one if you want the other.

The main problem is that SSL certificates are an utter joke, as they are currently used on the web. They're expensive and the security that they claim to provide via authentication is pretty much useless. You go to their website, plop down $50, they email the certificate to you and voila, you can now have a secure website! Sounds real f'ing secure, don't it?

Yeah, I know, you can always do a self-signed cert if you don't care much about authentication, but today's browsers will nag you constantly for using one for a variety of issues that I won't get into right now...

Re:Advertisement Injection

[Anonymous Coward]

SSL doesn't work this way. It relies on the certificate being signed by somebody trusted. If there is a flag that says that it is a dodgy self signed website then the ISP in the middle can just create a new cert self signed by themselves. Insert their crap and the user would still not be the wiser. The CA has the same trust.

Most of the SSL interception technology that I've looked at works by proxying ssl connections...

The client is a corporate SOE with the corporate CA installed... The SSL interception gateway just creates a cert for the remote website signed by itself that a corporate SOE client will not complain about because it is trusted. The gateway then makes its own SSL connection to the endpoint.

Re:Advertisement Injection

[trawg]

If you're paying for metered bandwidth, why are you accepting ads in the first place? AdBlock+ solves that problem very quickly. Because accepting ads are part of the unwritten contract that you have when you visit a site that relies on advertising to provide you, the user, with free content?

Full disclaimer - I work for a company that runs sites that are dependent on ad companies for revenue. We actually are pretty strict about what advertising we tolerate - we go more for branding and simple things, although I confess we do the occasional page take over and some other slightly intrusive things, because a) we get paid a lot for them and it allows us to do things like give away Xbox 360s to our regular users and b) they apparently have a very high success rate, which mean users actually click on them and it turns into revenue for our advertisers.

We are investigating (cheap) subscription options to make sure users have an alternative to ads, but in the meantime we don't think its a lot to ask that people absorb a few ads.

I see this attitude a lot on Slashdot and I'll be honest - it shits me to tears, because as a happy user of sites like this that manage to provide me with awesome services, I don't want to have to start paying for it - I'll happily cop a few ads, especially when they're hilarious Microsoft ones trying to pimp to a crowd that clearly hates them.

I can guarantee you that eventually ad blocking is going to just lead to better ad delivery technologies that will probably be even more invasive. Encouraging people to use AdBlock means more chance of less free services that survive on ad revenues.

I won't deny that some sites have terrible ad policies. Rather than block their ads and deny them revenue, I simply stop going there and find an alternate site. If you visit a site that has really crappy ad policies, STOP GOING THERE.

Re:Advertisement Injection

[centinall]

Someone's already thought and implemented this:
Web Tripwires
But you're right, perhaps websites should start providing something of this nature.

Re:Advertisement Injection

[Ed Avis]

SSL to an untrusted host is just as bad as no ssl because the man-in-the-middle (which is kind of the definition of an ISP) could easily produce a certificate that says, "hey, I'm what ever page you wanted to look at". And the insert ads.

It depends on your definition of easily. As I said earlier, I don't think the technical staff at ISPs are whizzkids enough to understand and implement man-in-the-middle attacks against SSL, there certainly isn't off-the-shelf hardware to do it, it's computationally expensive, and you can potentially get in a lot of legal trouble for it (much more than just injecting advertisements).

So I don't agree that https without a signed certificate is no better than unencrypted http. It may not be good enough for Paypal or even Gmail, but it's a lot better than plain http for ordinary websites that just want to serve a page and have the user see it without tampering by the ISP.

Re:Advertisement Injection

[deroby]

Because the ads are making the websites I like 'richer' and (hopefully) keep them in the air, not a penny goes to my ISP (**).

IMHO Ads aren't that bad when applied properly... but I agree that some sites overdo things.. guess those sites simply lose me as a customer from that point on...

**: unless off course my ISP replaces the original adds with adds of his own... think I read something on /. about that recently...

Is that legal?

[Opportunist]

Changing content and injecting different ads? I could see two possible violations here, one being copyright (altering content without the consent of the provider of the content), the other one dealing with fraudulent ad change (someone other than the one paying for the ads being displayed).

It's like a cable company changing the channel ads with their own. I doubt any channel would sit and bear it, especially since their customers (i.e. ad buyers) won't accept that.

Re:Is that legal?

[QUILz]

It's only legal if it's opt-in. Not entirely sure how obvious they are supposed to make it though...

Re:Is that legal?

[porkThreeWays]

It's like a cable company changing the channel ads with their own. I doubt any channel would sit and bear it, especially since their customers (i.e. ad buyers) won't accept that. Which Comcast already does here in the US...

Re:Is that legal?

[Anonymous Coward]

I'm sure it was found illegal in the UK a few months ago (this report is from 2007)

http://news.bbc.co.uk/1/hi/technology/7339263.stm

Re:Is that legal?

[corsec67]

How could a consumer opt-in with a company to violate a copyright held by a third party?

Take /. for example. How could I opt-in with my ISP to modify the page /. sends to me? Wouldn't that be a derivative, and a copyright violation?

Re:Is that legal?

[mpapet]

I had another thought. What if the plan is to aggregate advertisers? This would destroy the sites that makes any money based on advertising, or have them go to BT for their ad revenue.

The -eventual- outcome would be every ISP that can afford to do it will create something vaguely like television only with some extra free info out there where they can't sell adverts.

In the time that it takes for the case to make it's way through court, they could make plenty of progress toward this end without consequences.

Re:Is that legal?

[Misch]

Changing content and injecting different ads?

I would wonder what this would do for "common carrier" status held by these ISPs?

It's like a cable company changing the channel ads with their own

Seen it. In a very small city I used to live in, Time Warner injected their own ads over other ads on the cable network. You could always tell it was an injected ad because it was local and it was off by a fraction of a second, so you saw the beginning or end of an alternate commercial.

Re:Is that legal?

[ameyer17]

It's like a cable company changing the channel ads with their own.

They already do.

Re:Is that legal?

[Drathos]

All cable companies do that. Usually, there's provisions in their contract with the content providers for them to inject a certain amount of local advertising into the feed.

Re:Is that legal?

[SithGod]

They aren't actually changing the ads per say. A local cable company is allowed to sell certain ad space in a broadcast, hence why you'll see ads for Joe Schmo mattress warehouse while watching a nationally televised program. It's just that in that circumstance they are selling the ad to themselves. In summary, it's perfectly legal and a common practice for any carrier.

Re:Is that legal?

[norton_I]

Except that the cable company has permission from the national feed to inject local ads in specific slots. Sometimes the raw feeds have black space in those locations, other times they have ads for people who watch the national feed directly. Your local cable company is certainly not splicing in their own commercials without permission.

Re:Is that legal?

[kiehlster]

I agree it seems illegal. It sounds just like the music industry where we find poor artists because the record companies are knifing both sides of the relationship (customer and artist). For one, you're injecting ads to your customers who pay you in the first place. I can see the reason if you are trying to save the customer money by getting sponsors to pay the bills. However, you're possibly replacing ads placed there by content providers who may rely on that ad revenue to put food on their family's plates. That's downright stealing.

There's enough stealing going on from the customer perspective when they block ads to prevent outages/overcharges when they reach their limit; People coast down hills in neutral to stretch their mileage/dollar, so why wouldn't the same principle apply to bandwidth/dollar? So having the ISPs stealing ad revenue is more than double the trouble since fewer people know/care to block ads anyway.

Are ISPs going in the same direction as the media industry and the lovely RIAA?

Re:Is that legal?

[Irish_Samurai]

Derivative works are protected under fair use.

Without going into it again, I posted a prospected stance that the ISP would take once challenged on this here.

Before people start flaming me to death, please note I am not taking the stance that I think this is great and awesome, just being honest with myself about the shit that is going to get thrown back at me when I take action.

Re:Is that legal?

[Anonymous Coward]

All networks do. There are deals negotiated for how many ads in each timeslot, etc. are inserted at the local (i.e. Comcast) level, local network (i.e. Channel 9 news or whatever) level, and national network (i.e. NBC) level. Everyone knows about it, instead of this under the table shady secret ad injection stuff, which is totally different.

Re:Is that legal?

[corsec67]

Derivative works are protected under fair use.

So I could take a song, add "Buy Coke" in the middle, and release that? No, especially not for commercial gain.

Some derivative works are protected by fair use, but they generally have to be mostly newly created content, and can't just be the website with a little bit changed, per Wikipedia.

Re:Is that legal?

[Irish_Samurai]

I agree, but their stance isn't that they're re-releasing it, its that they are acting as an agent of the user.

I can take a song, inject "Buy coke" at the end of every refrain, and play it to myself all day long.

My stance is that in order to nip this in the bud we need to get fair use, as its being abused in this manner, to be eligible only on the user client. If I want to change how a page renders, only I can exercise that right at the browser level, not my ISP upstream. I don't believe copyright infringement is a strong enough argument to get this stopped. Defining where the right can be exercised would be more formidable.

Re:Is that legal?

[_xeno_]

Pretty much every cable company does that in the US. I'm fairly sure it's allowed by contract, though, since cable companies have some form of contract between the broadcasters and themselves. I think.

On cable it's not necessarily a "bad" thing - generally the ads that are placed over the existing ads are local ads over nation-wide ads. For example, ads for local supermarkets or furniture stores versus generic ads for Sonic.

(This is a specific example. According to the Sonic store locator, the closest Sonic to me is in New Jersey. I live near Boston, Massachusetts. Sonic is a fast food joint. Somehow, I don't really feel like driving to New Jersey for fast food. In other words: Sonic ads don't really apply to me. However ads for local businesses might.)

So the cable analogy doesn't really apply - the ads are usually more targeted than the ads they're replacing, and more importantly, the channels know about it.

Although I can't let this slide without one final Comcast bash: I wouldn't mind them replacing generic ads with targeted local ads, if only the targeted ads were shown during the commercial break and not during the show! Incompetence and not malice, but still...

Re:Is that legal?

[Vancorps]

Isn't the guideline for a derivative work that you have to change at least 30% of the original work? Not sure if that's a legal guideline or just something that designers use as a rule of thumb.

Re:Is that legal?

[Vancorps]

Actually no, there is space deliberately left for down channel providers, there is content that cannot be replaced and there is content that can be replaced. Advertisers pay accordingly.

Re:Is that legal?

[TheRaven64]

It's highly unlikely that this is even remotely legal. It is equivalent to receiving a TV channel and rebroadcasting it with your own adverts substituted for the originals without the consent of the original broadcaster. They are modifying and redistributing copyright content without the copyright holders' consent, which carries fairly stiff penalties under the EUCD and related laws, they are they are misrepresenting content as coming from a third party, which is fraud with penalties under a number of laws, and they are (by injecting JavaScript) running code on a computer without permission, which is illegal under the Computer Misuse Act.

The only question is who is going to sue them, and which laws they will decide to invoke.

Re:Is that legal?

[corsec67]

Even if that were the case, and the ISP did change 30%, isn't that also fraud, since they serve the page as if it were coming from the original host?

Re:Is that legal?

[alan_dershowitz]

I realize this is BT, but at least in the USA you can't hire someone as an agent on your behalf to alter content for you. There was a Mormon tape dubbing service in Utah that would take a legitimate copy of a tape you owned and remove the "dirty" parts. They got shut down because they didn't have any right to charge money to do that for the consumer with content that was not theirs (the agent's or the consumer's.) Ditto with online "MP3 ripping" services that would send you an MP3 copy of a CD you legitimately own, consumer "fair use" didn't authorize third party agents to provide this service. Does anyone know are there similar rulings in the UK regarding this?

Actually, this would kind of call into question the legality of any ISP adblocking or content modification.

Re:Is that legal?

[Drathos]

Every cable provider I've ever had (Comcast, Adelphia, Time Warner, AT&T, and, back in the day, Montgomery Cable) has placed local/self commercials over existing commercials in the feed. I know that most feeds have planned spots for the operator to place their own ads, but I've seen plenty of cases where a commercial will interrupt another or will end and you can catch the tail end of another commercial that was preempted. Whether these were your 'cannot be replaced' ads or not, I don't know, but this is a long standing behavior that's not limitted to a single cable operator.

Re:Is that legal?

[Anonymous Coward]

It's like a cable company changing the channel ads with their own. I doubt any channel would sit and bear it, especially since their customers (i.e. ad buyers) won't accept that. That kind of thing happens all the time where I'm from. One of the biggest impacts (for me, anyway) is that we don't get the good commercials during the Super Bowl.

Local car dealership ad < GoDaddy.com ad.

Re:Is that legal?

[Irish_Samurai]

The ISP isn't charging you for it, its a free service. Now, that's not enough to clear of the act.

But what the above two services did was send you a copy, they got nailed on the distribution end of the idea. The legal trick was that the action never took place against your specific physical copy. The CleanFlicks issue was a video store that rented the videos to people who didn't own them, and that isn't fair use.

In this instance the alteration DOES take place against the original copy, en route to you, and never creates a second instance.

Re:Is that legal?

[kramer]

Derivative works are protected under fair use.

No, they most certainly are not. Certain derivative works are protected under fair use, but they must fall into one of a few narrow categories such as parody or commentary (they vary from country to country). There is no blanket derivative work fair use protection.

Re:Is that legal?

[Anonymous Coward]

From what I understand, this works by the following mechanism: ISP collects user data, sends it to NebuAd. NebuAd sends this to DoubleClick & the like, where it gets used the same way a tracking cookie would. So the ads aren't physically replaced, instead the ads that are shown via some sort of syndication/rotation (most of them) are switched for "more targeted" ads which originate from the same place (again like DoubleClick).
 
What the ISPs are doing is spying on your traffic and sending that data to advertisers, so they can get paid twice. The ads are the least of it.

Re:Is that legal?

[Ctrl V]

This would destroy the sites that makes any money based on advertising, or have them go to BT for their ad revenue.

this is the biggest problem with an ISP switching ads to their own. In the end, it's a destructive practice:

1) advertisers will start to understand that ads they pay for on site x are being over-ridden

2) advertisers start paying ISPs for advertising

3) site x, now not able to support its costs through advertising, closes up shop

4) rinse, repeat, until

5) there's no longer any sites that users want to visit, and ISPs are getting less money from advertisers, and are loosing subscribers cause there's less demand

6) everybody looses

Re:Is that legal?

[Ctrl V]

er.... loses. damn sticky 'o'

Re:Is that legal?

[znerk]

Are ISPs going in the same direction as the media industry and the lovely RIAA? Of course they are! Have you been hiding under a rock for the past year and a half?

Re:Is that legal?

[znerk]

Ooh, I hadn't thought of that one... the Computer Fraud and Abuse Act could make things very ticklish...

Re:Is that legal?

[kiehlster]

Maybe I've just been hiding under a dictator-like manager.

Re:Is that legal?

[znerk]

In that case, let me quickly bring you up to speed.

Several major internet service providers have been making noises to the tune of "we're tired of our customers actually using the 'unlimited*' bandwidth we sell them". ComCast just rolled out its pilot program in eastern Texas, wherein they charge based on the bandwidth consumed. The party line is that "illegal" torrents are causing network issues for other subscribers, with 5% of the customer base eating 90% of the bandwidth.

The general Slashdot response seems to be a mixture of "Yeah! Evil pirates suck!" and "Why am I paying for unlimited bandwidth if I'll be penalized for actually saturating my pipe?", with liberal sprinklings of misinformation (such as the widespread misconception that "Common Carrier" status has anything to do with ISPs (they're more likely to fall under the "Safe Harbor" Act, and practically none of them (at least in the internet "subsidiary holding" of the main company) have anything to do with anything that "Common Carrier" status would even apply to).

To make a long story short, it seems like every major corporation out there is trying to eat a larger slice of an ever-shrinking pie, and the consumer is getting the bill.

Ya know, when I throw the synopsis together like that, it makes me wonder why corporations seem to have so much power... then I remember the Golden Rule, "He who has the gold makes the rules."

This was not an attempt at sarcasm or a personal attack; merely my musings on the subject, and an attempt to learn something by explaining it to someone else (which, surprisingly enough, sometimes actually works).

Re:Is that legal?

[Kadin2048]

I think what happens is that there are always ads in the national feed. They don't just transmit dead air or bluescreen for the local cablecos or broadcast stations to transmit on top of -- that would just be a waste.

So instead they have some ads in the national feed that aren't allowed to be overplayed. These cost seriously big bucks. Then there are other ads, which cost less, that still go out on the feed, but which the local operators can run local spots on top of, if they have them available.

These spots cost less, because not everyone sees them -- they only get seen if the local operator doesn't have any advertising to cover them with, or if you're watching the national feed directly somehow (via satellite).

This is why if you watch a show via a national satellite provider, you'll see the same number of ads, but they'll all be for national companies. If you watch the same show on a local broadcast affiliate, some of those national spots will be covered up by local ones.

The choice of which ones get covered over isn't, I think, totally random; I'm sure the national advertisers pay differently for "don't cover" and "may be covered" airtime.

Re:Is that legal?

[Actually, I do RTFA]

The CleanFlicks issue was a video store that rented the videos to people who didn't own them, and that isn't fair use.

Just like Blockbuster, NetFlicks, et al. The problem was that they modified the copies. Owning a copy of a film does not give you the legal right to even make one modified copy.

The person who modifies an MP3 buy adding "buy coke" in the middle violates copyright law. Just doesn't distribute it, so there is no practical way for them to get caught.

IANAL

Re:Is that legal?

[Opportunist]

But to be deriviate, a work has to be considerably different from the original. You have to add your own creative work, either as a parody where you use the original to either parody the work itself or something else (like Weird Al does), or you have to use it in a completely new context, using the work to create something completely new (like in collages).

Neither is the case when you just switch out the ads. Furthermore, I did not requrest a deriviate work, I requested the original. When my ISP gives me the deriviate, it's like getting Weird Al's Couch Potatoe when asking for Eminem's Lose Yourself. Somehow I doubt anyone wanting the one would be happy with getting the other. And neither would Al or Eminem be.

Now, in case of ads, it maybe does not matter to the person requesting the page, but it certainly matters to the one paying for the ad. And, well, you know our world. It may not matter what you want, but I guess it does what a company wants, so...

Re:Is that legal?

[Opportunist]

First of all, I'm not so sure anymore with today's copyright that you would even be allowed to do it just for yourself. But even if, the ISP isn't doing it for itself, it's doing it for you, its customer. BIG difference. You are not the one modifying the page (which would probably be legal, or all those ad removing programs would be in some kind of legal trouble). The ISP is modifying the page for you, especially it is doing this without your request.

Re:Is that legal?

[Opportunist]

The main difference here is that they most likely have contracts with the networks to make this kind of behaviour legal.

Now, I doubt the ISP has contracts with every single content provider on the planet.

Re:Is that legal?

[Opportunist]

It's likely they have contracts with the networks (I doubt a local cable company would dare to piss off, say, Fox). But do you think that some ISP has contracts with every single provider of content on the planet?

Re:Is that legal?

[centinall]

There could also be, depending on the content injected, a possibility of cross site scripting. I'm not saying I know how it would be done, but who then is liable for any damages done?

Re:Is that legal?

[Opportunist]

It will depend on the countries involved. I don't even want to figure out what kind of headache is being created with a page hosted in the US, with ad content from Europe viewed in Australia. Just to add a little insanity, using a TOR Router in China.

This is going to be a very interesting time for lawyers.

For the uninitiated

[Anonymous Coward]

BT stands for "British Telecom," Something they failed to mention, except in TFA

I hate it when people use too many arbitrary abbrivations. Let's start actually typing out names to set a context, then let people abbrivate in comments...

Re:For the uninitiated

[moz13]

I agree. It's annoying when I'm reading a summary and I have to go look up what AT&T means. How am I supposed to know it means American Telephone & Telegraph?

Re:For the uninitiated

[Stooshie]

Over here in the UK, nobody needs to expand BT. Everyone knows what it means. (I assume you are not from the UK).

I'm sure stavros-59 just used it out of habit.

Re:For the uninitiated

[Rob T Firefly]

OK.

Re:For the uninitiated

[Anonymous Coward]

At first glance, I thought they were talking about Blackthorne (http://en.wikipedia.org/wiki/Blackthorne), which used to launch off an executable named "BT.EXE".

Hey, at least it caught my attention.

Re:For the uninitiated

[amias]

>Over here in the UK, nobody needs to expand BT.
>Everyone knows what it means

yep , Bastard Telecom.

Re:For the uninitiated

[Anonymous Coward]

BT stands for "British Telecom," Actually, it doesn't stand for anything.

It USED to stand for "British Telecom", and the company USED to be called "British Telecommunications plc", and it was often called "BT" for short.

HOWEVER, in 1991 it changed it's name to "BT Group plc".

See http://en.wikipedia.org/wiki/British_Telecom

Re:For the uninitiated

[Richard_at_work]

Actually, BT stands for nothing - its a contraction of 'BT Group plc'. British Telecom stopped trading in 2001 when mmO2 plc and BT Group plc diverged and started trading as two separate companies.

Re:For the uninitiated

[cmsd2]

BT stands for "British Telecom," Something they failed to mention, except in TFA I hate it when people use too many arbitrary abbrivations. Let's start actually typing out names to set a context, then let people abbrivate in comments... It's not British Telecom. It hasn't been so since 1991 when it changed its name to BT Group Plc.

Re:For the uninitiated

[Anonymous Coward]

I thought it was Bit Torrent.

I was trying to understand why Bit Torrent was intercepting files and replacing them with ads though.

Re:For the uninitiated

[AndrewNeo]

While I can understand that you may not have known what AT&T meant the first time you saw it, it's a rather unique acronym so you'll probably at least remember it's a telephone company in the US, or something like that, the next time you see it. However, the first thing I think of when I see 'BT' is BitTorrent..

Re:For the uninitiated

[Anonymous Coward]

Over here in the UK, nobody needs to expand BT. Everyone knows what it means. (I assume you are not from the UK).

O rly? Has bluetooth and bittorrent not caught on there yet?

Re:For the uninitiated

[Anonymous Coward]

Thank you, because I thought maybe it was referring to BitTorrent, but that didn't make much sense to me.

Re:For the uninitiated

[TTURabble]

Bit Torrent?

Re:For the uninitiated

[level_headed_midwest]

Is that the one Simon and the PFY started?

Re:For the uninitiated

[Anonymous Coward]

That's why we have editors.

Oh wait.

Re:For the uninitiated

[ray-auch]

> BT stands for "British Telecom,"

No, it doesn't (anymore). The whole brand and company is "BT". They dropped the British bit (I forget when) when trying to become a global brand.

The full name of the company is "BT Group", but typically when naming companies you don't include the "group" or "plc / ltd. / llc" bits.

The website is also www.bt.com - check out the page, no mention of "British" whatsoever.

If you wanted to identify the company better, for folks that don't know it, you could say "BT - a major UK telco & ISP - ..." or something like that, but identifying them as "British Telecom" is simply incorrect.

Re:For the uninitiated

[Anonymous Coward]

Err, everyone calls it BT.

Re:For the uninitiated

[Isvara]

It isn't arbitrary at all. BT haven't even called themselves British Telecom for years now. (Since the first time they rebranded, when they got rid of the dated yellow dots logo.)

Re:For the uninitiated

[Anonymous Coward]

You're definitely not from the UK. Anyone saying BT in the UK (unless it's in a very specific context) will be assumed to be talking about British Telecom. They're part of the furniture mate. A fucking ugly, circa 1970s part (remember the stunt they tried, trying to patent the hyperlink?), but that's what they are.

Re:For the uninitiated

[Anonymous Coward]

BT has stood for British Telecom since long before slashdot existed.

Get with the program(e).

Re:For the uninitiated

[Anonymous Coward]

In fact, BT stands for... err, BT. It used to stand for British Telecom but changed its name to plain simple BT.

There's a bunch of other related companies including British telecommunications PLC too, but BT really is just BT.

Advertisers

[Anonymous Coward]

You can just tell the online advertisers (The ones which invent ways to bypass all your lovely ad filtering) are going to take this lying down. (End Sacrasm)

How does it distinguish between an advert and real content?

I hear every now and then that SSL could be used to stop this, is this realistic given the load ad-servers would be under?

Re:Advertisers

[Stooshie]

Advert tend to be fairly standard image sizes(468x60 and 120x60 being the most common) and are quite often delivered in iframes. They also tend to be delivered via a very small number of advert providers.

Re:Advertisers

[Stooshie]

Unfortunately, if it is charities they are targetting then they are the least able to fight back.

Block 'Em

[physman_wiu]

You could always use Firefox and install the AdBlock Plus extension. http://adblockplus.org/en/

Re:Block 'Em

[cybergrue]

I'm not sure that this would work. There are two methods mentioned in the article, switching content, and injecting Javascript into an existing page.

Ad block works by maintaining a black-list of server names. I don't know how the injection works, but it could involve random ip addresses, making the creation of a workable black-list very hard. Another method is to forge the address of something you don't want to block. If combined with a history file (generated and maintained by the ISP) of which sites the user (ip+mac address) allows images from, then it could be almost impossible to effectively block these ads. Someone above suggested a reverse DNS look-up which might work.

The second issue is the injection of JavaScript into the web page itself. ScriptBlock works here, but I am running in way too many sites where even simple things are done in js, like displaying a single static image. This means I have to create a white list of sites I allow js from to get the site to work. Now what happens if the injected js ad appears to come from a site I have white listed. I get ads in a page that was previously ad free. Again, by using random identifiers for the injected content, the creation of effective white and black lists becomes very difficult.

Furthermore, this type of deep packet inspection could be (ab)used in other ways as well, such as keeping track of how many ads you have viewed in a certain time-frame, and or to determine if a user has ad-blocking capabilities. The ISP could change their terms of service to require you to accept their ads, and turn off your connection if you don't.

Of course, the way around this would be to have your own proxie server that appears (at least to the ISP) to be playing nice and accepting the ads (even clicking on a few randomly) while the user chooses what they actually see.

Um, Replacing Charity Ads?

[DigitalSorceress]

Wow, talk about low:

In addition to the 18 million regular advertising injections or hijackings, it appears charity advertisements were hijacked and replaced with Phorm advertisements.

        "The advertisements were used to replaced [sic] a 'default' charity advertisement (one of Oxfam, Make Trade Fair or SOS Children's Villages) when a suitable contextual or behavioural match could be made by the PageSense system."

Re:Um, Replacing Charity Ads?

[zwei2stein]

Its actually good thing they did this.

Great way to influence public opinion against them and convince even usually non-caring people that something evil was going on.

Now if only major news picked this up and made big deal out of it...

Re:Um, Replacing Charity Ads?

[mpapet]

There's a very good reason they chose those ads. Do you think the non-profits have the resources to litigate this? What would they litigate exactly?

It's a big win for BT, and probably Comcast here in the U.S because there are so many legal issues that none of the harmed companies can afford to litigate it. It would be a career's-worth of work for both sides, with the ISP getting the vast majority of their wishes met either through litigation or purchasing legislation.

Re:Um, Replacing Charity Ads?

[aproposofwhat]

Do you think the non-profits have the resources to litigate this? What would they litigate exactly?

Litigation? I can see the likes of Michael Mansfield sharpening his pencil and accepting the case pro bono without a second thought.

As to what they would litigate, theft seems a good starting point - if I have paid for advertisements to be served from a site, and some Jumped-Up Fucking Marketing Shyster then intercepts those adverts before the user has a chance to accept or reject them, then the JUFMS has stolen some of my potential income.

I don't see it taking more than a couple of days argument, though the level of damage could be debatable.

Re:Um, Replacing Charity Ads?

[fhage]

TFA says BT purchased the ads they replaced. The Charities got free advertisements if they were not replaced.

Re:Um, Replacing Charity Ads?

[Anonymous Coward]

It appears that the purchased the charity ads for the express purpose of substituting them. So they weren't stealing - the charity ads were the "place holders".

Still, I agree. Very, very low.

Re:Um, Replacing Charity Ads?

[the_B0fh]

If they replaced oxfam ads with pr0n ads, the results would be... interesting.

Re:Um, Replacing Charity Ads?

[Inda]

Ah the truth. Shame you posted late in the game and not many will see it.

I hate Phorm with every bone in my body - I've complained to my ISP (Virgin) already - but they are not going to steal your ad revenue from your site. You will buy ads from them just like you buy adsence from Google now. The difference is Google knows what text is on the page you're reading and maybe a little more, Phorm will know your left nut size.

If anyone really thinks Phorm is going to out and out steal from you, you need to think again (and take the tinfoil hat off).

Re:Um, Replacing Charity Ads?

[soliptic]

Indeed.

I work for a charity -- not one of the three listed, but one fairly well known within the UK -- and when I get to work tomorrow I intend to spread the news about this, urging my colleagues to write and express their disgust.

Were I to send an email around saying "Phorm... hijacking... ISPs... advertisments... privacy issues... yadda yadda" I expect everybody would shrug and say, "Eh, I don't really see the big deal." Now I get to send an email around saying "Phorm... hijacking... advertisments... STEALING advertising that charities have paid good money for from their highly limited budgets..." and I fully expect everybody to say "WTF? That's despicable!"

Bullet, meet foot.

Also... agreed: CUNTS.

Re:Um, Replacing Charity Ads?

[soliptic]

Ah, see, now I scroll down a bit further, and see this. So they're not technically replacing ads which the charities have paid for.

Still, isn't it a tragic shame I never quite grasped that clarification, and my explanation to my colleagues about "replacing charity ads" therefore unfortunately implied that that is exactly what they did...

Frankly in my book they (Phorm) are still cunts even if they're replacing ads for Random Corporate Shitheads, and I relish the opportunity to give them some bad press.

Furthermore, BT are still cunts even if they'd never got involved with Phorm at all (anyone in the UK will know what I mean here).

So they both deserve all the stick they can get, even if it's undeserved. If you see what I mean.

(random off-topic aside: why does slashdot feel the need to render my bog-standard <p>paragraph</p> markup with triple line breaks between each paragraph?)

Re:Um, Replacing Charity Ads?

[Anonymous Coward]

No it doesn't:

The second phase - a traditional ad-selling campaign runby 121 Media selling ad space to various listed companies, for the 2 weeks of the trial itself, during which time, the ads would be placed to "replace" ads by various named charities with the ads of the companies on the list according to PageSense technology. The affected charities were Oxfam, Make Trade Fair, and SOS Children's villages.

It is unclear as to where this charity ad obliteration was occurring, there is no indication that the charities were paid for such ads, nor that their consent was obtained. It should be noted that the financial accounts for 121Media for the period in question do not appear to show any charitable donations.

The issue as to whether the obliterated charity ads were on Google search result pages, is currently being investigated.

from http://www.wikileaks.org/wiki/Talk:British_Telecom_Phorm_PageSense_External_Validation_report

Re:Um, Replacing Charity Ads?

[Anonymous Coward]

TFA says BT purchased the ads they replaced. The Charities got free advertisements if they were not replaced. Irrelevant. They payed to have the ad appear, not be bought off. There was potentially more value to them in having it shown than they paid for (if there wasn't, they were stupid to buy it). Thus they probably still lost money.

Any purchase worth making is an exchange in which both parties gain something more valuable to themselves than that which they give up. Thus you can't just switch what you give someone. If I buy a hard drive, you can't send me a plant of equal value because someone else pays you to.

Re:Um, Replacing Charity Ads?

[Anonymous Coward]

Just because they did their testrun against their own ads, do you think this will happen in the future? Think all the ISPs will play nice and only use Phorm against sites where they first buy ads, to replace them by... their own ads?
That's the same as saying that nuclear weapons pose no threat, because they only detonate on test-grounds... well, and the occasional japanese city...

Copyright infringement

[RichMan]

I see lawsuits killing this really quickly. The originating site is creating a unique copyrightable HTML text document. This document is being modified in transit against the wishes of the originator before being delivered to the destination.

Some lawyers are going to make megabucks off this one.

Re:Copyright infringement

[mabhatter654]

better yet, what happens when they swap ads in for illegal material? Since they have read the page (to give targeted ads) and replaced the data (they acted on the illegal info) would they not become distributors of said illegal material and lose CC status in a big way? Making them criminally liable for every torrent search, and every (insert bad illegal thing) "think of the children" crime that their users commit.

Spidey Sense Tingling

[whisper_jeff]

I sense a major lawsuit coming. I can imagine more than a few laws being broken by this sort of manipulation (copyright violations, hacking violations, interference with business violations, etc.). I cannot imagine this will go on for too long. Obviously, I'm not a lawyer (but does that stop any of us form posting our opinions on legal matters?...) so I could well be wrong, but I can't imagine this not resulting in major lawsuits.

What's going to happen...

[physman_wiu]

...companies are going to start paying the ISPs to advertise for them instead of companies like Google. They are feeling the heat from losing money on their bandwidth, now they have to think of a new strat. to get the cash flowing.

I for one don't mind this in some cases if it means that they would actually have the funds to hook the rest of the United States up to highspeed.

Re:What's going to happen...

[poetmatt]

Uh?

Why not just use Google's ads (which are far superior) and monetize them? It's not like google refuses to cut you a share of the profits.

Or you can use completely irrelevant ads that nobody reads, that don't work, such as the viagra/enhance your mangina ads. If an ad isn't relevant and interesting, nobody will read it. This is more on the intrusive category, which means its unwelcome and useless.

Also, what about the funds the companies already have? Surely you dont' think they'd keep pocketing the money like they already do or anything, right?

Re:What's going to happen...

[physman_wiu]

Well if I were running a company selling a local football teams T-shirt (or the like), I think that I would rather pay my ISP to target the people directly in my city.

There are already targeted ads like that but Google's ads are relatively unobtrusive (at least I don't think I've clicked on one in say a year or so, not from the search pages anyway), where as it's more difficult for Mom's and pops to ignore that HUGE graphic banner on almost every page that displays their favorite team.

Re:What's going to happen...

[Anonymous Coward]

ISPs getting paid for advertising is like the tail wagging the dog. If there was no content of value on the internet why the hell would I fork over money to an ISP every month? Without ad revenues to back it up the content will dry up.

Re:What's going to happen...

[physman_wiu]

I think it forces a little bit more competition. Now I don't just have to go to the Big Boys to be seen. Just because my ad is through ValueClick or some other agency like that, doesn't mean that's it's going to target who I want it to.

In some situations, and with certain types of local ads this would be a good way to increase revenue.

Not that everyone under the Sun who wants to advertise is going to switch to ISP (as there are many situations where ad companies do a much much better job).

Re:What's going to happen...

[aproposofwhat]

All that can be done by the site serving the ad through simple scripting - we know where the source address of the request is (well, roughly), and it's simple to serve a different image based on source IP address.

Oh, and good luck to the Shots for next season in the League :P

Misrepresentation

[Rob T Firefly]

There's another issue. Say I post a banner for Charity X on my site, with a note saying "I support these guys with all my heart and soul, and I urge my readers to do all they can for this cause." You go to my site, but your ISP swaps said charity banner for an ad for personal ads or punching the monkey for a ringtone or some other damn thing, making it appear to you as though I'm imploring you to purchase something I would never willingly endorse.

The ISP is then responsible for using my image to endorse their product to my readership, without my permission. Do I have recourse against them for perpetrating such a fraud? IANAL, etc.

Re:Misrepresentation

[Anonymous Coward]

Do I have recourse against them for perpetrating such a fraud? IANAL, etc. Yes you have - although IANAL as well, they may be guilty of copyright infringement at $750 per work, possibly illegal wiretapping, fraud and forgery, depending on what exactly they are doing.

Re:Misrepresentation

[Mr. Slippery]

IANAL either. But this stinks to high heaven of copyright violation to my untrained nose.

The pages on my server are works created by me, and I automatically hold copyright. If an ISP alters them in transit in any way - including inserting or changing ads - they are creating and distributing derivative works. But the distribution of derivative works is controlled by copyright law, and I sure as fsck didn't give any ISPs permission to distribute derivative works.

If I become aware than any ISP is inserting ads into any of my pages, I will definitely be consulting lawyers. Res ipsa loquitor. Let the good times roll.

Re:Misrepresentation

[Bel-Shamharoth]

Websites have to sign up to the service for the filtered adverts to be displayed. If you haven't signed up then you won't have this problem, regardless of what the visitor's ISP is doing.

Re:Misrepresentation

[Jason Levine]

Good point. Not only could a person's image be tainted by such a swap ("how dare you support that you sell-out!"), not only could you wind up losing money (no clicks on your real ads = no money), but someone could get injured/scammed based on your reputation ("Blogger X whom I trust is recommending Product Y. How bad can it be?"). Combine the two and you could even be sued ("You recommended Product Y and it injured me. I'll see you in court!"). Not that a lawsuit like that might have any merit, but it could still be a pain and cost you time and money.

This sounded awfully familiar to me and now I remember where I've heard all this before. Spyware. There are certain spyware programs that, when installed on your computer, would replace the ads that a site displayed with its own ads. Website owners were outraged by this. At least with the spyware, though, the user had to have the application installed on the computer and could remove it (sometimes with much difficulty). With Phorm, the "spyware" is installed on the ISP's systems. You, as a user, aren't aware that it is there and have no say as to whether it replaces ads or not. (Yes, they give you a chance to opt-out, but I can guarantee they'll hide the page for doing so as much as possible.)

I think we need to call Phorm what it is: Spyware on a massive scale.

Re:Misrepresentation

[vanyel]

My understanding of the way this works is that the devices at the ISPs are basically sniffers keeping track of who's interested in what. Web servers that serve ads then sign up with the ad companies and link to ads on the ad company web servers, which then match up who's viewing the web site with what stuff they've shown an interest in and return an appropriate ad. The result is that nothing is replaced, it just controls what they serve up in the first place, and only for sites that request it.

When you think about the data volumes in question, it's actually surprising they can do that much, actually modifying existing content on the fly would be very "challenging".

That doesn't mitigate the privacy issues, but at least it's not as evil as one might think. I'm still thinking about using a tunnel to a proxy server though.

I like how it's charity ads that were intercepted

[3-State Bit]

It's like the thinking goes "let's substitute out something utterly inconsequential and that will have no ramifications whatsoever". No, a charity isn't going to sue your pants off, so I guess it's okay, right?

What's next, Nike tests shoes (leaked codename: "rental") that deteriorate in 30 days -- on retarded children. Through a charity donation. That they write off their taxes the full value of.

Seriously: these are the times I'm glad to procrastinate about being an internet activist[1], because YOU CAN'T MAKE THIS STUFF UP. I couldn't have warned of this if I had tried.

[1] CHILL, guy with the sig 'whenever I hear the word activist I reach for my revolver' It's going to be all right.

Mod Parent Up!

[Cassini2]

I noticed that quote too. It is completely despicable that they would remove charity advertisements. Actually, I think the entire system boils down to theft and unlawful interception of traffic.

What if the phone company inserted commercial adds when you were talking to someone on the phone?

Re:Mod Parent Up!

[Nursie]

"Hi Jim, I just a bought a great new handheld console"
"Oh yeah, what did you get"
"A Sony Pzzzzzzzzzzzzzz^^^^^T Nintendo DS proudly sponsors this phonecall! Your pal loves Nintendo DS! bzzzzzt *click* so yeah you should totally get one so we can play against each other dude!"

Re:Mod Parent Up!

[vux984]

What if the phone company inserted commercial adds when you were talking to someone on the phone?

That's nothing. What if they intercepted and changed what was said:

You say: Hey Jim, How are ya?
He hears: Hey Jim, I wish I was eating a tasty Mars bar.

He says: Ok.
You hear: Ok.

You say: Wanna go see a movie?
He hears: Wanna go see Superbad, and get some popcorn?

He says: Uh... sure.
You hear: Uh... sure.

You say: Cool see ya.
He hears: Cool. Can you pick me up some Laramie cigarretes. They take me to flavor country!

He says: Uh... say what?
You hear: Uh... you too.

Re:Mod Parent Up!

[mabhatter654]

I doubt these were paid advertisements. BT (like TV and radio) probably floats a few charities in the ad rotation as a public service. Then they get to claim a portion of the ad space (that would have been unused) as a "donation" cost. So nobody was hurt at all here.

Re:Mod Parent Up!

[TheRaven64]

What if the phone company inserted commercial adds when you were talking to someone on the phone? Wrong analogy. Instead, consider a cable or satellite TV company taking an over-the-air channel, removing the adverts and sending it to their customers with different ones inserted, without the consent of the original broadcaster. Depending on how it's done, this might be even worse, since the original advertiser would be billed for customers who saw a competitor's advert.

Re:Mod Parent Up!

[TheGratefulNet]

I've never actually HEARD a backspace before. seen 'em but never heard 'em before.

(do you have an mp3 snippet handy?)

Re:Mod Parent Up!

[Anonymous Coward]

What is wrong with you people? The ads are there ANYWAY. Irrespective of the ISP actions ads are being served from some ad network - using this technology an ad that is different from the "default" ad is inserted. If you are going to complain about this technology at least get your facts straight.

Sites and others will move to SSL

[visionsofmcskill]

This sort of BS will cause standard non-commercial / login sites to all move to SSL.

redirect Http://youriste.com to https://yoursite.com/ before anything is served.

If anyone thinks any of the CPM ad networks or major sites will allow this for even an instant, your eye is not on the money.

If they use such tech for the less easily encrypted protocols... you'll find those as well slowly pushed into it.

Which leaves the ISP's with two options if they wish to pursue this, they can proxy everything their customers connect to and essentialyl monkey in the middle the whole affair (not possible due to sheer processing/bandwidth... yet)... or they may form an alliance with the ad networks (scarier more likely prospect).

Oxfam ads substituted

[andyh-rayleigh]

I could see Oxfam (and the other charities who had their ads substituted) getting their lawyers to shakedown BT for a substantial "donation" as an alternative to being sued.

Re:Oxfam ads substituted

[fhage]

TFA says BT purchased the adverts for the charities. It was not clear if they informed the charities beforehand.

Re:Oxfam ads substituted

[Anonymous Coward]

Wait until competitors override each others adverts.

Dirt slinging match will follow :)

The problem here

[Midnight Thunder]

Other than the ethical issues, that these guys have no issue with (money before ethics), there is the potential issues of having advertisement for a competing product. Imagine going to Mercedes.com and having an advert for BMW. Also, isn't this likely to deprive content providers of advertising revenue?

iptables or squid-cache: ads -- /dev/null

[flyingfsck]

I'm sure there is a way to use IPtables of Squid-cache to remove any and all ads from packets. If they can be put in, then they can be taken out just as easily.

Re:iptables or squid-cache: ads -- /dev/null

[AndrewNeo]

It's called modifying your hosts file.

Re:iptables or squid-cache: ads -- /dev/null

[dave420]

Nope. If they've edited the HTML of a page to insert an ad, knowing what is new content and what is original will be impossible, as they can shift around IP addresses and server names for their off-site content.

Wow another good reason for adblock

[multi-flavor-geek]

This is actually sick, great, lets steal from the charities to deliver targeted ads for Viagra, we need more boners not food for starving children. I think that they should be ending up under investigation for all kinds of privacy and copyright violations for this one. Hope they fry

Possible temporary fixes....

[postbigbang]

1) write a checksum to a page; if it doesn't match (or another hashing method doesn't match) warn the user that the page has been intercepted and corrupted; the code might not be too tough

2) Use page receipts to vet page authentication

3) litigate, especially for copyright violation as the page has been misused by an intermediary for a purpose not intended by the page's author

4) other solutions that someone will think of; stop the page vandals NOW!

Re:Possible temporary fixes....

[vux984]

1) write a checksum to a page; if it doesn't match (or another hashing method doesn't match) warn the user that the page has been intercepted and corrupted; the code might not be too tough

So much for using adblock.

Re:Possible temporary fixes....

[kvezach]

Intermediate term fix: Tunnel everything over IPsec. If ISPs are going to act like Eve or Mallory, let's treat them as such.

Re:Possible temporary fixes....

[Anonymous Coward]

great solution until the ISP decides to block all IPSsec traffic.

Re:Possible temporary fixes....

[Abcd1234]

Huh? Adblock doesn't change the contents of the HTML being delivered to the browser (unlike these products). It just causes the browser to render the page differently (ie, not downloading or displaying images, embedded objects, etc).

'course, these products could just re-compute and re-insert the checksum into the page...

Re:Possible temporary fixes....

[vux984]

It just causes the browser to render the page differently (ie, not downloading or displaying images, embedded objects, etc).

I'm actually not sure at what level or how exactly adblock is implemented. I thought it essentially filtered the html to strip out blocked content, collapse elements, etc. But even if adblock did rewrite the html I guess it would depend whether the checksum was checked before or after adblock got to it.

'course, these products could just re-compute and re-insert the checksum into the page...

It should logically be implemented as a digital signature. It would make the page tamper proof, with much less overhead than full on encryption of everything.

Re:Possible temporary fixes....

[Abcd1234]

True, though then you need to get the public key in order to validate the signature. And that requires you to... download the public key.

So, you recompute the digsig using your own private key, then intercept the public key request and replace it with your own.

No... this is not trivial. :)

Re:Possible temporary fixes....

[goodmanj]

1) write a checksum to a page; if it doesn't match (or another hashing method doesn't match) warn the user that the page has been intercepted and corrupted; the code might not be too tough

ISP adds its own ads, recomputes the checksum, and changes the checksum value.

D'oh!

Checksums and signatures are only useful if the sender and receiver have shared information inaccessible to the man-in-the-middle. For public web pages, this isn't true.

Re:Possible temporary fixes....

[goodmanj]

Err, I take it back. A public key signature system would work, a simple checksum would not.

Re:Possible temporary fixes....

[goodmanj]

Err, I take *that* back. Without an out-of-band communication, you can't be sure you've been given the website's public key, and not a fake key provided by your ISP.

Re:Possible temporary fixes....

[Anonymous Coward]

Intermediate term fix: Tunnel everything over IPsec. If ISPs are going to act like Eve or Mallory, let's treat them as such.

IPsec is a huge hassle. How about that well-known easy-to-use secure web technology: https

Re:Possible temporary fixes....

[AmiMoJo]

My solution is simple: reduce my payment to my ISP by 5 euros a month to cover the cost of a VPN service.

Re:Possible temporary fixes....

[postbigbang]

Simplicity may not be bliss. I wonder how many months your ISP will let you deduct the 5e from your bill until they shut you off completely, removing you from consideration.....

Re:Possible temporary fixes....

[Anonymous Coward]

That's why they should've said "No" to apples.

Re:Possible temporary fixes....

[pbaer]

What stops them from intercepting the interception?

Re:Possible temporary fixes....

[postbigbang]

too much work. imagine the possibilities and the parser you'd have to write to do that.

HTTPS

[Anonymous Coward]

The original website could run HTTPS.

ISPs won't be able to alter the original content short of a man-in-the-middle attack.

Re:https

[wild_berry]

The cheaper answer is HTTP 1.2 which mandates MD5 and SHA1 hashes in "hash-md5: " and "hash-sha1: " fields of the header.

Re:https

[darthflo]

Which will help exactly how?

Two standardized hashes in standardized header fields are not much of an issue to adjust after the page has been enhanced with ads.
There are two solutions: Strong encryption or cryptographic signatures (i.e. more computationally expensive to intercept than ads bring in) or custom algorithms (e.g. some javascript comparing a server-generated hash to the delivered page. In this case, "cracking" the JS needs to be more expensive than injecting ads for the period uf unpatchedness would generate).
Also, apart from all the techno-babble: Lawyers, lots of them. Favourably blowing themselves up at 121Media/BT's headquarters or suing the crap out of those companies in court.

Re:https

[Jellybob]

To easy - the proxies inserting ads could just recalculate the has, and insert their own headers instead.

Time for crypto...

[Captain Zep]

So, I guess servers are now going to have to start doing widespread cryptographic signing of web pages so that users can tell whether or not the content they asked for has been tainted by going through a dirty inter-tube.

Z.

Brief Overview

[skinfitz]

Interesting - whole system runs on RHEL (told you it was evil..) and multiple Squid processes. Adds some latency into browsing (obviously...) Old system dropped javascript tags into URLs but later version did not (resulting in some users having some javascript appearing in their forum posts - like that guy on the motorbike phorum if anyone remembers that incident) Apple.com among the 'download target' sites (page 49) but surprisingly due to Evil, not Microsoft or Google.

Do we have to...

[camperdave]

... during the covert trial a possible 18 million page requests were intercepted and injected with JavaScript and about 128 thousand charity ads were substituted with the Phorm Ad Network advertizements purchased by advertisers...a means of serving advertising directly through Layer 7 interception at ISP level...

Do we really have to go down this road? I mean, if we can't trust that the page we're looking at is the page that was served... Are we going to have to go to HTTPS for our browsing now? Are we going to have to have MD5 checksums on our web pages to make sure they weren't tampered with? Stuff like this layer 7 interception will make it inevitable.

Adblock

[infonography]

Sorry to slashdot and others, but I don't feel the slightest guilt in using that tool (ok slashdot is on my white list) but inspect my packets as deep as you like when adblock sees your ads now PHORM especially will get the boot.

Google Ads

[Stooshie]

• Ask BT to replace ads with my google ads
• ...
• profit!!!

Would a copyright challenge be possible?

[supersnail]

Copyright conditions usually have a "reproduced without modification" clause so someone who's website is copyrighted and contains ads could thoereticaly sue the ISP for modifing thier page.

My bet is that if they once replace a google ad with one of thier own they will drown in subpeonas.

Forum security thingy

[LiquidCoooled]

Do I recall recently that some sort of worm had attached itself to different forums around?

from the pdf:

page 5
3) It was noted that posting to some web forums through PageSense caused the Javascript tag to be appended to a number of users' posts. A fix was provided for this by 121Media towards the end of the trial, following which the issue was not detected. It should not arise with ProxySense as no tag is appended.

shocking.
So far the rest has been as bad if not worse.

Tortuous Interference W/ Contractual Relations?

[Anonymous Coward]

Some legal eagle can set me straight here but this sounds a bit like a case of tortuous interference. The site owner and the user have a contract that the viewer views their ads in exchange for the content. The ISP is coming in and interfering with that contract in a material way by replacing ads. Somebody could make some big money on a class action -- as tortuous interference settlements are often very large.

Loss of Common Carrier Exemption?

[OmniGeek]

It occurs to me that, at least in the US, an ISP that does ad injection *may* be losing its common-carrier status by changing the information that they convey from a Web site to the subscriber.

Consider that the data is being edited on-the-fly based on its content -- i.e., whether or not it's a banner ad. I think a good case could be made that this violates the conditions for a common carrier.

Question is, does this have any legally useful consequences in trying to prevent ISPs from doing it?

Re:Loss of Common Carrier Exemption?

[Red Flayer]

It occurs to me that, at least in the US, an ISP that does ad injection *may* be losing its common-carrier status by changing the information that they convey from a Web site to the subscriber.

Newsflash: ISPs do not have common carrier status.

This means that whatever safeguards you associate with common carriers, are not enforceable wrt ISPs. A lot of the big ISPs are very happy with the current situation, since they basically get the benefits of common carriers, without the drawbacks (such as not be allowed to throttle certain users).

Re:Loss of Common Carrier Exemption?

[v3rgEz]

Absolutely, and you've come up with a great point. If they are scanning and replacing ads, then sure (since as you point out they lose common carrier status) they can scan a) warez b) pirated music/movies c) illegal porn d) libelous material, at least at some levels. By editing some material they substantially endanger their rights to distribute all material, per what I was taught in Intro to Internet Law (could be outdated by now) and ISP's won't have many customers if you can't download your mp3z.

Re:Loss of Common Carrier Exemption?

[Jellybob]

per what I was taught in Intro to Internet Law

Holy crap... is this a moment where someone on /. can say "IAAL"?

Re:Loss of Common Carrier Exemption?

[nuzak]

> Newsflash: ISPs do not have common carrier status.

They have data service provider status, which is essentially very similar. Common carrier status applies almost entirely to freight.

Anyway, last I looked, BT stood for British Telecom. Different set of laws, and an overall regulatory climate that is not going to be at all favorable to BT.

Re:Loss of Common Carrier Exemption?

[goodmanj]

To hell with "common carrier": a network that deliberately mangles transmissions isn't a "carrier" of any sort.

It's as if I called my grandma on the phone, and ten seconds into the conversation the phone company started playing a recorded ad for computer equipment on my end, and an AARP membership ad on her end.

You can bet Grandma would be on the phone to complain to her congressman about that ... oh, wait.

Re:Loss of Common Carrier Exemption?

[Red Flayer]

They have data service provider status, which is essentially very similar.

All the benefits (no requirement to monitor throughput, etc) without any of the drawbacks? I'll read up on data sevice provider status, since I am not familiar with it -- thanks for the tip.

Anyway, last I looked, BT stood for British Telecom. Different set of laws, and an overall regulatory climate that is not going to be at all favorable to BT.Parent to my post was referring to the US, which is why I brought it up.

German Laws

[Anonymous Coward]

In germany there are law against that.

- Surpression of Data Â303 StGB (up to 2 years in prison)
- can be extended to 5 years if the data is important for some organization

- Interception of Data 202b StGB (up to 2 years in prisong). Even producing or owning software or hardware that is designed to do this is a felony.

It should be noted, that the customers browser sends a request to see one ad, which is then answer by the ISP with a different add. This could be interpreted as forgery, because the ISP disguises as the legitimate source of the add.

As an Oxfam contributor, I am pissed

[Anonymous Cowdog]

BT stole part of my donation to Oxfam.

I give money to Oxfam. They take my money, and use it to run their charity, which includes helping people as well as doing some overhead like, for example, creating ads and managing ad campaigns. Seems like a perfectly good use of my donation.

But now I find out that some of these efforts have been sabotaged, stealing part of the money I donated!

Not only does Oxfam have standing to sue, I would think Oxfam donors have also been wronged.

But worst of all, of course, is the loss of aid to the people who really need it. Hijack an Oxfam ad today, and another child goes hungry tomorrow.

https

[TheSHAD0W]

I predict that soon all web pages will be served via https rather than http. The encryption puts a heavier load on the server, but makes it impossible for such injections to be performed.

This will affect computer forensics

[fhage]

1. Insert page refreshes to child porn or terrorist training sites into a dissident's computer.

2. Extraordinary rendition!

Autodetect the tampering and redirect to https

[Cassini2]

The most protocol efficient way to handle this is to use an MD5 checksum and JavaScript to detect tampering with the web page. If the web page is changed, then redirect the user automatically to an https server. That way, the https protocol is only used for users suffering from web-page tampering.

A more evil application of the Level 7 interception technology would be to intercept he GIF and JPG images of the advertisements themselves, and replace just the images. This would be more difficult to detect from JavaScript. Effectively, all the advertisements would need to be encrypted too. The big problem with encrypting images, is that it would make the progressive download and page display algorithms used by web browsers useless. It would also defeat any proxy and website caching software used by the ISPs.

Deploying Level 7 interception may lead to a market response that could ultimately increase the bandwidth costs of ISPs. It could force every internet communication to be a encrypted secure communication, defeating all in-transit caching algorithms.

doesn't anybody understand?

[Anonymous Coward]

1) The charity pays if the ad is served.
2) The ad is served if the snippet from Doubleclick (... insert fav vendor here) that the page owner has inserted into the page gets interpreted by the browser
3) The browser doesn't interpret the snippet from Doubleclick because it isn't there
4) The browser does interpret the new snippet from BT
5) The browser shows the BT ad
6) The BT client gets invoiced

==> in an unmodified page, Doubleclick and the page owner earn money

==> in a modified page, BT earns money

a) BT are trying to charge web site operators for sending traffic their way (no matter whether youtube or doubleclick)
b) would we want to grant page owners the power to stop modification (NoScript in Firefox modifies pages ...), which would allow them to sue BT for modifying the page

best regards,

os10000

Term and conditions

[TheP4st]

Excerpt from chapter 4 titled Terms and Conditions of the document.

Also consideration must be given to the opt-out procedure enabling user to circumvent the system. The latter issue regarding op-out could not be specifically trialed since BTRT concucted this test as a stealth trial.
The system does provide an opt-out mechanism and this was laboratory tested and verified. However the method of opt-out requires consideration. Since it involves the dropping of a web-cookie on the users machine to indicate an opt-out preference, which if wiped by the user means they will be opted back in.
The solution would of course be to make it a opt-in instead of opt-out. Most users would of course not opt-in without seeing a clear benefit for doing so. One obvious benefit would be that those that opt-in recive a discount on their internet connection. Simple and fair.

Re:Term and conditions

[mikael]

Or the ISP simply makes it a condition that by agreeing to the terms and conditions of the contract, they agree to be opted in to Phorm by default.

Pot calling the kettle black?

[Duncan Blackthorne]

ISPs complain that BitTorrent users are eating up all the bandwidth, and the MPAA and RIAA complain about "stealing" of IP through filesharing. Meanwhile, the RIAA and MPAA are breaking the law trying to turn a profit with their (pseudo) legal engine, and the ISPs are breaking the law with DoS/MITM attacks, and altering content on the fly! This is bullshit, complete and utter bullshit, and it needs to stop, NOW. Net Neutrality needs to be the LAW, and ISPs need to have the hammer dropped HARD on them over bullshit like this.

DPI - Charter ISP St. Louis

[jrwr00]

ARG its annoying, at times for web siggys ill use 468 by 60, bam gets replaced with a webad, but no JS... just the image ive even checked this with wget on my linux box does anyone else get the same thing im going to test more std banner sizes http://en.wikipedia.org/wiki/Web_banner

Re:DPI - Charter ISP St. Louis

[Slashcrap]

ARG its annoying, at times for web siggys ill use 468 by 60, bam gets replaced with a webad, but no JS... just the image ive even checked this with wget on my linux box does anyone else get the same thing im going to test more std banner sizes http://en.wikipedia.org/wiki/Web_banner You dropped your word salad all over my fucking Internet.

Absolutely actionable

[mlwmohawk]

From a legal point of view, I would say this is clearly something that the source web sites can sue over.

Insertion or replacement of advertising is vandalism, which is a criminal act.

It is probably arguable as product tampering.

I would say that even if the ISP has an agreement with the end user (overlooked in the small print) that allows this, they need to properly compensate the originating web site. These hijacked ads represent an improper interference of lawful business practices of the web site, i.e. providing a service sponsored by advertisement. By hijacking the ads, they deprive the website of earned revenue, which is theft.

Re:Absolutely actionable

[Forbman]

I would even argue that it takes the ISP out of the "common carrier" business, also.

And created a copyright violation

[Anonymous Coward]

in the process.

Or did they have the right to take a copy of the site's pages, make a derivative, and send that on?

Copy to forward is necessary.

Copy to change isn't.

Re:And created a copyright violation

[Jason Levine]

I think it is actually worse than copyright violation. It is fraud. When I have an ad on my website, it is an indicator that I either a) really like the product/service the advertised company is providing, b) will profit from viewing/clicking the ad, or c) really think that the charity being advertised is worthwhile. Phorm ads wouldn't fit any of those categories and yet are purposefully being injected into pages to make it look like A, B, or C are true. It is giving the impression of me approving/profiting from an ad that I am not approving and profiting from. In addition, it is taking money out of my pocket (or a charity's pocket) to make Phorm money. That's fraudulent activity in my book.

Re:And created a copyright violation

[mikael]

This was discussed in the forum digitalspy.co.uk

Phorm in the UK

One business user was updating the website for his home business. He used his home network connection to inspect the appearance of his website. To his surprise, he could not understand why the format of his website was consistently different from what he had intended. Disturbed by this, he reinstalled the OS on all his servers in fear of being rootkitted, rechecked all his security settings, reconfigured his firewall, and performed a packet trace on every connection made. In the end he noticed that various links on his webpages were being changed and that in particular some were coming from dns.sysip.net. Basically, this system redirected any links to adverts back to Phorm servers.

Customer who was Phormed

Re:And created a copyright violation

[The_Wilschon]

Just wait until they do it to some politico's campaign site.

VOTE OBAMA 2008!
Banner: Hey kids! Want a Marlboro?

That'd put a stop to things real fast.

Looking on the bright side...

[Anonymous Coward]

I suspect the charity ads were there as a control, after all, it's a test. Set up some "fake" ads (hey, we might as well give a few charities a freebie) and then use those to experiment on. That's my reading of it anyway, nobody's ads were "stolen", just dummies.

That said, it's still a downright evil thing to be doing, if I can prove that any of my IP has been infringed I'll be straight on to a lawyer. See? IP regs DO have a use. (Presumably "I don't Believe In Imaginary Property" thinks this is a perfectly legitimate tactic by BT?)

Re:

[TheWGP]

I think the best argument against this is twofold, from a legal perspective: a)compilation copyright issues and b)unwanted traffic. If you are, in fact, metered, the company most likely has your standard "bend over and smile while we do what we like" ToS attached - and this may or may not be enough to get around these issues. I think the unwanted traffic issue will be covered until a court is presented with a REALLY EXTREME example - like someone who an ISP accidentally sent 250gb of data to and tried to make them pay for it. The compilation copyright claim is probably stronger, but would require action from a third party - namely, the website owner or some such. For example, if an ad I've put up on my webcomic page for, say, t-shirts I sell to do with my comic is replaced. That's quite possibly a relevant claim, BUT I, as the WEBCOMIC OWNER, would need to present a claim (since I've suffered the harm). You haven't been harmed, technically. Relatedly, if an ad I serve on my webpage (and am being paid to do so) is replaced by the ISP, I'm losing money - so that's a fair claim. Net neutrality legislation would almost certainly bar this type of practice - it would just be prioritizing ISP ads over website ads, and if that isn't biased, I don't know what is. The free market doesn't work in a situation like that, where any one website, unless it's Google or Amazon, is nothing but a puny gnat compared to the near-monopolistic ISP's. Another interesting question would be to do with those sites where you go and do nothing but click ads to donate money to charity, or the like. Those sites would become basically completely defunct, and though ISP's would try to say "oh, we'll except you!" it's very problematic to actually do so in practice, for every site, every time, with perfect reliability, as new sites pop up and old ones have subtle programming changes. Even if they do "fix" it, those are great examples to bring into court! In short, I think an American company that uses this should expect to be sued posthaste. There's no reason to think there's any level of benevolence in American ISP's, so expect this to be adopted as quickly as they can get away with it - just like Time Warner is trying to pull with its "test" of bandwidth "caps" that's really a staged setup. Nothing is really going to change until legislation or large legal judgments come down, I fear.

Bluetooth in court? WTF

[JLavezzo]

Eh? There was a secret court case against Bluetooth?

How many Dots Per Inch were the illustrations of the judge?

Modifing data in transit may be illegal

[Anonymous Coward]

So, my ISP modifies the electronic data that I requested from someone. That could be a felony in Michigan and elsewhere. http://www.infosecnews.org/hypermail/0009/2760.html

"Under current Michigan law, the unauthorized alteration, damage,
destruction or use of a computer system resulting in at least $1,000
in damage is a felony punishable by 5 years in jail and/or a fine of
$10,000 or three times the aggregate amount involved, whichever is
greater. An amendment to the law, however, which takes effect
September 19, will remove the $1,000 damage threshold.

Granholm added: "In the future, any hacking, regardless of the amount
of financial damage it causes, will be a felony. A vandal is a vandal
whether you are a virtual vandal putting graffiti on a web site or a
real world vandal putting graffiti on a wall. Both are illegal."

Also, in Michigan computer trespass or hacking "Or known as hacking, any person who uses a computer or computer network with knowledge that such use is without authority and with the intention of: Deleting or in any way removing, either temporarily or permanently, any computer program or data from a computer or computer network; (2) Obstructing, interrupting, or in any way interfering with the use of a computer program or data; or (3) Altering, damaging, or in any way causing the malfunction of a computer, computer network, or computer program, regardless of how long the alteration, damage, or malfunction persists"

So Phorm stole advertising space ...

[bestinshow]

128 thousand charity ads were substituted with the Phorm Ad Network advertisements Disgusting and immoral.

Either (a) the website isn't getting any advertising revenue because Phorm has STOLEN the advertising - leading to a loss of revenue for the website and eventual closing.

Or (b) The charity has paid money for an advert display, but Phorm has STOLEN that advert opportunity for their own profit. As it's a charity, that means that's the money of the people who have donated to it. This is vile, nasty behaviour.

Simply inserting extra adverts into a page is bad enough, and also I believe is altering a copyrighted work without authorisation.

It's a shame that ethics and morals aren't part of business / management courses, like they are part of many other coursees. There's something sick at the heart of corporatism.

Why not alert the charities to this behaviour?

[Anonymous Coward]

I'm sure they would be very intrested to hear about it considering they rely on donations and contributions.

It would certainly be nice to hear their stance/reactions on these actions. If anything BT might of found a prime target as charities would probably be less likely to issue legal action due to the costs involved.

I love it--use SSL for everything

[phr1]

There is just too much unencrypted web traffic on the net, and too much snooping and now man-in-the-middle attacks. SSL/TLS fixes that (unless Phorm subverts a certificate authority, which would REALLY be playing with fire). So now there's finally more incentive to start using it. Authentication and privacy in one now-fairly-simple operation. SSL isn't nearly widely enough used because years ago it was hard to set up and cpu-expensive. But the heavy computation is just during the session negotiation, and CPU's are fast enough now that it's just not significant (about 1 millisecond server-side on today's Core 2 processors vs a good fraction of a second in the early web era, to set up the key for the whole browsing session).

Re:I love it--use SSL for everything

[TheGratefulNet]

SSL fixes nothing. the user is still stupid.

I interviewed at a company (a few years ago) that had designed a hardware 'appliance' that intercepts SSL web comms and fools the user into accepting a fake cert that looks VERY VERY much like the real thing. he clicks 'ok' and whammo - he FEELS safe but his link is now MITM attacked and compromised. and he didn't even know it.

technically, SSL didn't break but the middle box (cough cough) did some very evil things and asked both ends to talk to it, instead. essentially.

how many people really scrutinize the MESS OF TEXT that comes up in those cert popups? even experts tend to say 'yeah yeah, OK' and click it away.

morale: assume your company is using one of these boxes and go from there. over time, more and more companies WILL be snooping on their employees or users using these 'SSL feel good' faker boxes.

be advised.

Cancelled Account

[Simian Road]

It may not lead to any legal action but it certainly was the number one cause for me to cancel my BT broadband account a couple of months ago. If more and more people hear about this kind of invasive snooping, hopefully BT will be left without any customers at all!

tunnel to where ?

[Anonymous Coward]

and where is the tunnel endpoint ?
is this service free ?
can it handle 18 million British Telecom users ?

This should just be plain illegal.

[maillemaker]

It should be just plain damn illegal to intercept and modify communications from one person to another. Period.

If I have chosen to log onto www.cnn.com and pull content from that site, linked advertisements and all, then I have made that choice. No one should be able to modify the content stream and/or links to inject other content into it.

What's next? Modifying the content of the actual NEWS?

New ads for ISPs...

[UttBuggly]

"Raping and pillaging YOUR network packets since 2008!"

"We know what you want...because we just told you!"

"Big Brother?...no. It's more like Big Family...everyone is screwing with you!"

"All the packets you deserve...and many you don't!"

This irritates me. Self-serving and not well thought out. Kind of like New Coke; what's good for the consumer doesn't exist, it's only about the revenue stream.

I may set up some tests in my lab and see if DPI retards throughput in stuff like WoW, CoD2, and so on. Does it cause issues streaming video? And so on. Curious for now, but may come in handy during the class action lawsuit later!

Paging Mr Schneier, Mr Schneier ...

[IchBinEinPenguin]

... please come to the PR office, there are a few million calls for you!

Re:Either, depending on how you set it up

[Anonymous Coward]

By default Adblock prevents the ads from being downloaded at all but it is possible to change that in the configuration options if you wish.

Alternative Internet

[znerk]

The more of this kind of activity I read about, the more it seems like we need to take the power to regulate/intimidate/manipulate our information systems away from those without the common sense to understand that my information is mine, and when I send it to someone, I expect it to arrive unadulterated.

Perhaps we should move to a wireless infrastructure, and avoid the "intartubes" all together?

To answer your immediate outburst: No, I haven't really thought this through. On the other hand, It's obvious that the ISPs aren't thinking through their reality-twisting plans, either... so why should I?

Direct proof of spying

[MtlDty]

Page 14 of the report claims "During the trial three users posted their observation of this effect [browser briefly redirecting to site unknown to user]. In each case the reaction was negative, the user suspecting a virus, malware or spyware of some kind"

If you read the next three pages you see similar comments in the report, strongly suggesting that they were manually inspecting data over the trial period, including users forum posts. Further proof can be found on page 4 of the report: "no BT customer helpdesk calls were received which were directly attributed to a defect of the page system".

Is that legal? For ISPs to monitor what their users are posting to web forums? I hope my ISP doesnt get up to s\*3$%%S&#:: CARRIER BREAK

Bzzt Bzzt Bzzt

[Vo1t]

This post was originally a charity ad but was replaced with this text.

Legal Threats

[AlexanderHanff]

Well, firstly I am glad to see that the document has forked such a debate here on Slashdot and I thank you all for that (it is long overdue). As a result of some of my comments regarding the report, I am now facing legal threats from Phorm and BT. Alexander Hanff

Re:Legal Threats

[AlexanderHanff]

Oh and for the record, I am the one who released the report to the public domain. You can read more about it here: http://nodpi.org/

Re:Legal Threats

[AlexanderHanff]

I know the article here was linked directly to WikiLeaks and not my web site; however it appears part of my initial interpretation of the report regarding charity ads being hijacked was inaccurate.

I retracted that part of the article yesterday morning and have since received notification from BT PLC and Phorm's Legal Counsel that the ads discussed were purchased by Phorm for the technical trial.

The revised article is here:

http://nodpi.org/?p=10

My public apology for the misinterpretation is here:

http://nodpi.org/?p=11

I would be grateful if people could edit their comments accordingly (for fairly obvious reasons).

Alexander Hanff

Re:Legal Threats

[hasdikarlsam]

Sorry, slashdot comments can't be edited.
Not that it would happen, but since it /can't/ happen..

Interesting ...

[ScrewMaster]

NebuAd claim they are using DPI to enable their advertising to reach 10% of USA internet users.

So those ISPs have chosen to deliberately corrupt data transmitted to at least ten percent of their user base.

Brilliant.

Phabulous name

[Repton]

We've had phishing for a while. Recently people have been talking about "pharming" or "phlashing" --- it's getting to the point where replacing an f with a ph is the industry-standard way of denoting something as malicious.

So, Phorm's choice of name is ... interesting.

Regulation of Investigatory Powers Act 2000

[Anonymous Coward]

IANAL, but I thought this was a BIG no, no as far as the RIP is concerned. You cant do this unless both the sender and receiver give consent, or your MI5/MI6/GCHQ/Judge etc. And thats just to snoop, modifying traffic is a even worse.

You can snoop on a private network, if you own the network (ie a company can spy on its own network/equipment), but BT would be considered a public network and you cant do this on a public network.

Any other guys in the UK know any more?

http://www.opsi.gov.uk/acts/acts2000/ukpga_20000023_en_2

Encryption is long over-due

[sideswipe76]

Every website you visit should start encrypting it's data -- hell, even with self-signed certs. Simply to prevent this kind of tampering. That it also acts as a huge impediment to eavesdropping is a big bonus too. Google, why don't you take the lead on this?