ISP Is Bypassing Firefox's Location Bar Search

It was only a matter of time before ISPs began doing more than just redirecting failed DNS requests to their own pages. An anonymous reader writes "It looks like the largest ISP in Hong Kong has started bypassing search results from Firefox's location bar (which typically uses Google), forcing their own search provider (yp.com.hk) onto their users. ... Can an ISP just start re-directing search traffic at will?"

Comments

Sure they can

[yakatz]

As shown by the recent Comcast - FCC ruling, ISPs can barely be regulated at all (and therefore can do anything they want).

Re:Sure they can

[NervousNerd]

It looks like the largest ISP in Hong Kong

I never knew that Hong Kong was in the United States.

Re:Sure they can

[yakatz]

I mean in general ISPs can not be registered.
But once one is doing it, the rest will follow.

Re:Sure they can

[eldavojohn]

As shown by the recent Comcast - FCC ruling, ISPs can barely be regulated at all (and therefore can do anything they want).

Well, as someone else pointed out, this is an ISP in Honk Kong, not the US. While most of the "harmonizing" efforts of the Chinese government have been passive toward the consumer of the "non-harmonious" content, I would fear that this is a sort of precursor towards ISPs in China being required to pass search terms linked to individuals/accounts/addresses to the government for non-harmonious search terms indicating a level of dissent associated with that individual. Call me a tin foil hat but I haven't been too impressed with what's going on out in China. While you might claim it's overhead and too expensive, I guess we might start talking about https (port 443 secure) traffic even for search terms to avoid this inspection? Even that's naive though as the government could just ask the inside search provider for the data ... or failing that block the that port on that provider.

Re:Sure they can

[Jurily]

I never knew that Hong Kong was in the United States.

It's rude to derail a rant with logic.

Re:Sure they can

[yakatz]

sorry: regulated

Re:Sure they can

[Bryansix]

This IS Slashdot right? Let's look at the technical limitations here. As long as your ISP does not block DNS requests then you can use any DNS provider you want and therefore bypass any redirection. If an ISP started blocking the use of other DNS server then I'd say it's time to jump ship.

Re:Sure they can

[Cryonix]

My US ISP recently started doing this (windstream.com). This was done without any real notice and turned on by default. Granted, there is a link in the redirected search results to turn it off.

Re:Sure they can

[Eponymous Coward]

They don't block DNS requests, they just send all port 53 traffic to their DNS server.

There are a lot of areas with a single good internet option (where 'good' means decent bandwidth and latency). Jumping ship may not be a realistic option.

Re:Sure they can

[rattaroaz]

Caffiene deficiency this morning? ;)

Re:Sure they can

[yakatz]

Slightly off-topic, but ... A relevant first post is hard to come by, so I tried very hard to get it out quickly.

Re:Sure they can

[Dishevel]

Well. Thank God that like most /.'ers you realize that getting FP is way more important than the content of your post.

Re:Sure they can

[commodore64_love]

Well you're still wrong. State governments have the same power to regulate an Internet Monopoly as they do to regulate the Electric Monopoly or Natural Gas Monopoly. Your local government could very easily put the squeeze on Comcast and require them to fall into line.

As for this article:

I don't understand how the ISP hijacks the request. If I type "slashdot" doesn't Firefox automatically convert that to "google.com/search?q=slashdot" and produce results? I don't see how the ISP can interrupt a valid URL request.

Re:Sure they can

[kheldan]

If ISPs can do whatever they want, then so far as I'm concerned, I'll do whatever the hell I please as well!

Re:Sure they can

[drewhk]

Morning? It's a fine afternoon!

Oh.. wrong continent..

Re:Sure they can

[yakatz]

Some browsers do a DNS lookup first in case you are on an intranet. At my office (and anyone who uses SBS) we use this purposely: http://companyweb/

Re:Sure they can

[JustNilt]

Only when you want the associated karma of a relevant first post. :-\

Re:Sure they can

[msantosn]

Unless they are using some sort of transparent proxy which rewrites the request. I was working for a company which does content filtering using this technique. So the limitation you are assuming is not a limitation at all, and of course jumping the ship will be the temporary solution after all ISPs start doing the same.

As what others have said, the only viable thing to do is to use https and I heard about efforts for looking at https traffic by faking the certificate. How? By having all traffic being inspected and modified everything can be done.

Re:Sure they can

[whargoul]

Why are you being a douche about it? He was on topic and it was goatse free - one of the best "first posts" ever on /.

Re:Sure they can

[jdgeorge]

Facts, not logic. But yes. Well put.

Re:Sure they can

[rhsanborn]

No, mine produces this: http://www.google.com/search?q=slashdot&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

It announces where it comes from. It's good, and important for the Mozilla Foundation to get the referral bonus, but it also means an ISP can detect what's going on and intercept it. I suspect if they intercepted a generic google search, people would notice. But if you intercept the search from the little bar in the corner, there are a lot of people who wouldn't know the difference.

Re:Sure they can

[Anonymous Coward]

I would fear that this is a sort of precursor towards ISPs in China

Do not confuse "Hong Kong" with "China". Hong Kong is a "special administrative region", and there are very different legal rules and power structures in both places due to how the place developed as a British territory. At least until 2047, anyway.

If you were watching the Google/China drama just a short while back this distinction came up frequently, particularly when it came time for Google to move their servers from mainland China... To Hong Kong.

Re:Sure they can

[Attila Dimedici]

All that ruling showed is that Congress has not given the FCC authority to regulate ISPs.

Re:Sure they can

[DWRECK18]

I have to agree with yakatz as ISPs can do whatever it is they please being that they are not regulated. Though many people are saying hey it in Hong Kong not the U.S, do you really think that will stop companies like Comcast from doing the same thing. My advice is that we all start using TOR and https: as a way of bypassing this. As I am on /. I would assume people know how to hide who they are and take advantage of knowing how to work around people forcing you to go to a specific DNS.

Re:Sure they can

[omnichad]

And you only visit your own domains? Or does it have to forward requests to the root servers via port 53? Doesn't sound like that fixes anything.

Re:Sure they can

[godrik]

You mean, there are cities outside the united states ?

Re:Sure they can

[wvmarle]

And when we're at it, let's just add it's called Netvigator.

I'm one of their customers - it's the only option available in my location (the fun of living in a village, maybe some 500m away from the nearest high-rise - and with that I mean some 40-odd floors tall stuff). Connection is pretty OK though. I have 6 Mbit nominal down (640k up or so, that sucks) for under USD 30 per month, and quite often getting >800 kB/s download speeds.

This yp thing I ran into recently as well. Quite irritating, though it did give me the correct url instead of the mistyped one.

Re:Sure they can

[weszz]

I wouldn't call them cities per say... savage nomads grouping together to brave the coming storm is probably more appropriate.

Re:Sure they can

[dandart]

I'm a Vulcan, you insensitive clod!

Re:Sure they can

[gman003]

Who said logic had anything to do with the Internet?

Re:Sure they can

[Lumpy]

only in books and movies....

It's ok, it was only a nightmare.

Re:Sure they can

[vegiVamp]

opt-out bad, mmmkay ?

Re:Sure they can

[Dishevel]

Rofl. Though he was only partially on topic. FCC rulings in the US have very little to do with policies in Hong Kong.

Re:Sure they can

[Bakkster]

Sure they can, and by the federal government, too. Congress just hasn't yet given the FCC that power.

So in general they could be regulated, but in practice not yet.

Re:Sure they can

[wvmarle]

Like another poster also pointed out: Hong Kong is not China. It is politically part of China, but for all practical reasons it acts as a different country (and you as not being involved in the world political stage should simply consider it as such, much closer to the everyday reality):

Separate currency, the Hong Kong dollar, linked at 7.8 to the US dollar and fully convertible (can't say that of the yuan).

Borders with China. I am Hong Kong resident, and still need to buy a visa to enter China.

Hong Kong is a free port for import and export of goods and services. China is pretty thoroughly locked down, import duties of goods to China are huge. Really.

Hong Kong has an open, accountable judiciary, with a strong respect for the rule of law. The exact opposite of the other side of the border.

Hong Kong has press freedom, and not just official.

Hong Kong people have the right to demonstrate, and do so. In 2003, half a million people took to the streets - or about 7% of the total population. It sent shock waves throughout the country, all the way to Beijing. Something like that would never be allowed in China.

And last but not least Hong Kong has the permission from Beijing's overlords to move towards full democracy.

Re:Sure they can

[Lehk228]

well then i guess it must be time to set up an experimental high volume DNS system and you can volunteer to help stress test it. if an uninvolved third party were to blindly hijack said connection the negative effects on their infrastructure would be entirely their fault seeing as they chose to hijack your connection.

Re:Sure they can

[Bigjeff5]

Nope, sure doesn't. And they can sniff out a DNS request even if you find a DNS host that was amiable to using another port.

So what you really need as a DNS service that sends and receives encrypted requests over a non-standard port.

Then you can get around it. Hosting your own DNS does no good, as it still comes through your ISP's DNS first. Hard-coding Google's IP address would work short term for Google search, but if it catches on they'll just start redirecting all Google traffic instead of just DNS requests.

My host only reroutes failed DNS requests to their own shitty search, but it's still annoying as hell.

Re:Sure they can

[fatalwall]

he was referring to the last part of the summary in regards to ISP's in general. It was asking if other ISP's could follow suet and he replied with the the information that in the US it would be possible for them to do as a result of current rulings.

Now if they asked if other ISP's in Hong Kong could do this he would have been a little murky as although it has to do with a similar issue it would not be covered by the actual question.

Re:Sure they can

[anexkahn]

you learn something every day :)

Re:Sure they can

[Sleepy]

You're absolutely correct - it WOULD be wiser to bring your argument to the Chinese equivalent of the FCC.

Oh wait, there is NO FCC-like entity in China, therefore your "point" has as much relevance as the the post you were critiquing.. none.

Re:Sure they can

[andymadigan]

My ISP (Frontier) was doing this as well, even worse, when you opted out you still actually got the wrong response from DNS, it would detect your browser and give back an error page that looked similar, but not quite the same (at least that's what it did for Firefox). I noticed because the error page looked a little different and the URL was clearly wrong. I ended up switching to Google DNS until my contract was up, and then switching to the local cable monopoly (I suppose they do something similar, but I haven't noticed since I'm still using Google).

However, I'm obviously a lot more technically savvy than the average user, or even the average tech support person (they couldn't understand the problem). ISPs shouldn't be doing this, router manufacturers should start shipping their products to default to Google DNS, it's faster anyway.

Re:Sure they can

[icebraining]

If this is the case , Then Both Mozilla Google should sue Them !!

For what?

Re:Sure they can

[icebraining]

DNSSEC prevents tampering, if I understand it right. If you request an answer from server X, the client won't accept a server from any other server, thus prevent man-in-the-middle attacks like this.

Alternatively, you can redirect all or part of the traffic through a VPN or secure proxy. Even Tor, if you compensate the long delays with some DNS caching, as provided by pdns or other caching server (even if you don't need it, it's awesome, I tell you! Every request after the first takes 0ms).

Re:Sure they can

[s73v3r]

I find it quite disgusting that an ISP can fuck with your traffic like this on an "opt-out" basis. If I send a search query to Google, then I wanted my search results from Google, dammit! If I wanted to use your shitty, 3rd rate search engine which gives you a kickback, I would have sent my search query to them. If they want to do something like this, it should be mandatory opt-in, and I should get a discount on my bill for using the provider which gives you a kickback.

Re:Sure they can

[icebraining]

As what others have said, the only viable thing to do is to use https

Nope, there's also VPNs.

By having all traffic being inspected and modified everything can be done.

No! That would be a major security flaw! Would you really access your bank if any man in the middle could tamper with your data?!

A website using HTTPS has to provide a certificate containing the domain and digitally signed by a CA, and that signature can be verified against the public key present the in the certificates your browser comes with.
Since nobody can digitally sign using a CA's private key, nobody can provide a fake certificate for a website. And if they provide a copy of the right certificate (that can be copied when you access the real website), the request will then be encrypted with the public key present in the cert, so the attacker won't be able to decrypt it, because they don't have the website's private key.

If an attacker presents you with a fake certificate, it won't match the key of any of the CA's, and your browser will scream "DANGER, WILL ROBINSON!" with red screens and scary messages.

http://en.wikipedia.org/wiki/Public-key_cryptography
http://en.wikipedia.org/wiki/Https

Re:Sure they can

[fulldecent]

So, as always, 8.8.8.8 is a lucky number in China?

Re:Sure they can

[agbinfo]

IANAL but I don't think you are allowed to misrepresent yourself that way. The user has every reason to believe that the search result comes from Google and this has a direct impact on how Google will be perceived.

Re:Sure they can

[kdemetter]

I don't understand how the ISP hijacks the request. If I type "slashdot" doesn't Firefox automatically convert that to "google.com/search?q=slashdot" and produce results? I don't see how the ISP can interrupt a valid URL request.

Easy : the request and response passes trough them , so they can force you to redirect to anything.
When my download limit is reached , for example , my ISP redirects me to a page displaying this.

They can easily apply that logic depending on the request you send . Whether it's legal ( privacy ? ) is another question.

Re:Sure they can

[icebraining]

Then QoS would also be illegal, as it can make sites appear slower if other high-priority data like VOIP is using the bandwidth. I'm pretty sure ISPs are not legally obligated to provide correct DNS answers.

Are you aware of any law (even in the US) that grants websites the right not to be altered by the ISP?

Re:Sure they can

[Bing Tsher E]

There is a link in the redirected search on my ISP too.

The link didn't work.

I just switched away from their DNS server.

4.2.2.1 works adequately.

Re:Sure they can

[ottothecow]

yeah, but what will you do when verizon starts doing this and the hordes of people who use 4.2.2.X (hey...it is easy to remember) will all be screwed?

I am confused though...I thought I had my router pointing to OpenDNS and my machines taking their settings via dhcp from the router...but I still occasionally get those search pages from my ISP (RCN).

Re:Sure they can

[raju1kabir]

Oh wait, there is NO FCC-like entity in China

Regardless of whether or not there is such an entity in China, it wouldn't have jurisdiction over Hong Kong, which has its own regulatory authorities (in this case OFTA).

And in point of fact, China does have a communications regulator, MII.

Re:Sure they can

[kabloom]

But the rant is true in this case too. (It's a fortiori.) If you can barely regulate an ISP in the US, then surely you can't regulate an ISP at all anywhere else.

Re:Sure they can

[The End Of Days]

I am not a lawyer either, but I think I'm going to sue you for putting that retarded shit out on the Internet where I could a) see it and b) derive a pounding headache.

Re:Sure they can

[agbinfo]

The reason for starting the post with "IANAL" was to highlight the fact that I'm not actually qualified to provide legal information. I'm just trying to use common sense.

Now that we've established that my opinion is basically worthless on this matter :-), here's what I think:

QoS reflects poorly on the ISP when not used properly. I would like to think that if directed at a particular individual or company, the ISP could be sued.

Are you aware of any law (even in the US) that grants websites the right not to be altered by the ISP?

Would slander or libel apply? As I said IANAL but I'm pretty sure there are laws that exist to stop a company from posing as another especially if it's making the second company look bad.

Re:Sure they can

[agbinfo]

Love you too.

Re:Sure they can

[ReverendLoki]

http://companyweb/

Hey, how'd you know to put a link to my Company Intranet web page in your post?

Re:Sure they can

[digitalunity]

Kind of a technicality really. The existing laws granting FCC authority just don't spell it out. A forgiving interpretation of the intent of the law lends me to believe congress did intend for the FCC to regulate all activities of companies using government granted monopolies.

The free market is powerless in a pseudo-monopolistic environment. Companies(and I mean specifically Qwest, Comcast, AT&T Wireless, AT&T, Sprint, Verizon Wireless and others) have shown and will continue showing that they are unable to provide a service consumers want without applying unscrupulous terms, practices, price gouging, or without violating privacy of their customers.

Congress needs to get this figured out. Consumers don't have many broadband choices and the companies in the market now are abusive bullies.

Re:Sure they can

[tobiah]

+1 informative

Re:Sure they can

[Bakkster]

My understanding of the issue is that Telco's are alternating between how they are classified. First, they wanted to be classified in such a way that they could receive gov't grants to build infrastructure. Then to reclassify so they do not need to license their infrastructure to competitors. Then to reclassify to avoid FCC regulation.

I agree, Congress needs to get their heads out of their asses. They either need to be regulated, or forced to compete.

Re:Sure they can

[HeronBlademaster]

You switch to Google's DNS servers? 8.8.4.4 and 8.8.8.8 are pretty easy to remember, too.

Re:Sure they can

[digitalunity]

You're largely correct.

They shift their stance based on what they're asking for. Just 2 weeks ago, AT&T defended the FCC(in a case against Comcast) because it feared losing universal service fee money because of the "telecommunications carriers" classification. I don't pretend to be an expert...

but it seems fairly obvious that when there is tax dollars to be handed out to build infrastructure, the telecoms are all out there with their hands open ready and willing. But when it comes time for the FCC to enforce consumer fairness and openness on the internet(that we taxpayers paid AT&T and others to build a backbone for), they cry foul.

Politicians seem spineless when it comes time to intervene.

Re:Sure they can

[icebraining]

So are we incurring in copyright violation by using Adblock or IE6?

Re:Sure they can

[Haymaker]

It's rude to interrupt a correction with semantics.

Re:Sure they can

[Jesus_666]

At least we nomads only have to worry about that storm - unlike Americans who are hit by a constant barrage of tornados, hurricanes, earthquakes and volcanos and who have to deal with the sparse vegetation going up in lethal firestorms every other year or so.

Seriously, it's a wonder there's any life at all on North America. No wonder you invented nuclear weapons; anything less doesn't even register against the hellish conditions of that purgatory-like continent you live on.

Re:Sure they can

[jp10558]

Well, not necessarily, you're not redistributing the derivative work. Nor are you doing it for profit. They're changing a copyrighted work, distributing it, for profit. That seems to tick more copyright violations than general torrenting does (the for monetary profit). IANAL, but if they're deliberately giving you a different page than you think you're getting it's at least a hijack a la various malware, and may constitute fraud. And if they fake google in some way, they're probably infringing the trademark as well.

I don't know that anyone is going to sue though.

Re:Sure they can

[berbo]

Bluto: "Was it over when the Germans bombed Pearl Harbor? Hell no! "

Otter: "Germans?"

Boon: " Forget it, he's rolling. "

VPN

[drolli]

Use a VPN provider of your choice.

Re:VPN

[cc1984_]

Use a VPN provider of your choice.

And immediately get throttled by the ISP for using encryption

Re:VPN

[Sir_Lewk]

Does this actually happen in practice? Most people who use VPNs use it because they work from home and their work requires it. I don't think we are at the stage yet where all VPN traffic is assumed to be evil.

In the past I've had more success torrenting things with comcast while VPN'd into my school, then without a VPN at all. Not that my story is evidence of much, but I haven't witnessed any sort of throttling like you claim.

Re:VPN

[poetmatt]

not happen, happened. Lots of ISP's worldwide, not US only, want you to have a business connection just for daring to establish a VPN connection over it. Usually it ends up being somewhere between 10 and 40$ extra a month depending on country/currency/etc to do so.

right now however, in the us, comcast is staying away from that stuff, at least temporarily. Or if they do throttle, it's on the low end speeds. On my 22/10 they are not throttling anything, nor are they sending warnings and I use what comcast considers massive amounts of bandwidth per month for games/downloads/videos/netflix (>500GB).

Outside the us, these throttling attempts are quite regular. Especially rogers, etc.

Re:VPN

[coniferous]

All encrypted traffic is throttled on my canadian ISP, Rogers. Port 443, BT, VPN. Its pretty rediclious.

Re:VPN

[thijsh]

I've found that UPC in the Netherlands throttled torrents (other traffic is faster). Encrypting traffic does nothing (I guess they filter based on data volume per connection/port whatever). But I also use a VPN connection to work to securely move files of several gigabytes, and these connections were also noticeably slower... I guess this is a side-effect of the throttling, but I don't think they detect encryption but a more simple bandwidth detection.

NOTE TO SELF: just got the idea of creating a VPN connection to port 21/80, perhaps they are exempt, I'll try that out later...

But your mechanism of speeding up traffic (torrent/ftp/svn) over VPN does in fact work (I bypass the corporate firewall that slows things down by VPNin into another work location to get good speeds). Strangely even my ping times to google are improved over the VPN! But that might be because the other location has a pretty sweet fibre up-link.

Re:VPN

[Joe U]

not happen, happened. Lots of ISP's worldwide, not US only, want you to have a business connection just for daring to establish a VPN connection over it. Usually it ends up being somewhere between 10 and 40$ extra a month depending on country/currency/etc to do so.

ISP: VPN's are for work only, and you have to pay $100/mo for a business plan. Response, I was connecting to school for educational purposes and the computer lab requires a VPN.

Re:VPN

[poetmatt]

Well, that sounds nice and all to you, but they can and will cut you off for that - it's stupid, but it's how they milk extra money, sadly.

Re:VPN

[Lumpy]

I have my VPN port at home on port 80. It is the best way to bypass firewalls at work and other places.

works great. you can run your VPN software from a thumb drive and firefox as well. do your surfing over it and the IT BOFH's cant detect or prevent a thing.

I pointed this out once as a IT manager, "isn't it easier to educate the users about safety? any fool can vpn out port 80 and bypass all our security."

I had several IT consultant "gurus" stutter and almost foam at their mouth because they just proclaimed their new firewalls as unbreakable and it was impossible for anyone to get unwanted files through it.

Re:VPN

[Bigjeff5]

ISP: VPN's are for work only, and you have to pay $100/mo for a business plan. Response, I was connecting to school for educational purposes and the computer lab requires a VPN.

ISP: In that case, you have to pay $100/mo for our business plan. Have a nice day. :)

Re:VPN

[Bigjeff5]

That doesn't solve anything, because DNS requests still go through the default DNS first generally, and then the DNS on the VPN network.

This cuts down VPN traffic for external links, but I know from first hand experience that DNS re-direction it can really screw up intranet connections over VPN. I recently had to switch my DNS to Google's because the local ISP's redirection was hijacking the DNS fail procedure, thus preventing any intranet connections (obviously my ISP had no IP addresses for the intranet sites).

Re:VPN

[characterZer0]

My ISP (Time Warner) will not sell me a business connection because my house is zoned residential. I would gladly pay the extra money for better upload speeds, a better modem, a static IP address, a better service contract, and an account rep who I can call when my service is not functioning.

Re:VPN

[bami]

Are you using uTorrent and its encryption protocol? If so, do you allow legacy connections?

I too saw a decrease in torrent throughput (UPC cable internet, 25/4 mbit), but when I disabled legacy (unencrypted torrents) and forced encryption everything went back to regular speeds.

Re:VPN

[Mister Whirly]

Do you need to be zoned for business if you run a home business that doesn't have any business traffic from the physical location? Like a mail order or internet only business? What if I sell a lot of Ebay stuff from my house? Where do you draw the line? I also wouldn't think Comcast would turn down extra money for an internet account if you were willing to pay it. I know people who have "business accounts" in their residences because they wanted all the things you stated and were willing to pay. Comcast was more than willing to take their extra money. Maybe their rules are different for your location - with Comcast it is hard to find consistency in their policies nationally.

Re:VPN

[coolsnowmen]

It is definitely possible to do deep packet inspection and verify that port 80 is only being used for web. I know companies and government agencies that do it.
Basically only port 80 and 443 are allowed and those are verified by some means. Now if you wrote your own encapsulation (and incurred the overhead), you could get through.

Re:VPN

[soundguy]

You should use a better ISP then. Verizon has no problem selling me business FIOS (35/35) in the Seattle suburbs. If you don't have any other connection options besides TW, sell your house and move to a better neighborhood.

Re:VPN

[DamnStupidElf]

Does your ISP throttle your HTTPS banking sessions too? If not, there's your answer.

Re:VPN

[zeropointburn]

Talk to your local city administration office. Typically for a couple of bucks you can get the authority to operate a no-visibility business out of your house. You need not actually run any such business, the city just wants to be sure you won't be generating a bunch of street traffic and complaints.
Next, send a certified copy of your form to your ISP and tell them you need a business-grade connection to start your company.
If they ever call and ask about your business, tell them you never got the capital together.

Of course, the better option is to just dump them and move on, if that is possible for you.

Re:VPN

[russotto]

Basically only port 80 and 443 are allowed and those are verified by some means. Now if you wrote your own encapsulation (and incurred the overhead), you could get through.

You mean there isn't already a VPN over HTTPS which is indistinguishable (without the keys) from HTTPS?

Re:VPN

[thijsh]

Isn't HTTP(S) highly asymmetric in bandwidth usage? If they drop all HTTP(S) connections which use more than a certain factor of upstream they could prevent most VPN connections...

Re:VPN

[iamhigh]

Same issue here. Fucking pissed at ATT for implementing the DNS redirection crap. My connection is slow enough without having to use some third party DNS, but I guess that's what I'll have to do. Good to finally see another person with this issue (searched for this exact issue with no good results).

MitM of Google

[nweaver]

We've seen a few ISPs that MitM www.google.com in DNS (you can check for yourself in Netalyzr.

Does anyone know (save me looking at a TCPdump) what domain name firefox uses, is it www.google.com or something else, for the google searches?

Re:MitM of Google

[yakatz]

Exhibit A: OpenDNS
http://forums.opendns.com/comments.php?DiscussionID=226

Re:MitM of Google

[Anonymous Coward]

It's www.google.com. That's why OpenDNS forges DNS responses for that domain name to redirect to an OpenDNS server. I am really looking forward to DNSSec and SSL keys in the DNS. If the ISPs can't keep themselves from meddling with the traffic, the traffic needs to be authenticated and encrypted to foil their attempts.

Re:MitM of Google

[Sir_Lewk]

Thank [deity].

I saw that this article was tagged "opendns" and for a moment thought with horror that people were tagging it that as a kind of suggestion that using OpenDNS was a solution to this. It seems like every single fucking time an article comes up about ISPs doing something wrong (generally messing with NXDOMAIN) people come out of the woodwork to suggest using OpenDNS, even though they do the exact same thing and there are plenty of perfectly standards compliant and free DNS providers to chose from.

You link is actually incredibly relevant, thanks.

Re:MitM of Google

[nweaver]

The EICAR test "virus" is used to see if you have working AV which is blocking threats that are downloaded from the network.

Please see the FAQ.

Re:MitM of Google

[Eponymous Coward]

Or they will just put their cert into your browser so they can "optimize your web experience".

Re:MitM of Google

[Ephemeriis]

It seems like every single fucking time an article comes up about ISPs doing something wrong (generally messing with NXDOMAIN) people come out of the woodwork to suggest using OpenDNS, even though they do the exact same thing

They do... But it's generally in a beneficial way (phishing filter, content filtering, etc.) and at the user's discretion. Your ISP may not have any way to opt-out of the NXDOMAIN hi-jinks... But OpenDNS does.

I happily use OpenDNS at home, as well as at any client that asks for a quick and easy way to make sure folks are surfing for porn.

there are plenty of perfectly standards compliant and free DNS providers to chose from.

I've been using Google's DNS for the folks who don't want filtering.

I have, in the past, found the addresses for various higher-level DNS servers and used them successfully... But I've always wondered just how happy some of those folks are to have their DNS servers being used by random people. Is there a list of free/public DNS servers somewhere out there?

Re:MitM of Google

[jank1887]

a fair followup to show that mainly OpenDNS was just trying to fix what google/dell/others? broke:
http://blog.opendns.com/2007/05/22/google-turns-the-page/

Re:MitM of Google

[thijsh]

Yeah, they can just as easy mess with OpenDNS... I recently 'fixed' an internet problem for a friend at his work by setting up OpenDNS but it appears they now resorted to blocking OpenDNS! He had no choice but to reset the DNS server (or learn all IPs). ;-)

I love OpenDNS, it's very useful, but I agree it's not the answer to everything...

Re:MitM of Google

[Lumpy]

Exhibit B: redirect all DNS lookups to inside DNS. It's not hard at all to do.

Re:MitM of Google

[Coopjust]

If you want to use OpenDNS, NXDOMAIN redirection is easily disabled from an account (free to register, then you just put the DynDNS in your router or run their DynDNS client).

Re:MitM of Google

[Bigjeff5]

Does OpenDNS still redirect all google.com addresses? The GGP's forum thread was from three years ago. It seems like a pretty insane response to what software one company installed on their servers.

Redirecting all Google traffic because one company decides to load up shitty software on their machines? Seriously? If people don't like what Dell is doing, they'll either find a way to fix it or not buy Dell again, or both. If Google's reputation gets damaged because their partner went overboard, so much the better in a free market system.

I really don't see why OpenDNS did any of that. The correct response was a blog post on where the software is and how to remove it, since Google/Dell doesn't make it immediately clear. They also said "Browser Error Redirection" was unclear even to techies. WTF kind of techies do they have over there? When your browser is redirected on an error, and the page tells you it's "Browser Error Redirection" software, what's not clear? GoogleAFE is unclear (the original name of the software), but the other is not.

OpenDNS just seems like a bunch of self-righteous control freaks, I'm glad I have nothing to do with them. Google and Dell were definitely not doing the right thing, but OpenDNS screwed over most of their customers to fix it. How is that any better?

Re:MitM of Google

[Sir_Lewk]

Why the hell would you want to bother doing that (it's a piss-poor solution...) when there are countless proper DNS servers out there? Having to use DynDNS just to get working standards compliant DNS is patently absurd.

Recommending OpenDNS to anyone but technical users who know exactly what services they need, that OpenDNS provides, is irresponsible at best.

Re:MitM of Google

[Sir_Lewk]

Well there is the classic 4.4.4.1, and some others in that range, run by Verizon. Publicly accessible and standards compliant, also far easier to remember than whatever OpenDNS's IPs are.

More recently 8.8.8.8 and 8.8.4.4 have become available. They are run by google and I know this is slashdot, but they are at least certainly less evil than OpenDNS. Even easier then the verizon servers to remember too.

After those, there are always universities. Many local colleges or universities have publicly accessible DNS servers, just look on their websites to find out where they are.

With none of these solutions do you have to go out of your way and run DynDNS to get correct NXDOMAIN responses.

Re:MitM of Google

[GameboyRMH]

If you don't like OpenDNS, Google DNS is another option that is less untrustworthy than your ISP.

http://code.google.com/speed/public-dns/

Re:MitM of Google

[LanMan04]

uses www.google.com

Re:MitM of Google

[Cryonix]

Wouldn't this still be vulnerable to man in the middle? I suppose you could manually update the DNS tables, but the ISP can still redirect your internal DNS record updates to their servers. IANADNSGuru, so correct me if I'm wrong.

Re:MitM of Google

[Ephemeriis]

Does OpenDNS still redirect all google.com addresses?

As far as I know, yes, it does.

I really don't see why OpenDNS did any of that.

OpenDNS redirects Google traffic so that they can make money. It's a free service, so I don't mind them getting something from the ads shown to me by Google.

Dell's Browser Error Redirection was also redirecting Google traffic to a Dell-sponsored site, presumably to make Dell some money. Obviously OpenDNS didn't like this much... But the bigger problem was that the Browser Error Redirection was redirecting NXDOMAIN stuff, which OpenDNS also might be trying to redirect.

OpenDNS just seems like a bunch of self-righteous control freaks, I'm glad I have nothing to do with them. Google and Dell were definitely not doing the right thing, but OpenDNS screwed over most of their customers to fix it. How is that any better?

When I use OpenDNS it is so that I can filter traffic. OpenDNS provides this filtering service at no cost to me. Obviously it costs them something to run their hardware. I do not mind paying them for their service by having my Google traffic routed through their servers.

The alternative would be for me to set up my own filter server, maybe running Dan's Guardian... Which is free software, but I'd need hardware to run it... And it just isn't worth my time/money to make it happen.

Obviously, if you've got problems with OpenDNS, you've got plenty of alternatives.

Nope

[ffreeloader]

Can an ISP just start re-directing search traffic at will?

Not in my book. My ISP started doing some redirection and they got an immediate complaint from me. In person, at their local office. If there was an alternative to their service I would have switched ISP's immediately.

Re:Nope

[Anonymous Coward]

... and how did that work out for you?

Re:Nope

[sadness203]

Even if it didn't work, the act in itself is great. If more people were doing that, things might change a bit more.

Congratulation to ffreeloader for doing the right thing.

Re:Nope

[ffreeloader]

Who knows? They have been quite responsive to complaints about services in the past. Even if I don't get an immediate response my voice was heard. They do know at least one of their customers was angry about their conduct. Should I just silently accept them screwing with me and not voice my concerns? That seems to me a guarantee that they won't change their ways.

From your post it seems that you think not standing up for yourself is the way to change things. Don't vote. Don't express your opinion. Be a martyr. How's that working for you? Effecting a lot of change in society are you?

Re:Nope

[kz45]

"Not in my book. My ISP started doing some redirection and they got an immediate complaint from me. In person, at their local office. If there was an alternative to their service I would have switched ISP's immediately."

I love how the general slashdot public has this "I should be able to do what I want with my property" attitude with things like file sharing. But when an ISP decides to use that same logic (since you are using their lines to access the Internet) you get pissed off.

Re:Nope

[John Hasler]

> I love how the general slashdot public has this "I should be able to do what
> I want with my property" attitude with things like file sharing. But when an
> ISP decides to use that same logic (since you are using their lines to access
> the Internet) you get pissed off.

I see no contradiction in this specific case. They can do what they want with their property and he can take his business elsewhere if he doesn't like it. He did them the courtesy of telling them what they were doing that he didn't like so that they could consider changing it.

Re:Nope

[VisiX]

The fact that this is modded funny just shows how desperate a situation we are in.

Re:Nope

[John Hasler]

> Should I just silently accept them screwing with me and not voice my
> concerns?

No. You are supposed to rant selfrightously about evil, greedy corporations and demand that the government "regulate" them into forcing whatever it is that you want on all their customers whether they want it or not, but never make any attempt to communicate your concerns to the company in question. That's the Slashdot way.

Re:Nope

[ffreeloader]

Who says I support "file sharing", as in taking copyrighted work without permission?

I have never downloaded a song or movie. I have always purchased all my music, and never buy movies as that doesn't interest me. I just don't buy any music any more. But, that's because of the actions of the RIAA. If they acted ethically I would most likely still be buying music that interests me.

You make some huge assumptions with absolutely no evidence to back them up. You can search all my posts here and you will never find me supporting perceived theft as a way to combat out-of-control copyright laws. You will find me arguing against that kind of behavior.

Re:Nope

[value_added]

My ISP started doing some redirection and they got an immediate complaint from me. In person, at their local office.

I imagine that approch would yield a response that consisted of little other than a look of confusion of amazement, or a blank stare that barely suppressed the "I wish this guy would stop talking and go away."

When I call ATT and they discover I have fixed IP addresses, I immediately get transferred in a flurried confusion to second level tech support. When the next level discovers my connection doesn't require PPPoE, I get transferred again. The higher you go, the better your chances of resolving issues, but the less they care about your opinions. And if they do care, the most you can hope for is sympathy. They're typically a customer of the ISP just like you are, and subject to the same problems.

I find comfort in the fact that ATT's employees (field techs included) have to wait on hold and deal with the same idiots the rest of us deal with.

Re:Nope

[Eponymous Coward]

When you buy an internet connection, I would say there is an implied warranty of merchantability that includes integrity of communication.

You should be able to assume that your inbound and outbound internet traffic isn't effectively altered.

Re:Nope

[DiademBedfordshire]

When I lease the line it becomes my property, the same when I lease an apartment. The landlord can't come in with out my express permission unless it is a great emergency and I expect my ISP to act the same way.

Re:Nope

[corbettw]

If you're paying for a service that requires using someone's else property, they have voluntarily transferred some of their interest and rights in that property to you. Your landlord can't come into the house you're renting from him just because he feels like it, even if a clause permitting it is in the lease agreement. In the same way, if an ISP sells you access to the Internet, they can't start blocking you from certain parts of it without changing the agreement, which requires your consent (after all, it's a contract, and contracts require all parties to agree to it).

Whether the courts would agree with this interpretation is another matter, but this is the way I see it.

Re:Nope

[RemoteSojourner]

Silly Logic. ISP is providing a service and it's okay to get pissed off.

Re:Nope

[ffreeloader]

I don't know at this point. I haven't experienced it lately, but that doesn't mean they aren't still doing it.

A lot of people complain about my ISP but I've found them pretty reasonable. When they first moved into this area their service was really bad, and expensive. In the years since then though they've actually lowered their prices, increased their speeds and usage caps, and become very reliable. If I have a service interruption they are there that day, not a week later.

Re:Nope

[ffreeloader]

Well, actually I complained to the local head of their internet service department. I've known him for several years. I got to know him when his company first moved into this area and their service was very unreliable. Since I work from home I require a dependable service so he and I talked on a regular basis. We hadn't talked in years, but he still remembered me.

Re:Nope

[ffreeloader]

Come on mods. This is funny. It's great satire. Mod this guy up.

Re:Nope

[JumpDrive]

I think you would get a better response, if you would stand in front of one of their tanks while CNN filmed it.
It's worked before.

Re:Nope

[ffreeloader]

Get a grip. Don't demean the sacrifices made at Tiananmen Square with this far less serious bad behavior on the part of my ISP. The two situations aren't slightly close to be moral equivalents.

Re:Nope

[fmoliveira]

Great your ISP has a local office you can complain. Where I live (Brazil) all you have is a shitty 0800 that has no shame to hang up when you try to cancel their services or anything they don't like. (You have to sue to make some providers stop sending their bills and ruining your crediting when you stop paying here).

Re:Nope

[DrXym]

I wonder if an ISP would opening them up to all kinds of legal issues if they stop being a neutral carrier of information. After all if they can redirect a search, then what's stopping them from blocking kiddie porn, or monitoring users who are filesharing?

Re:Nope

[flaming error]

> it's a contract, and contracts require all parties to agree to it

Yeah... no. Not really.

Most "contracts" for services include a clause like "We, The Company, can unilaterally change the terms of this contract at our whim. You should frequently check the following URL to see what the terms are on any given day."

Re:Nope

[Bengie]

I'd just say that they're interfering with my encrypted connection and I have probable cause that they're doing a man-in-the-middle attack. Put the burden of proof on them by doing a large audit.

Re:Nope

[Twanfox]

Inclusion of a clause that says we can change the terms at any time and enforcement of that term are two separate issues. The problem with such contracts is that the offended party generally needs to do something about that offense, IE take the other party to civil court. For most people, they don't want the hassle and either submit to the new rules or leave, if they can. That still doesn't make those clauses legal. It just means they get away with it.

Re:Nope

[butlerm]

Most monthly service contracts come with a clause that say we reserve the right to change terms - service, prices, options, etc at will. If you pay one month in advance, your implied contract lasts one month.

So until Congress passes an ISP appropriate law to allow the FCC to regulate a handful of critical issues like traffic interception and rewriting, the FCC's only option is to attempt to reclassify ISPs as a Title II "telecommunications service" providers, subject to all the fun regulations that telephone companies are subject to, good, bad and ugly.

In the long run, that is probably a good thing, although I doubt the FCC will be successful without an act of Congress requiring such a change, and making appropriate provisions for ISPs.

Re:Nope

[corbettw]

The FCC already tried that got smacked down by the courts. So they have to wait for Congress to do something.

And I go back to what I previously said: just because a contract has a given clause doesn't mean that clause is valid. For one party to be able to change the terms of a contract at will, with the other party presumed to have agreed to it just because they did nothing, is unconscionable. Why that practice is considered acceptable by our courts is beyond me.

Re:Nope

[coolsnowmen]

That depends on local laws I think. I'm pretty sure my landlord can come in as long as I get written or verbal notice in advance (24h?).

Re:Nope

[coolsnowmen]

If there was an alternative to their service I would have switched ISP's immediately.

There is a certain dark humor to the idea that you can complain all you want, but monopolies of a service that is in high demand don't really need to give a damn until they have a real competition for that service.

Re:Nope

[idontgno]

Then you should have probably mentioned that you're trading on a special personal relationship with your service provider. Most consumers have no such access, so your advice to complain in person is, at best, useless (i.e., walk into Foobar Cable Co's local office, rant at nice reception desk lady, get blank stares, leave angrier than when you entered), and at worst, dangerous (walk into Foobar Cable Co's local office, rant, get tazed or shot by the police responding to the nice reception desk lady's panicked 911 phone call).

Re:Nope

[jc42]

After all if they can redirect a search, then what's stopping them from blocking kiddie porn, or monitoring users who are filesharing?

They could also redirect your search or download request to a kiddie-porn site, then send a report on the stuff that "you downloaded" to the local police. Of course, they'd probably be more likely to do something like that if you make a fuss about their redirection.

Re:Nope

[butlerm]

On the contrary, the FCC made a Title I determination and the Supreme Court upheld it against a challenge in the Brand X decision. The Supreme Court did not mandate that ISPs be classified as Title I carriers. What they held was that "The Commission's conclusion that broadband cable modem companies are exempt from mandatory common-carrier regulation is a lawful construction of the Communications Act under Chevron and the Administrative Procedure Act"

That does not prohibit the FCC from coming to a different conclusion, as long as the change is not arbitrary and capricious. Of course this is all the FCC's fault anyway. Their previous determination is a model of specious logic. The basic function of an internet access provider is to transmit packets, not process, store, or transform them.

The reason why service providers can change terms every month is because their customers are on a month to month contract. It is like the difference between renting and leasing. If you signed up for a long term contract, then arbitrary changes to the service during that term would be restricted. Beyond that it takes a law to override the terms of a contract, unless the terms are clearly unconscionable.

Re:Nope

[butlerm]

Unless you sign a long term contract, the implied contract lasts all the way to the end of the month. At that point either you or they can walk away, or make any other change in the agreement not prohibited by law. If you make the next month's payment, you renew the contract under the new terms for another month.

Re:Nope

[Pulzar]

The higher you go, the better your chances of resolving issues, but the less they care about your opinions.

I don't know if that latter part is true. I think they all equally don't care about your opinion of ATT.

Re:Nope

[ffreeloader]

You're ignoring the fact that the only relationship I have with the guy is based on me complaining about the service I am paying the company he works for provides. He knows me because I've complained so many times over the 10 years I've subscribed to their service. In the first year after they took over the cable system here I talked to him at least a dozen times. That's how bad their service was at first. I used to lose connection several times a week. I haven't had occasion to talk to him after they improved the reliability of my connection until now.

We've never seen, or talked with, each other outside of that context. It's not like we're friends. We're not. We're not enemies either. I doubt we even qualify as acquaintances. We've just had contact over the years. I may not even recognize him if he was away from work and not wearing his work uniform.

Re:Nope

[mjwx]

That's the Slashdot way.

Their man pulls a Iphone,
Your man pulls a Nexus One,
They send their man to the App store,
you send your man to a pron site,
That's the Slashdot way!

time for end to end encryption

[Anonymous Coward]

If these idiots are too dumb to handle being a dumb pipe, we have no choice but to encrypt everything.

Re:time for end to end encryption

[GameboyRMH]

It's getting so bad now the only option might be to fork the Internet's infrastructure, in combination with universal encryption. Replace it with open WiFi/WiMAX wireless mesh networks that only connect to the "corporate Internet" via TOR routers or something similar. Then once the public wireless mesh is popular enough, companies like Google and Hulu will voluntarily tie into it directly to stay relevant. The hard parts would be:

- Replacing the IANA/ICANN. A democratic online community might be the best solution.
- Submarine/satellite links. A "community project" wouldn't have the capability to do anything on this scale. Using TOR-like traffic on the "corporate Internet" might be a good short-term option.

Eventually ISPs that attempt to control traffic (to the extent that even these measures aren't sufficient) would be put out of business, those that stop trying to control traffic might stay in business serving as a backbone to the community Internet.

If this all seems too idealistic, imagine it could work like torrents: Those who are selfish or malicious have their access restricted or even removed due to rules built into the protocol. The more you share the more you get.

The way I see it working in the Average Joe's house is like this:

They have their "local AP" for short-range connections that handles LAN traffic, just like how home wireless APs are used today. Traffic is freely allowed out but inward traffic is restricted in a NAT-like configuration (there is actually a standard for NAT-like security on ipv6, but I can't find the name of it now)

Then they have their "community AP" that connects to other community wireless nodes. This is the center of the home network and handles all aspects of connecting to the community mesh. It might be a long-range-only AP.

Then optionally, a "corporate Internet modem" much like the ADSL/cable modems used today. All traffic sent over this connection is either onion-routed or securely tunneled to another "community AP," and of course encrypted like everything else. Providing this connection gives the network better "karma" like the seed ratios on Bittorrent, and therefore gives their network better access to other networks.

If the technology becomes available I'd be more surprised if this didn't happen. If a DD-WRT like system becomes available with "community Internet support," people will start reflashing their equipment so they can share warez, host services the ISP doesn't allow, etc. Then businesses will get on board for the security and redundancy (and maybe speed - going via "commu-net" to another location might be faster than a "corp-net" connection and cheaper than a wired connection).

The only weakness is that governments could outlaw the "commu-net," but once big businesses start reaping the rewards their lobbyists should ensure it stays legal.

Re:time for end to end encryption

[egcagrac0]

Mods, +1 Interesting

Re:time for end to end encryption

[Pence128]

In communist Internet, Internet throttles ISP.

Encryption

[dmbasso]

And that's why we should start using encryption for everything...

Re:Encryption

[JesseMcDonald]

Remember that encryption won't help without authentication; your ISP will just MITM all your encrypted traffic. You need to know who you're really talking to.

Re:Encryption

[Anonymous Coward]

It's obviously better with authentication, but even if you don't authenticate and they MitM you, you're costing them some resources. Best of all, a Man in the Middle might not know whether you have authentication or not. If you know the other guy's key id and the MitM thinks you don't, then you've just honeypotted them.

Re:Encryption

[JesseMcDonald]

Sure, but do you want to take the risk? Costs can be justified. The marginal overhead of decryption and re-encryption may not be significant compared to scanning plain-text traffic for key URLs and editing them on-the-fly. The risk of discovery for MiTM is no worse than it would be without the encryption, given their goal of redirecting requests to another search provider. It would be a different matter if they were just eavesdropping, of course.

Re:Encryption

[chill]

Dude, it's China.

XKCD explains this situation well.

Re:Encryption

[JesseMcDonald]

Sure, provided you're not relying on unverified self-signed certificates. HTTPS would work fine for securing the Search Bar—but I was responding to the more general solution proposed by the OP. "Encryption for everything" covers more than just HTTP.

Re:Encryption

[Bigjeff5]

Next thing you know you'll be signing up with a DNS service and they'll be sending you a private key in the mail. That's going to suck. Friggin dirty ISP's.

Re:Encryption

[Alsee]

Maybe then we can send them to prison for five years for circumventing your technical protection measures to illegally access your copyrighted communications.

We may as well put the DMCA to some positive use.

-

Re:Encryption

[TedRiot]

I once saw a documentary where a guy from NSA (IIRC, might be some other TLA..) stated that pretty much any encrypted communications can be intercepted, if given enough time and computing power. But they usually didn't because according to him it's usually much easier, faster and cheaper to ask from either the sender or the recipient.

Re:Encryption

[chill]

Yeah, that certainly is plausible.

Steven Levy's book Crypto: How the Code Rebels Beat the Government--Saving Privacy in the Digital Age is a good read. So is David Kahn's The Codebreakers and Simon Singh's The Code Book -- which seems almost like an updated version of Kahn's book.

The truth is a crypto algorithm like AES may be flawless mathematically, but that is just an abstract representation. Crypto is a chain of everything from the sender to the receiver, from everyday PCs infected with malware to buggy implementations of code to side channel leakage, etc. Odds are that somewhere along the chain there is a fairly easily exploitable weakness.

Why bother breaking into the vault the hard way when the bank manager has drinking problems and is frequently down at the local pub with the keys, barely able to stand upright?

Not much evidence yet...

[Interoperable]

The article is a single post on a forum from one user with no follow-up. Can anyone else confirm the allegation?

Re:Not much evidence yet...

[sam0737]

It's PCCW. What I have heard is they are hijacking NXDOMAIN, but not sure about redirecting the location bar. Maybe Firefox will try to lookup for domain for single name hostname, hence giving an impression that it redirects if your "search term" is just one word.

Re:Not much evidence yet...

[jimicus]

Indeed, the poster only discusses what happens when he puts the name of a website into Firefox's address bar. By default, that will carry out a DNS lookup and if that lookup fails, Firefox will redirect to a Google "I'm feeling lucky" result.

Lots of ISPs are intercepting failed DNS requests and injecting their own ad page, there's usually a way to bypass this.

Re:Not much evidence yet...

[griffinn]

Confirmed this with a few of my friends who are using PCCW Netvigator. I have the same ISP, but use OpenDNS, so haven't notice anything was amiss for some time.

Re:Not much evidence yet...

[sydneyfong]

(This is also a single post on a forum from one user... ;-p)

I'm in Hong Kong and I use that ISP mentioned in the article at home.

Never noticed the change because I've set my DNS servers to google's, but now that I test it out, my ISP's servers do seem to be returning 203.198.80.* in place of NXDOMAIN.

Fuck.

Re:Not much evidence yet...

[Bigjeff5]

Confirmed this with a few of my friends who are using PCCW Netvigator. I have the same ISP, but use OpenDNS, so haven't notice anything was amiss for some time.

Wait till they start hijacking all your DNS requests, whether they are going to their DNS or not. That's the next logical step in this progression.

Re:Not much evidence yet...

[kellyb9]

It would be mildly amusing if it was someone saying "First!"

Re:Not much evidence yet...

[KiloByte]

Don't worry, starting tomorrow they'll redirect all DNS queries to their own servers.

A local ISP I sometimes conslut for did this because of a few "computer repair/shop" punks making all machines they put their grubby mitts use a certain DNS server ran by another telco. Suddenly, that server was changed to not answer requests from the outside (ie, sane protection vs DNS amplification attacks), and guess what -- customers who ever came into contact with that rogue repair shop started screaming "the Internet is not working, fix it!".

It was so much simpler to iptables --dport 53 -j REDIRECT instead of explaining whose fault it is. Since people had their computers purchased or "repaired" in that shop working for some time, the outage must have been on the ISP's side, right?

Now take a guess what will happen if this is done for more nefarious purposes...

Sleezy

[nicolas.kassis]

This is as sleezy as it gets for an ISP. I hope firefox and google setup some sort of trusted cert and use HTTPS for the traffic from that bar. That might make it much harder for them to do men in the middle attacks of the sort. Google could sue the ISP for impersonation or something similar.

Re:Sleezy

[javilon]

Correct me if I am wrong, but in theory, if Firefox uses the google certificate, there is no way the ISP can do man in the middle attacks, that's the whole point of the certificate.

So this is the answer, start using https and certificates for everything.

And on a more general note, all traffic should be encrypted to every web site and for every Internet application.

Re:Sleezy

[wall0159]

"harder for them to do men in the middle attacks"

bloody hell, it was bad enough when there was _one_ man in the middle - now there's a whole army of the bastards!

(sorry, couldn't resist :-P)

Re:Sleezy

[Marillion]

You are correct. Unless the ISP requires you to install their certificate authority they can't forge a certificate that matches "google.com".

Re:Sleezy

[nicolas.kassis]

Well, who says it's only one server doing the intercepting. I'm simply updating the description to bring it closer to reality

Re:Sleezy

[Timmmm]

Nah it could be worse. Remember phorm?

Re:Sleezy

[GameboyRMH]

Browsers should start treating self-signed certs the same as unsecured http traffic: Don't give a warning but don't call it secure either. A self-signed cert is at least as secure as unencrypted traffic, and at most more secure than one from a cert vendor.

Maybe instead of turning the address bar green or blue with a lock icon, turn it yellow/orange with a lock with a question mark over it. That should get the message across to the mindless masses about how secure their connection is: You expect more when signing into Amazon or Gmail, but it's fine for normally unsecured pages.

Why?

[B5_geek]

For the love of $deity why would _anybody_ still be using the DNS server that their ISP provides?
Ignoring the multiple FREE DNS providers out there, it is trivally easy to setup your own caching DNS server regardless of the OS platform you use.

With the abundance of 'old' computers that most people upgrade from, it shold be standard practice to setup an old box as a firewall/dns server.

Re:Why?

[Get on the boat]

Must have missed "Manual DNS server configuration" next to step 2: Plugging in your new PC.

Re:Why?

[Anne_Nonymous]

>> With the abundance of 'old' computers that most people upgrade from, it shold be standard practice to setup an old box as a firewall/dns server.

Imagine how much power we'd save if everybody did this.

Re:Why?

[koreaman]

Do you really believe the average firefox user has the technical know-how to even understand what a DNS server is, let alone how to setup and configure one, even if it is "trivially easy" for you? Please...

Re:Why?

[wondafucka]

For the love of $deity why would _anybody_ still be using the DNS server that their ISP provides? Ignoring the multiple FREE DNS providers out there, it is trivally easy to setup your own caching DNS server regardless of the OS platform you use.

With the abundance of 'old' computers that most people upgrade from, it shold be standard practice to setup an old box as a firewall/dns server.

Really? You can set up a firewall/dns box, but you aren't familiar with laziness. Also, for the majority of internet users, setting up a firewall / dns server is not trivial. For a majority of internet users, changing the desktop background is not trivial. This affects non-nerds....you know, most people.

Re:Why?

[_Shad0w_]

It's also very easy for your ISP to intercept all DNS queries, regardless of where they're being sent, and handle them themselves. I know of an ISP that does this.

It would, of course, be possible to run an encrypted tunnel to a remote machine with a caching DNS server on it, then direct all your queries to that. I suspect this is far beyond the ken of most normal users. Just setting up a caching name server is beyond the ken of normal users. Most of them can handle turning computers on and click icons. Some of them have problems with that.

Re:Why?

[The MAZZTer]

8.8.8.8 and 8.8.4.4. That is all.

Re:Why?

[BassMan449]

I'm not using my ISP DNS server (OpenDNS) and I still get redirection from Firefox address bar. I have a caching server running that forwarders requests to OpenDNS and my ISP (Mediacom) still redirects some, but strangely not all, of the traffic.

Re:Why?

[cgenman]

Why would you bother setting up a firewall server when you have two routers that act as firewalls and the firewall on your local computer?

For that matter, what advantage is there to a caching DNS server over another provider? Windows seems to cache DNS requests locally, and I'm guessing OSX is the same.

I have my primary DNS set to my ISP's dns so that they can interrupt surfing to provide updates on service. In other words, when I'm getting cut off for being late with the check, I'd rather they tell me that's why it's going down, rather than wondering if it is just another system outage.

Re:Why?

[gnieboer]

Or just block DNS ports except from their approved servers.

Just like most ISP's do already for SMTP.

Re:Why?

[bendodge]

I use my cable co's because it's faster than OpenDNS and Google's DNS. It's also not obnoxious. Even though I hate them for being a monopoly, CableONE is fairly decent. They actually called my house to tell me that I could get a free speed upgrade (they just have to mess around with the boxen).

Making their own argument for net neutrality...

[MikeRT]

Most people still believe that just because you can legally do something, doesn't mean you should. When businesses do every sneaky, duplitious thing they can to make a buck, they push that natural tendency toward expecting civility and something resembling high-mindedness in civilized people straight into the Socialist camp.

As a Capitalist, that really offends me. If businesses want to be treated laissez faire then they damn well better learn to make society not feel like they're a bunch of crooks who care so little about the common good that if regulators aren't going Big Brother on them every nanosecond they'll steal everything that isn't nailed down and cheat everyone who isn't paying 110% attention to every detail of their lives.

Re:Making their own argument for net neutrality...

[Anonymous Coward]

Indeed! Adam Smith's laissez faire was based on thousands of small, independent businesses --not a few monopolies. Perhaps that is why in Europe people are not bothered by the idea of government intrusion in controlling their lives, but rather big business intrusion and controlling their lives.

Re:Making their own argument for net neutrality...

[jimicus]

As a Capitalist, that really offends me. If businesses want to be treated laissez faire then they damn well better learn to make society not feel like they're a bunch of crooks who care so little about the common good that if regulators aren't going Big Brother on them every nanosecond they'll steal everything that isn't nailed down and cheat everyone who isn't paying 110% attention to every detail of their lives.

... which is precisely why there is regulation in every civilised society on the planet, and no such thing as a 100% capitalist society.

Re:Making their own argument for net neutrality...

[John Hasler]

> ...a bunch of crooks who care so little about the common good that if
> regulators aren't going Big Brother on them every nanosecond they'll steal
> everything that isn't nailed down and cheat everyone who isn't paying 110%
> attention to every detail of their lives.

That pretty much describes the entire human race. Including the "regulators".

Re:Making their own argument for net neutrality...

[John Hasler]

> ... which is precisely why there is regulation in every civilised society on
> the planet, and no such thing as a 100% capitalist society.

People do not become superhuman when they become part of government. They merely acquire power over other people.

Re:Making their own argument for net neutrality...

[geoffrobinson]

Well, to be fair, Europe has a long cultural history which was more at ease at government intrusion into people's lives. America has descendants of Europeans who got the heck out of there.

Re:Making their own argument for net neutrality...

[FriendlyPrimate]

Most people still believe that just because you can legally do something, doesn't mean you should. When businesses do every sneaky, duplitious thing they can to make a buck, they push that natural tendency toward expecting civility and something resembling high-mindedness in civilized people straight into the Socialist camp.

As a Capitalist, that really offends me. If businesses want to be treated laissez faire then they damn well better learn to make society not feel like they're a bunch of crooks who care so little about the common good that if regulators aren't going Big Brother on them every nanosecond they'll steal everything that isn't nailed down and cheat everyone who isn't paying 110% attention to every detail of their lives.

It's even worse than this. It is now considered immoral to NOT do any possible sneaky duplicitous things, because the benefits to the shareholders outweigh anything else.

Re:Making their own argument for net neutrality...

[lennier]

Well, to be fair, Europe has a long cultural history which was more at ease at government intrusion into people's lives. America has descendants of Europeans who got the heck out of there.

And during/after WW2, got the heck back into there in a big way. 'Freedom' started being spelled 'strategic dominance', weapons of mass destruction began being called a 'shield', and the War Department got renamed 'Defense'.

Re:Making their own argument for net neutrality...

[mjwx]

As a Capitalist, that really offends me. If businesses want to be treated laissez faire then they damn well better learn to make society not feel like they're a bunch of crooks who care so little about the common good that if regulators aren't going Big Brother on them every nanosecond they'll steal everything that isn't nailed down and cheat everyone who isn't paying 110% attention to every detail of their lives.

Here's the thing, you cant force businesses to act in an appropriate manner under a laissez faire system, they are permitted to do whatever they want which is why Libertarianism will never work. It relies on everyone thinking in the exact same way, which fails in reality.

Today, the Golman boss Lloyd Blankfein told the senate they have "no moral obligation" to investors when advising them to invest in ventures they themselves are betting against. Corporations are not good entities, this is what Libertarianism will always fail at seeing. Under laissez faire corporations have no imperative to act any different, it is as they say "anarchy for rich people".

So, the highly regulated telecommunications industries of Australia and Europe are in better shape and a lot more competitive then the poorly regulated US industry and this tells you regulation is a bad thing. I know I can go into any major Australian city and get coverage on any telco yet US telco's consider the line "fewest dropouts" to be a sign of a good network.

Re:Making their own argument for net neutrality...

[klkblake]

So, the highly regulated telecommunications industries of Australia and Europe are in better shape and a lot more competitive then the poorly regulated US industry and this tells you regulation is a bad thing. I know I can go into any major Australian city and get coverage on any telco yet US telco's consider the line "fewest dropouts" to be a sign of a good network.

There is *zero* competition in ISP infrastrucure in AU. With the exception of two suburbs in Sydney, the entire internet infrastructure in this country is owned and operated by Telstra. ISPs occasionally own the "last mile" connection, but to provide internet access they have to buy it from Telstra. Hence Telstra being pissed at the National Broadband Network.

Re:Man in the Middle

[Nadaka]

You can try. It might even work this time. But they can also choose to misdirect the request based on the IP address because they literally are the man in the middle, your traffic must pass through their routers.

Re:In China?

[Pharmboy]

They outed the almighty Google...

Google is gay?

They can if they're in China

[elrous0]

This is, after all a Chinese city redirecting search traffic away from Google. Hardly surprising, considering the recent lack of love between the Chinese government and Google (even though Hong Kong is *supposedly* exempt from much of China's more repressive policies)

Re:They can if they're in China

[diamondsw]

Despite the handover in 1997, Hong Kong is still very much its own entity, sharing more in common with Seoul and Tokyo than with, say, Shanghai. They have protests, marches, and as far as I could tell the internet wasn't subject to the Great Firewall. Having been there three months ago and a wife there now, I *think* I can say that much.

Re:They can if they're in China

[dwye]

> Having been there three months ago and a wife there now, I *think* I can say that much.

But can you say the opposite (assuming that you aren't looking to upgrade the spouse)?

Re:They can if they're in China

[dwye]

> How long before the evil empire starts paying ALL ISPs to redirect everybody to bing?

You mean Baidu.com. The ISP is located in Hong Kong, which is not PRC only by its current forbearance, so them redirecting Google when Google is about to be banned is no more surprising than it would be if they were in Beijing.

Or do you really think that Microsoft has enough money to bribe the PRC?

Re:Man in the Middle

[Volante3192]

Or run your own DNS server?

This is why we need net neutrality

[Fallen Kell]

A perfect example of why we need net neutrality rules in place. An ISP should not be allowed to modify packets or redirect packets to/from known destinations.

Re:This is why we need net neutrality

[AnonymousClown]

A perfect example of why we need net neutrality rules in place. An ISP should not be allowed to modify packets or redirect packets to/from known destinations.

We can have all the rules we want till we're blue in the face, but what do we do about countries who violate them? Block them? And what if they don't give a shit?

Re:This is why we need net neutrality

[Fallen Kell]

Actually this has everything to do with network neutrality. The ISP went into a business relationship with a search engine and then changed all the DNS entries to redirect all traffic from all other search engines to the one they have a business relationship with. That isn't a "hacked" connection, that was packet re-prioritization at the ultimate level. Instead of sending the packets to where the user wanted, the ISP sent them to their own service to make more money from their services (thru ads etc.), and away from a competing service. That is the very definition of a NON-neutral net, since they are being HOSTILE to other networks and services.

Re:This is why we need net neutrality

[elashish14]

Exactly, think of where it could go. Who knows, next they're probably being bribed by spammers or phishers to redirect to sites that will maliciously install spyware and shit. If they're not already. I mean, think about it, what would stop them?

More profit!

[redscare2k4]

1) Be an ISP
2) Create an online shop ala amazon.
3) Redirect all users to your shop
4) Profit!

Re:More profit!

[Yvan256]

They could even be sleazy and open up shops that almost look like the same name depending on the font used.

Shop at Arnazon.com!

Re:More profit!

[Locke2005]

Fortunately, amazon is smart enough to typo-squat their own name! amaz0n.com and arnazon.com simply redirect to amazon.com.

Re:More profit!

[snowwrestler]

They could even be sleazy and open up shops that almost look like the same name depending on the font used.

They would not need to, since they control the pipe through which all your traffic passes. They could simply load their site and set their DNS to call it "amazon.com". Or redirect all requests for "amazon.com" to "ISP-shop.com" whether you want them to or not.

Re:Obviously

[Pharmboy]

Best answer so far. Yes they can. The real question should be "SHOULD they do this".

Re:Obligatory

[Yvan256]

Title is by-passing. I was expecting a funny reply about "you've got to build bypasses!" in the "letter from your ISP" format.

Re:Obviously

[Yvan256]

No.

My ISP has been doing this for some time now

[the plant doctor]

I use a small, local telephone company for my DSL. They're reliable, not the fastest or the cheapest, but hey, it's pretty much a monopoly unless I want the cruddy cable service provider that is unreliable in their connectivity and just as expensive.

For six years now I've dealt with this. At work I just type a keyword and end up at the site I wanted. At home I do that by mistake and I get a page with an advertisement for something local saying the page couldn't be found.

Extremely annoying, but I don't have much choice as I don't want cable or their cruddy service, so I deal with it.

Re:My ISP has been doing this for some time now

[Anonymous Coward]

use a different DNS server

Re:My ISP has been doing this for some time now

[AnonymousClown]

At home I do that by mistake and I get a page with an advertisement for something local saying the page couldn't be found.

Out of curiosity, have you type in hooker.com or something and gotten an ad for something local? Or potsmokers.com?

Just wondering.

Re:My ISP has been doing this for some time now

[Fross]

Block all content from the server they're using to advertise their spam?

Re:My ISP has been doing this for some time now

[MrNemesis]

Run your own DNS server. Faster, and you get total control over what monkeying about is done at home.

Heck, I'm with a company called Zen internet at home, who are one of the best ISP's in the UK, and do absolutely no monkeying around with DNS (and have stupidly fast servers as well), but I still run my own DNS server.

Re:My ISP has been doing this for some time now

[Orrin77]

I use a small, local telephone company for my DSL. They're reliable, not the fastest or the cheapest, but hey, it's pretty much a monopoly unless I want the cruddy cable service provider that is unreliable in their connectivity and just as expensive.

For six years now I've dealt with this. At work I just type a keyword and end up at the site I wanted. At home I do that by mistake and I get a page with an advertisement for something local saying the page couldn't be found.

Extremely annoying, but I don't have much choice as I don't want cable or their cruddy service, so I deal with it.

You don't have to use your ISP's DNS servers, which is probably what is enabling the redirection. Use OpenDNS instead.

Routine Altering of DNS? Really?

[Petersko]

"For the love of $deity why would _anybody_ still be using the DNS server that their ISP provides? Ignoring the multiple FREE DNS providers out there, it is trivally easy to setup your own caching DNS server regardless of the OS platform you use."

Because the internet stoppped being just for techies 10 years ago? Step out of your little bubble, you dweeb, and look around. First you have to give a crap about the concept of a DNS, which is exactly one step too far for the vast majority of folks.

Rightly so, too. If my family had to worry about things like that they would never have gotten any further than the occasional email.

In my past I've frequently been in your position - wondering why the whole world doesn't give a crap about some ridiculous thing I think is incorrect. However, this year I'm turning 40, and for some reason I'm starting to get the other perspective. The "ridiculous" is on the other side.

This is a Mozilla Problem

[chemindefer]

I have the same issue in Seamonkey, just posted about it on the Mozillazine forums as well. http://forums.mozillazine.org/viewtopic.php?f=5&t=1811375

Re:This is a Mozilla Problem

[chmod a x mojo]

NO, this is a DNS problem. Chartercom started pulling this shit with their DNS servers years ago, after switching to openDNS routerside and bypassing charters DNS servers the issues stop and location bar searching works as expected.

Re:This is a Mozilla Problem

[Bengie]

I use Charter at home to. Typo a domain and get their crappy advertising. Typically, my Chrome Address bar does an extremely good job auto completing and/or fixing my typos anyway.

One nice thing about using the Charter DNS is it's very fast. I'm getting an average 30ms response time via DNS from them when running a DNS benchmark. Even Google's DNS 8.8.x.x is coming back with ~70ms. Now mind you, I have a 30ms ping to Google at ALL times of the day, so it's 15ms there 40ms to process the request and 15ms back. Charter's DNS is something like 5ms there, 20ms to process and 5ms back.

My response values where acquired using some DNS benchmark tool from Google and averaged over 34k DNS entries.

Obviously my local branch DNS server is going to have much better network response to me and much less load than Google's servers, but the only metric I'm using to "grade" the servers is response. Google may give better "quality" response.

Re:In China?

[Nadaka]

If any high tech company is going to come out of the closet, it would be apple.

Re:Obviously

[Nadaka]

Obvious answer as well. The real question is, what can you do about it?

Re:In China?

[Minwee]

Google is gay?

You never wondered about the rainbow colours in their logo?

Probably NXDOMAIN wildcarding....

[nweaver]

What firefox does is first try to do DNS lookups for:
foo
foo.com
www.foo.com

before launching the google search.

Thus NXDOMAIN wildcarding (which is unfortunately growing very common, distressingly so in our data) will mess up the firefox behavior by causing one of the three names to resolve to the "helpful" search page belonging to the ISP.

Re:Probably NXDOMAIN wildcarding....

[sconeu]

What's a good DNS server to use that doesn't wildcard NXDOMAIN?

Re:Probably NXDOMAIN wildcarding....

[nweaver]

A: If the ISP is good, they have an opt-out to a non-wildcarding DNS server.

B: If the ISP is not, I hate to say it but use Google Public DNS (8.8.8.8 and 8.8.4.4), as they don't wildcard or do anything beyond use the DNS information for data-mining purposes.

I'd personally STRONGLY AVOID OpenDNS, which does lots of bad things to DNS: NXDOMAIN wildcarding ANY address (not just www. addresses), SERVFAIL wildcarding, wildcarding addresses which HAVE valid records but just no A record, and even man-in-the-middling Google!

Re:Probably NXDOMAIN wildcarding....

[nweaver]

Actually, it is: Firefox on the mac, typing in "fubar" into the browser

7336+ A? fubar.ICSI.Berkeley.EDU. (41)
7336 NXDomain* 0/1/0 (91)
33396+ AAAA? fubar.ICSI.Berkeley.EDU. (41)
33396 NXDomain* 0/1/0 (91)
53828+ A? fubar.Berkeley.EDU. (36)
53828 NXDomain 0/1/0 (94)
31608+ AAAA? fubar.Berkeley.EDU. (36)
31608 NXDomain 0/1/0 (94)
16219+ A? fubar.com. (27)
58529+ AAAA? fubar.com. (27)
16219 1/2/0 A 66.238.90.231 (83)
58529 0/1/0 (82)

So type in fubar, its first looking up fubar through the local DNS search path, and then fubar.com
So any wildcarding in the early part will nail it.

Likewise, for slashdot, its first doing local lookups before the google search:
61012+ A? slashdot.ICSI.Berkeley.EDU. (44)
61012 NXDomain* 0/1/0 (94)
52372+ AAAA? slashdot.ICSI.Berkeley.EDU. (44)
52372 NXDomain* 0/1/0 (94)
01773+ A? slashdot.Berkeley.EDU. (39)
1773 NXDomain 0/1/0 (97)
28834+ AAAA? slashdot.Berkeley.EDU. (39)
28834 NXDomain 0/1/0 (97)
60412+ A? www.l.google.com. (34)
60412 4/4/4 A 74.125.19.147, A 74.125.19.104, A 74.125.19.103, A 74.125.19.99 (234)

A nxdomain wildcard will EASILY mess up this process.

Re:Probably NXDOMAIN wildcarding....

[characterZer0]

A: If the ISP is good, they have an opt-out to a non-wildcarding DNS server.

If the ISP is good, their wildcarding DNS server will be opt-IN.

B: If the ISP is not, I hate to say it but use Google Public DNS (8.8.8.8 and 8.8.4.4), as they don't wildcard or do anything beyond use the DNS information for data-mining purposes.

Q: What is to stop your ISP from redirecting all outgoing packets to port 53 to their own DNS server?

A: Nothing. And some do.

Re:Probably NXDOMAIN wildcarding....

[nweaver]

Q: Whats to stop your ISP from redirecting all outgoing packets to port 53 to their own DNS server?

A: If an ISP does this, we'd detect it: thats one of the tests we check for explicitly in Netalyzr: we send raw DNS requests directly to our server and ensure that they are not intercepted or proxied or modified on the way.

Re:Probably NXDOMAIN wildcarding....

[darkain]

alternate public DNS servers that have worked great over the years:

4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4

Out in Montana, both Qwest (DLS) and Bresnan (Cable, just about as crap as Comcast) both use wildcard DNS for their own search pages, so I've had to switch countless customers over to this alternate DNS server.

From a speed point, these particular servers also resolve names faster than either of the ISP's provided servers, speeding up the user experience at the same time.

Re:Probably NXDOMAIN wildcarding....

[lwsimon]

Cox recently "messed up" and redirected Google search traffic from Firefox's search toolbar - not the Awesomebar. They corrected the issue, but I seriously doubt that it was by mistake. I think it was a trial balloon.

Re:Probably NXDOMAIN wildcarding....

[nweaver]

TCPdump and trimmed the output.

Its because it first has to make sure the name isn't valid, at least within the local DNS context, so you will ALWAYS get fubar.{MY-DNS-SEARCH-PATH} before going to goole.

Re:Probably NXDOMAIN wildcarding....

[egcagrac0]

Mods, +1 informative

Yes

[Danathar]

They can if they are in China.

I have the perfect solution

[Bob Cat - NYMPHS]

Use Google's DNS.

8.8.8.8
8.8.4.4

Pretty easy to remember, too.

Re:I have the perfect solution

[Sabriel]

This is an ISP. If they don't have gear that can make 8.8.8.8 at your end go to a different IP address at their end, they aren't worthy of their acronym.

UPC Netherlands pulls the same kind of trick on ya

[Morpheus4you]

UPC in the Netherlands currently pulls the same kind of trick on you.

Their DNS servers have a catch-all redirect to there own search portal. They have instructions on how to undo it (manually change your dns servers), but the common man doesn't of course know how to do that.

Shouldn't governments protect us from this evil?

Re:communist China

[peragrin]

Not really no. China's leaders aren't stupid. They realized Russia fell trying tokeep pace Econmically with the USA. Then china realized theyout number us 4-1. So all they had to do was convert their poor peasants into manufacturers. The fastest wayto do that is to invite foriegn companies to use their labor. Putting their own people in place to learn the tricks of the various trades. After 20 years they will be teaching their own people to do that on their own. (current place). After that they can kick out the foriegners.

However in reality I think china and the USA are on a Course for merger in a couple of centuries. Slowly the USA will add socialist ideals totake dare of thosewho can't. And china won't be able to shake the grip of the captalism that is slowly changing their country.

China?

[PatDev]

Heck, it happens here in the USA. I'll name names too - Windstream Communications. As of a couple months ago they started redirecting our google search bars to their custom search portal. Annoyed the hell out me. Emailed, but apparently got dumped into the bucket of spam/"unhappy customer, please ignore".

Re:China?

[Anonymous Coward]

Windstream pissed me off too. They do, however, provide a link on the redirected results to "opt out" and opting out does actually work.

Re:China?

[ErkDemon]

An ISP who tampers with the information stream risks losing the legal protection that they normally get for being a simple telecoms carrier who just "supplies the wires".

The usual argument is that an ISP isn't legally liable for the information that they carry (as long as they comply with some basic rules), because their whole business model is based on them being a dumb carrier. They don't edit, they can't edit, it's not their job to edit, and if they tried, they'd be failing their customers and be wrecked as a business. If someone emails a piece of child porn across their network, they aren't guilty of aiding and abetting, because it's not their job to read or alter content.

So if an ISP has decided that it might be able to make a bit of extra money by deciding to divert search requests and exercise editorial control over what their customers are able to access, then ... bad news ... they've just broken that principle, stopped being a simple carrier and started to be an edited service. And with editorial power comes editorial responsibility. And that means that if someone goes on a killing spree and their family decides that they were influenced by content they found on the net, then if the person's ISP felt entitled to edit out Google, but not to edit out gun retailer sites or extremist political sites, the family's lawyer can now try to sue that ISP, on the grounds that the ISP has already discarded the principle that it doesn't filter content.

Any time an ISP pulls a redirection stunt like this, don't complain to their technicians: write a polite little note to their board of directors, or to their technical director, asking whether the shareholders understand that they're risking operating a corporation without legal "pure carrier status" protection. This is potentially a "shareholder alert" situation. Does the company's prospectus inform shareholders that the company is operating outside the usual "dumb carrier" rules?

If they're making extra money on the side by stealing Google business, by "diverting the flow", ask them if their legal department has estimated how much they stand to lose if they get sued. Not by Google, but by the mother of some kid that got murdered after meeting someone they shouldn't from an internet chatroom.

Simple "carrier" ISP's don't edit for a reason. By deliberately firewalling themselves off from editorial powers, they give themselves a degree of immunity from being liable for what they carry. That's not something you throw away lightly. And if I was the CEO of another ISP, I'd be wanting to ring the CEO of this ISP, and ask them what they hell they thought they were doing, and whether they were trying to bring down the entire industry.

Re:China?

[J053]

I know it's been stated probably thousands of times on /., but ISPs are NOT common carriers. See FCC v. Brand X, USSC, 2005.

Re:Once you signed the agreement

[Fross]

And all of a sudden, you realise that EVERY car dealership in town has small print saying "...and if you buy this car, we can fuck you in the ass."

Well, you don't like being fucked in the ass. But there are only 3 car dealerships available to you, and they all have this small print in it. And you really need a car.

So what do you do?

Re:Geez! I tell ya...

[cybiko123]

What backbone? There isn't one; the internet is a distributed network.

The closest you could get is probably one of these. Of course, these companies are ISPs, too.

Re:Geez! I tell ya...

[gnieboer]

as mentioned elsewhere, setting to other DNS servers can be defeated.
But... leasing dedicated servers is cheap (now), and VPS even cheaper.
Set one up as a VPN/Proxy server, and route your connection through there. The major server hosting farms can't (edit: won't) do any re-direction tricks as they would gain little/nothing from it.

That will effectively get you your direct access (with a latency/bandwidth penalty) without some insane cost.

Alternatively, business packages from the same ISP -may- have a different setup, but at a higher cost.

Re:Your asking like this is a crime in china...

[jonbryce]

It is Hong Kong, which unlike mainland China, has a democratically elected government.

The rise of personal resolvers?

[tlhIngan]

I'm surprised that people haven't started making personal resolvers easy to set up and use - or routers don't start coming with them to bypass the ISP resolvers. After all, all you really need is the list of root servers (which change inrrequently and are available at a well-known place for self-bootstrapping) and that's it. Eliminates pharming (poisoned DNS servers), ISP shenanigans including NXDOMAIN, and possibly others.

Add in the ability to link with DHCP in the router and no more needing annoying IP addresses for a home network.

Windstream, DSL US ISP is already doing this

[Anonymous Coward]

This isn't new, and this isn't NXDOMAIN hijacking. Windstream, a US DSL provider, was already caught red-handed doing this. Not only this but they also refuse to answer very specific questions asked (see http://www.dslreports.com/forum/r24059591-DPILayer7NXDOMAIN-Privacy-questions-re-Windstream-DSL) and provide a paper-thin excuse as to why it's happening (see http://www.dslreports.com/forum/r24074065-Our-Response-to-Redirect-Service-Concerns).

Affected users are not using the ISP's DNS servers, this is not NXDOMAIN hijacking. This is layer 7 inspection, the sheer fact the URL was transformed, being carefully re-written, from the URI passed to 'www.google.com' discredits what Windsteam has said entirely.

When a user performs a search using the Firefox search bar against Google HTTP/1.1 is used with an HTTP method of GET against Google. The following URI is constructed:

q=[search critera]
ie=[encoding]
oe=[encoding]
aq=
rls=[browser]

So, when I search against Google I pass ?q= for my search term.

When this is redirected to searchredirect.windstream.net the URI is transformed, with the ?q= parameter being extracted. Windstream's site uses this URI structure:

search=[search criteria]
src=[interger value, likely points to an RDBMS based on HTTP_REFERER]

Windstream is not disclosing the truth. For this behavior to occur you would have to be using an MITM proxy or DPI; either way they are inspecting layer 7 traffic, extracting the ?q= URI string passed to Google, and either transparently or via HTTP 302 redirecting customers to searchredirect.windstream.net

They got caught, red handed, and have been fabricated mis-truths from the start.

How HTTP/1.1 GET against /search?q=my_search_term becomes /search.php?search=my_search_term without some form of Layer 7 is impossible. This CANNOT be NXDOMAIN.

Clearly they're not disclosing the full details or hiding behind careful sentence structure and semantics. This appears that there is now an industry initiative and a company behind this search harvesting and privacy invasive technology which is being sold to ISPs. Expect more to come, this isn't isolated to over-seas, it's already happening right here in the US.

-SirMeowmix_I

Re:Windstream, DSL US ISP is already doing this

[nweaver]

If you are a windstream customer, could you please run netalyzr (http://netalyzr.icsi.berkeley.edu) and send teh results URL to netalyzr-help@icsi.berkeley.edu?

I'd like to investigate this in further detail.

Re:In China?

[greenreaper]

Apple isn't gay, they're just metrosexual. That way they get to look fashionable without actually taking it in the butt.

Yes.

[djsmiley]

Yes.

But then again customers can stop using them. (Of course theres legal ins and outs depending on the contract you signed... but you read that of course didn't you?)

Re:Man in the Middle

[omnichad]

or based on HTTP request headers.

This can be solved simply

[Billy the Mountain]

All Google needs to do is modify their search bar to encrypt the outbound search string using Google's public key. By doing that, it makes it difficult to intercept whatever search is being done.

Re:This can be solved simply

[6031769]

We have an abbreviation for that: it is "https".

Re:In China?

[roman_mir]

Apple is bi or multisexual, its customer love having unprotected sex with Apple (and Jobs by proxy... hmmmm... jobs, what kind of jobs I wonder) and you know, Apple's customers are of all genders I think.

I suppose there is an App for that, iSex anyone?

Re:Once you signed the agreement

[kaizendojo]

And all of a sudden, you realise that EVERY car dealership in town has small print saying "...and if you buy this car, we can fuck you in the ass." Well, you don't like being fucked in the ass. But there are only 3 car dealerships available to you, and they all have this small print in it. And you really need a car. So what do you do?

I buy KY or take the bus.

Seriously, though - you are talking hypothetically and I am talking about this example. If you don't like anal, then perhaps you should take steps to avoid "suprise butt secks". If you trust every company to put only nice things that benefit you in their terms and conditions, then you are living in a fairytale world. Why is it that people aren't willing to take responsibility for their own lives and then complain about a "nanny-state" governement??

Re:This is ridiculous.

[keeboo]

Apparently racism against white people is fine for you.

Wait...

[ceoyoyo]

The issue is that the ISP is redirecting your malformed URL before Firefox can, right? And yet the ISP is sleazy and Firefox is a victim?

How about everybody not fiddling with DNS responses, at least not without asking permission first?

Re:Once you signed the agreement

[Locke2005]

Yeah, if I'd bothered to read the agreement, I would have noticed that I had agreed they could have sex with my wife anytime they wanted, and my wife was required to submit... boy is my face red!

If it is an unconscionable contract, you cannot be legally held to it. The best thing to do is to guarantee the customer has adequate choices available, then the customers who care about the ISP butt-raping them will eventually gravitate to an ISP that doesn't -- or at least to one that uses lubricant.

Re:In China?

[value_added]

"Hi, I'm Pat. I'm a PC."

Re:Obligatory

[Bigjeff5]

I thought it was funny, apparently there aren't as many HHGTTU fans on Slashdot as I thought.

And it's perfectly a on-topic reference.

Metrosexual? That's way too kind.

[Overzeetop]

1. Apple makes Kurt from Glee look straight.

2. I suspect that, based on their approach to their users, Apple would be more likely to pitch than catch.

Re:Your asking like this is a crime in china...

[Bigjeff5]

Which only exists by the good grace of mainland China.

They are a separate entity only because China decided it would be economically beneficial to allow them to remain separate. It's not a strong position for HK to be in.

China still has influence on Hong Kong

[sabt-pestnu]

For all that Hong Kong people may have the right to demonstrate, have a separate judiciary, there are still companies operating in Hong Kong that are being pressured to conform to mainland laws...

A Hong Kong Internet company, called TOM Online, announced it had stopped using Google's search mechanism. "TOM reiterated that as a Chinese company, we adhere to rules and regulations in China where we operate our businesses," the company's parent, Hong Kong-based TOM Group, said in a statement Tuesday.

Companies owned by people/companies subject to Chinese laws, or wishing to do business in China proper, will certainly have to make decisions based on the relations they want to keep with the Chinese government. I can well imagine employees of a HK company being denied visas based on the ire of some Chinese bureaucrat. Or Chinese citizens who own an obstreperous HK company getting harassed because of the behavior of that company.

Re:China still has influence on Hong Kong

[wvmarle]

Of course any company wishing to do business in mainland has to conform to mainland laws. That is not just for HK companies. It accounts for all companies, and it is why Google redirected its censored google.com.cn search engine to uncensored google.com.hk.

And of course it works always like that. If a company wants to do business in Germany they have to follow German law. If they want to do business in the US, they have to follow US law.

And HK is independent enough for companies operating in HK to fall only under HK law and not under mainland law. It is just that TOM Online wants to do business in mainland, and then their mainland business falls under mainland laws. And that has nothing to do with the fact that the parent happens to be in HK. Also there is no pressure from mainland on companies not operating in mainland to reform and conform to their laws - of course they sometimes do try to pressure the HK government to change the laws, but that's another matter.

Re:Clearly illegal

[jc42]

... in the course of which data is falsified. I believe we call people who do something like that "terrorists" nowadays.

Nah; we usually call them "marketing". Which is pretty much what's going on in this case.

https://duckduckgo.com/

[tofupup]

duckduckgo is amazing in my book - it
makes me feel warm and fuzzy inside.

I tried most of the major websites and no dice with https.

Here are few that do
https://www.blackle.com/
https://www.powerset.com/
https://www.leapfish.com/
https://www.a9.com/

honorable mention
https://www.vadlo.com/

and a mystery anyone know what's up with this
https://www.ask.com/
https://www.bing.com/

Youtube redirection

[masmullin]

Soon ISPs will be redirecting youtube traffic to here http://www.youtube.com/watch?v=b1WWpKEPdT4

sigh.

Re:Geez! I tell ya...

[mlts]

This is only the first ISP out of the gate who wants to do this. With net neutrality on the ropes, I'm sure people at a rogue ISP have considered most of the following:

Redirect traffic to sites to the highest bidder. If search engine A wants traffic redirected from google.com, they have to bid more than search engine B.

Use throttling to discourage traffic. If Google's pages start taking 30 seconds to load up, eventually people will use another search provider. Since this can be done via ports, a traceroute or ping will not detect these shenanigans. Of course, the destination site gets blamed.

Use passive interception to build not just a profile on people's Web surfing, but with smart utilities, intercept E-mails to make a non-anonymous profile to sell to the highest bidder. One doesn't need to have full access to an E-mail server to read stuff that swings through port 25, or gets read via the Web, POP, or IMAP.

Inject ads via a Phorm like mechanism. If the ISP wants to be mean, they can "accidently" inject ads that are handed to them by shady clients who are known to do malformed code and exploits in browsers and add-ons. Then the target site would be blamed for these.

Replace a website's ads with their own. In the early to middle part of the last decade, there was spyware that did exactly this. This would give a rogue ISP big pay per click bonuses on the expense of the website's advertisers.

Intercept registration/login info (usernames and passwords) that are sent via plain text. This can then be sold to someone who can then use the username/passwords to log in to a website or E-mail account.

Replace people's Web postings in flight. Someone posts a complaint about a business, the POST gets intercepted and it becomes praise for the product... or even worse, the content changed into libelous posts which cause the poster to be sued, and there is no way to detect this, much less prove innocence.

Replace people's reviews on products. Someone hits a local BBB website to give a thumbs down on a company due to bad service. If the mentioned company has a deal with the ISP for the presto-chango service, the thumbs down becomes a thumbs up.

Send bogus E-mails out with the correct headers. This can get sites to be blackholed, with no way to prove otherwise if some form of cryptographic signature capability isn't used. A bit on a wire is a bit on a wire.

What can websites do about this? The ideal answer would be have everything go to the end user via SSL and the problem is solved. However, SSL takes CPU power in its setup and takedown. Second would be a way of sending signed Web pages from the servers that the browser can check for tampering. Since the signature is sent with the page (and validated by a CA against the domain names used), it wouldn't add to the CPU usage of machines (other than the first signing of Web pages when they are present), and it would only add a number of lines of text, like a PGP/gpg cleartext signature. Of course, webpages with dynamic content might end up with a performance hit signing the page, but this would be nowhere near as bad as a full SSL setup/takedown. This way, a Web browser can detect if a Web page has been altered in flight and warn the user. One can also sign various iframes, so it could display which part of the page is bogus as well.

What can users do about this? Probably just as the parent poster said -- a coloced box with VPN software. One can use the coloc box for a full VPN, or use it with a program like stunnel so only the Web browser traffic gets redirected via a SSL link.

Colocing a box whose purpose is to be a VPN gateway might soon be the only way to have an Internet free of foul play pretty soon.

Trademark infringement?

[DigitAl56K]

IANAL, but isn't it trademark infringement if your browser tries to look up Google by name and an ISP deliberately redirects to a different, similar service?

Re:Trademark infringement?

[DigitAl56K]

Further thought: I don't know if Firefox does look up Google by name when given a malformed hostname, or only does so after a DNS lookup fails.

Summary is wrong and hysteria is misplaced

[raju1kabir]

Oh for fuck's sake. This is the same thing that Network Solutions and ISPs all over the world have tried for years. Nothing new to see here, folks. Just a response to failed DNS queries that redirects to a selected search provider.

It's amazing to me that not a single person in this entire thread (at least that I detected on a fairly close skim) actually read TFA where that was made plain as day.

Switch your DNS and the problem goes away.

Re:In China?

[perryizgr8]

Apple is bi or multisexual, its customer love having unprotected sex with Apple (and Jobs by proxy... hmmmm... jobs, what kind of jobs I wonder) and you know, Apple's customers are of all genders I think.

I suppose there is an App for that, iSex anyone?

no, you should buy android for that.

Re:Obligatory

[geminidomino]

TLDR, brah

If anyone actually had to Read beyond the first line to know what it said, they fail at Slashdot.

Word of the day

[Citizen of Earth]

antitrust

Comcast

[Acecoolco]

Comcast is doing this... I have a portable version of firefox running, and comcast hijacks pages not found, and redirects it to their search, instead of allowing me to use Google!

Fuckinit

[Mana Mana]

``there's usually a way to bypass this''

Yes, there is Google Public DNS. A gratis service provided to any desiring user.

http://code.google.com/speed/public-dns/

``What is Google Public DNS?

Google Public DNS is a free, global Domain Name System (DNS) resolution service, that you can use as an alternative to your current DNS provider. ''

Re:Fuckinit

[jimicus]

Well yes, but if you're the ISP it's trivially easy to forward all requests on port 53 to the DNS server of your choice. I don't know of any in the UK that are doing this, but I've heard of it happening elsewhere.

Besides, consciously clicking the "I'm opting out of this crap, thanks" button makes it explicitly clear to the ISP what's going on.

Re:Once you signed the agreement

[dwye]

Why is it that people aren't willing to take responsibility for their own lives and then complain about a "nanny-state" governement??

I don't know. Why do people complain about the waste of duplicated services, then complain about the effects of a monopoly??

Obviously because there are more than one "people" under discussion, and you want to conflate them for the sake of a good line. That is almost as whacked as the car analogy in the GP (Seriously, what metropolitan area has just three car dealerships?).

Re:Free to choose.

[Pence128]

So how's your dial-up working out for you?

Re:In China?

[mjwx]

If any high tech company is going to come out of the closet, it would be apple.

With Apple I get the idea that Apple's mother keeps calling every 3 days to talk about grand kids but after 34 years she still hasn't figured it out.

Re:Once you signed the agreement

[kaizendojo]

Sometimes when you post, you don't realize that many folks will take you literally rather than common idom. However you are correct; let me restate what I said and see if we are a bit closer in our thinking.

Why does it seem that a growing number of the population feel that they can complain about not enough things being done for them and provided to them, and yet these same people are quick to rail about injustices when everyone has partial or overwhelming responsibility to protect their own interests? That's not just ideologic, it's BIOlogical.

If you don't like the way that things are being handled "for" you "on your behalf", it is your responsibility to handle it yourself. If you are not sure what your rights are, why wouldn't you take the time to do a bit of research, especially in this community where so many /.'ers are talented and skilled enough to find the resources.

There. fixed that for me.

Windstream Communications

[utoddl]

Browse to http://searchredirect.windstream.net./ Select "Opt Out of this Service" on the bottom right corner of the page.