Slashdot Mirror
Cox Comm. Injects Code Into Web Traffic To Announce Email Outage
An anonymous reader writes "Cox Communications appears to be injecting JavaScript and HTML into subscribers' traffic, as part of their effort to announce an email service outage. Pictures showing the popup."
Providers have been doing similiar things for a while...If you want security, use https.
Shouldn't they send an email warning us about injecting stuff in our web traffic?
Sig Battery depleted. Reverting to safe mode.
Not seeing any sort of injections here. I do have DNS set to 8.8.8.8. though.
Good-bye
We apologize for the inconvenience. Cox is experiencing a residential email outage in your area.
If you use Outlook Express or another email client you are able to send email. However, incoming email is not available at this time. Incoming messages are being stored and should be available when service is fully operational.
Restoring service remains our top priority. Unfortunately, we estimate at this time service may not be restored until tonight. We again apologize for the inconvenience. Please visit cox.com/support for regular updates.
Thank you,
Cox Communications
is that it refers to Outlook Express, a mail client that was deprecated over 5 years ago.
Who knows what else they are injecting.....
This is the not the first time they have done this. I feel that they are listening/eaves dropping between me and my communication with another server. I wish there was a law that would stop them. Reminds me of the great firewall of china.
Well hey, someone has to put those layer 7 switches to good use.
Just compromise Cox's servers, and deliver your payload. Very blackhat friendly.
Nothing to be found here. Yet, I have no email. Running Firefox with default settings.
the truth is out there
Obviously Cox are a bunch of DICKS.
It's your own fault for not realising it.
For those who wonder why people think this is EXTREMELY POOR FORM:
- Their ability to do this is based on them intercepting all your HTTP data, all the time, every day - insert massive invasion of privacy yadda yadda etc etc etc
Visit CryptoGnome in his home.
about your damned severe weather advisory! So what if a tropical storm is going to destroy my property, You're interrupting my TV time
"At least I've never seen it before. This is intrusive."
I'm not certain, but isn't there a law against messing with your packet stream, and inserting their own content?
It might depend on your user agreement, but I would never intentionally agree to a provision that would let my ISP alter my content.
I have never used my ISP-provided email address since abandoning AOL as my provider some time before half of you were born, and that's about 5 moves and 8 providers ago.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Seriously, guys. I don't want to download them over mobile. Stop this crap.
I use Millenicom, who resells Sprint, and in my area Sprint started injecting JavaScript into every page that comes over HTTP to recompress all the jpegs to a much lower quality setting.
That, at least, I could block. Now they just recompress all jpegs that come over http to a horrible level. If I want to keep the internet from looking like ass, I have to use a secure tunnel. Which is obnoxiously slow on 3G.
(Unfortunately, there's nothing Millenicom can do about it. It's up to Sprint. And there's no opt-out.)
Give me some news for nerds, not this regional crap. I don't care what is Cox & don't what to know.
They are looking for spin-2 particles at LHC, and they have a hint about two Higgs bosons. IPv6 isn't adopted yet. Quantum computers are being sold commercially. Ziegler et al. are setting up a quantum encrypted communication channel over a satellite link! There was life on earth 60 billion years earlier than previously thought.
Guys, that's what I call news. I know all that from reading slashdot (you can look it up yourself). Who cares, really, about this Cox crap?!
C'mon, do your moderating job on http://slashdot.org/recent
#
#\ @ ? Colonize Mars
#
Yep, I received this too, right on Netflix. Um, thanks, Cox, but even if I used your email service, I'd really rather watch my movie..
Keep your hands off my traffic, please. Is it too much to ask for you to simply carry my bits back and forth for the agreed-upon amount?
I'd give my right arm to be ambidextrous...
All these Cox injections are wearing me out. I have a headache and I'm really just not in the mood.
Most ISPs have this ability.
SOURCE: ISP
When your Cox unexpectedly pops up like that?
Cox should just have sent an email to the affected users.
http://michaelsmith.id.au
I wonder if they could have done the same thing with Adsense.
Target the ads for a specific area.
Anyone else?
All jokes aside.
I like how they are all legitimate now.
It's about time someone with a three-digit IQ weighed in.
Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.
So now internet companies are essentially trying to train users to trust whatever information shows up on a web page that claims to be from 'known' sources?
After all the problems that spoof emails cause for people who don't know better, you'd think an internet provider *would* know better.
pr
I'm sorry, but if you're injecting Javascript and other text into my web sessions, that's a Web Outage (and a serious security threat.) If you're doing it to announce that your email service is down, that's probably annoying to customers who do use your email service, and much more annoying to customers who don't.
(Unlike many people here, I actually do use my ISP's email service, because it includes a shell account where I'm running procmail, in addition to the spam filtering they do, so email that gets forwarded by my primary email address does go through there. But otherwise I'd be running the filters somewhere else. And it still doesn't justify breaking my http sessions.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
My intuition says the mail outage may have been faked as an excuse to test and demonstrate widespread ad injection tech on the sly.
I run Linux, I see none of these pop-ups.
Oh, right, I'm on one. _
Is there any standard (but unused...) messaging system for an upstream provider to send a network status message to its users?
Like DHCP, something that should only work on the local network, and can't work cross-network?
If there was, and it was available, would you just turn it off anyway?
Hell, with everyone going to streaming video instead of TV, what's going to happen to the Emergency Broadcast System?
Tornado? what Tornado? I was watching Netflix...
Surf using HTTPS only. Not all web sites over this, yet. But more and more complaints to them about their lack of support for secure communications could get more to see the need.
Use an offsite provy via a secure vpn/ssh. Rent a VPS for a few more a month (VPS providers are not known to be doing this, yet). Or rent one of those free-for-a-year micro instances at a cloud provider and run your own proxy and connect via ssh.
This post has been sponsored by your own ISP.
now we need to go OSS in diesel cars
Last night while trying to access my email on Cox it was down but then I noticed my traffic being redirected in odd and strange ways. I said out loud "I know it seems paranoid, but I think Cox is hijacking my traffic, I'm getting off of this site!". Now I read this and my paranoia is confirmed. I may as well think that my additional paranoid thoughts are true on this subject such as when the Cox internet goes down many times it is their DNS server which tanks because they have too many monitoring and traffic shaping measures employed and it just stalls out every now and again. They also seem to serve up ads with the same technique I was having a huge problem with OS X and checked my system up and down to find everything was fine. The only thing that changed was the ISP and I quickly switched to the Google public DNS servers. Since then I've had much more up time and way less ads. Netflix is almost twice as fast too. Don't let COX sell your privacy up the river I recommend for everyone to drop their COX DNS servers starting today.
official corporate correspondence via html & javascript on domains they don't own?... brb: gone phishing ^_^
ironic captcha: warrant
Unless the web site that you're reading doesn't offer a secure protocol. Slashdot, for example, redirects HTTPS to HTTP unless you subscribe. A lot of smaller sites don't offer HTTPS at all, possibly because they're on a shared hosting plan. Entry-level shared hosting plans tend not to include HTTPS for reasons involving outdated browsers (mostly IE on Windows XP and Android Browser on Android 2.x) and the IPv4 address shortage. I recently moved my own web site from Go Daddy to WebFaction because WebFaction offers SNI hosting, which is a form of HTTPS that works pretty much everywhere but those two outdated browsers, at no additional charge.
Who's to say some significant fraction of popup adds we see in general browsing aren't injected by the ISPs? The actual content providers could be totally unaware while the ISPs are selling ad space on any site, what a cash cow.
ISP: Hey, company X - for $100,000 we can make sure your ads are seen on 3% of all requests in region R, on sites with content targeted at demographic D.
Company X: Is that legal?
ISP: Of course! It's right here on page 17 of the terms and conditions...
Why wouldn't they??
while [ 1 ]; do echo -n -e "\xe2\x95\xb$((($RANDOM&1)+1))"; done
If you find a way to inject data (in a useful way) into an HTTPS stream without adding your own certificate to the person's computer
The easiest way is to just con users into installing a certificate. After several failed connections on port 443, the next hit on port 80 will be MITM'd to say "Have you been getting certificate errors? This certificate allows devices using this Internet connection to connect to secure websites. Here's how to install it:" followed by instructions pertinent to the User-agent that retrieved the page.
And what is to keep them from routing everything from pagead2.googlesyndication.com doubleclick.net, etc... to their own server at XXX.XXX.XXX.XXX? absolutely nothing, I do it locally using /etc/hosts as a browser independent ad blocker, but they could set up their primary dns server to steal all of google's (and others') ad revenue that Cox customers would have generated. I just threw together a working prototype using bash and netcat in about 10 lines. But why stop there, they could mirror popular CDNs with mostly static content too and inject even more revenue (ajax.googleapis.com/... for example which not only serves jquery and many popular js libraries but also static ads at imagead?...some.swf) Also did this in 5 more lines of shell + sed (obviously you wouldn't use a shell script for a production server, but it would have taken me a lot longer to do it in C)
But why stop there, route all competitor domains to similar sites owned by Cox.
But why stop there when they could layer all payment code with a "protective" Cox wrapper for a measly 10% of each transaction...
But why stop there, just make everything on the internet Cox
All completely possible. ...anyone switching to opendns yet?
Who cares if its fraudulent? It will generate enough revenue to buy our way out of it right... right?
Being a web browser support person, I get to hear about ISPs injecting code in web pages frequently, first time was ... what, 7 years ago? Of course, usually that was ads; in that sense at least Cox is not trying to sell you anything.
First case I recall was a Canadian ISP injecting their own ads into search results. More recently there's a low-cost ISP in India which will inject ads in any (insecure) web page.
Of course, I'm not going to pay for someone's service and tolerate them inserting pop-up ads into the pages I see. If they were giving the service away for free or at a substantial discount (like NetZero does) then that's one thing, but paying near full price for something like that doesn't cut it.
Actually it's far more invasive than that, it means they actually LISTEN to the phone conversation and choose the correct GAP in that conversation to inject their javascript. They don't just randomly shove in javascript into a HTTP socket, they have to be watching the traffic.
So they're giving themselves the basis for monitoring your URL surfing later too.
So when they inject adverts, or sell your surfing habits to others, they can point to this and point out that they've been monitoring web surfing and injecting message 'for service quality purposes' for a long time. And thus the change is actually minor, because you like quality service don't you?
Remember phone logs? Tony Blair demanded that phone records for everyone be kept for 2 years and available on demand, he pushed it through the EU when the UK had the chair. His argument was that 'this data is already kept for billing purposes so it changes nothing'. So he opened the basis for spying on everyone, just in case sometime in future they commit a crime. And his lawyer game was, "well it's recorded for billing" so it's only a minor change. The minor change being to keep it for 2 years and replace the warrant with a RIPA letter from one of Murdochs employees in the police.
Your surfing is already monitored, so it makes no difference if we also monitor it on behalf of Govt/RIAA/Voting Corp/Marketing Corp/Fox News/News International...
http://hardware.slashdot.org/story/03/11/11/0031204/belkin-to-offer-firmware-fix-for-router-hijacking
Charter cable in Michigan does this if your bill is overdue.
Dicks. Oops, I mean Cocks.
Or file a complaint for violation of Net Neutrality by modifying part of your internet traffic to their leisure. Also, as a content provider, you could sue for breach of copyright. They are putting their preferred content in other people's web sites without their explicit permission. I'd say that's reason to sue for anyone offering content to Cox subscribers, not?
I was promised a flying car. Where is my flying car?
So if you have Cox, complain to them, if enough people threaten to leave they might actually listen, bringing up suggestion of class action lawsuits might help too.
corporate.investor.orderinfo@cox.com
Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
HTTP is used for many purposes besides delivering HTML pages. This is a stupid idea.
Cox probably only injects it when the response has the correct MIME type, so you don't get it in images and binaries. Still, there is a huge amount of XML and HTML that is never intended to be seen by the user: automatic update checks can break, all kinds of mobile applications and other networked applications, aggregator services, etc. Some IM programs use HTTP-like requests.
There was a good analogy above, that this is like playing a recorded message when someone makes a phone call, before transferring it to the correct recipient. As you can imagine, this would screw up faxes and modems quite bad.
Now that I'm done complaining, I should come up with an alternative. The best candidate is email, but the email was down so it wouldn't help much. They surely should put up a big message on the home page, as many people will be going there to look up the phone number for tech support. Apart from that, I think the correct way to handle it is to do nothing. This HTTP injection technique may be appropriate for urgent security problems, but not for announcing an outage.
This is basically a man-in-the-middle attack.
"A plan fiendishly clever in its intricacies"- Homer Simpson
Bend Broadband (Bend, OR) has been doing this for at least 3 years by now. Is this seriously the first time anyone has noticed this?
Not much difference between this and the "emergency alert system" on radio and TV. Content is interrupted and "important" messages are broadcast in its place. Maybe this needs some coordination and oversight by the FCC, and this could become a good thing. Compared to 20 years ago, very few people would realize any benefit from the TV/radio emergency broadcasts, unless it was on the Internet somehow like this.
For that reasoon alone, I urge partners and colleagues to switch to IPv6 IP based virtual hosts for crowded externally facing virtual hosts
Let me know when all home DSL ISPs, all home cable ISPs, all home fiber ISPs, all satellite ISPs, and all mobile ISPs are routing IPv6. Otherwise, users behind an IPv4-only ISP will likely end up failing to connect to externally-facing hosts that you set up because there's no A record, only AAAA.
This has been popping up while I'm browsing porn and it's making me extremely nervous.
will give you a clear internet windscreen.
The Cable Companies want you to PAY for cable TV even though you still have to watch advertisements.
Now Cox Communications are doing functionally the same thing in your internet.
Are you ABSOLUTELY certain that those ads you see weren't actually injected by Cox just like these outage notices?
Vote with your wallet people, this is yet another deliberate attempt to completely screw up everything we love about the internet.
Visit CryptoGnome in his home.
ISP does what they told you they would!
If you don't want this kind of thing happening, read the terms of service before you sign up.
Just email everyone about the problem!
Its not really advanced DPI filtering injecting code on a packet per packet basis, most likely what they doing is using firewall to redirect all port 80 outgoing traffic through a proxy like squid, nginx etc and those programs have a simple config type file you can edit to insert what you want. Its really an evasion of privacy to do this, even more so because hollywood and music industries latest way to make money is say, make a crappy cd of music, post it on a torrent, then go sue any IPs downloading it, asking ISP's to invade users privacy to snoop their traffic to obtain this information, yes, what a joke. What is really going to happen if ISP's continue down this road of not protecting users privacy, users will start using third parties to bypass their ISP's filtering and inspection, opening up a whole new problem of possible malware etc. I mean look at problem with not offering windows7 or windows8 free to begin with, people download and install it and take the malware just to get it free, at least OS's like linux have it right here. In my opinion if ISP's are doing any kind of packet inspection at all, yes its almost like having to pay a cable company to watch their ads, then their service should be sold at a reduced cost, and it should be made public their terms of service for handing you over to joe and pop music store law firm for downloading anything as well so you can take appropriate measures to bypass their inspection to protect their own privacy through encrypted VPN's or whatever they can.
Couldn't they, you know, send their email customers an email?
Nah, probably get blocked as spam.
Who have they outsourced their email administration to?
--
Never attribute to stupidity that which can be explained by greedy self-interest.