Slashdot Mirror
Cox Comm. Injects Code Into Web Traffic To Announce Email Outage
An anonymous reader writes "Cox Communications appears to be injecting JavaScript and HTML into subscribers' traffic, as part of their effort to announce an email service outage. Pictures showing the popup."
Providers have been doing similiar things for a while...If you want security, use https.
Shouldn't they send an email warning us about injecting stuff in our web traffic?
Sig Battery depleted. Reverting to safe mode.
is that it refers to Outlook Express, a mail client that was deprecated over 5 years ago.
Just compromise Cox's servers, and deliver your payload. Very blackhat friendly.
"At least I've never seen it before. This is intrusive."
I'm not certain, but isn't there a law against messing with your packet stream, and inserting their own content?
It might depend on your user agreement, but I would never intentionally agree to a provision that would let my ISP alter my content.
I use Millenicom, who resells Sprint, and in my area Sprint started injecting JavaScript into every page that comes over HTTP to recompress all the jpegs to a much lower quality setting.
That, at least, I could block. Now they just recompress all jpegs that come over http to a horrible level. If I want to keep the internet from looking like ass, I have to use a secure tunnel. Which is obnoxiously slow on 3G.
(Unfortunately, there's nothing Millenicom can do about it. It's up to Sprint. And there's no opt-out.)
Yep, I received this too, right on Netflix. Um, thanks, Cox, but even if I used your email service, I'd really rather watch my movie..
Keep your hands off my traffic, please. Is it too much to ask for you to simply carry my bits back and forth for the agreed-upon amount?
I'd give my right arm to be ambidextrous...
You'll care when your ISP starts doing this because no one cared when it happened to others...
First they inject for "emergency notifications" and then next they'll inject for "advertisements to keep your bill down" or something even worse.
I've seen a lot of people suggest "just use Google DNS", but frankly it's a disturbing trend (unless, naturally, your existing DNS provider is even less trustworthy.)
By using Google's recursive DNS servers you should be aware that you're offering them even more information about your online habits, as if they probably didn't have enough already. I'm pretty sure that a capitalist company like Google isn't offering free recursive DNS for purely altruistic purposes (or just to 'speed up browsing').
It's also no secret that Google are proposing including the original source IP in EDNS in recursive lookups too, again obstensively for routing edge services, but of course it also has that side effect of offering all that extra juicy information to slurp up.
Before I get jumped on as a troll, I'm not anti-Google or pro-anything else, I'm not suggesting you run away from Google and use $competitor, which basically is a choice of no difference, I'm just saying before you decide to move all your services over like that, just think about the disconcerting amount of trust being placed in a company that is in the business of getting as much personal information about you as possible for their ad networks.
So now internet companies are essentially trying to train users to trust whatever information shows up on a web page that claims to be from 'known' sources?
After all the problems that spoof emails cause for people who don't know better, you'd think an internet provider *would* know better.
I'm sorry, but if you're injecting Javascript and other text into my web sessions, that's a Web Outage (and a serious security threat.) If you're doing it to announce that your email service is down, that's probably annoying to customers who do use your email service, and much more annoying to customers who don't.
(Unlike many people here, I actually do use my ISP's email service, because it includes a shell account where I'm running procmail, in addition to the spam filtering they do, so email that gets forwarded by my primary email address does go through there. But otherwise I'd be running the filters somewhere else. And it still doesn't justify breaking my http sessions.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
If you find a way to inject data (in a useful way) into an HTTPS stream without adding your own certificate to the person's computer, there are a LOT of government agencies that would LOVE to talk to you.
Actually it's far more invasive than that, it means they actually LISTEN to the phone conversation and choose the correct GAP in that conversation to inject their javascript. They don't just randomly shove in javascript into a HTTP socket, they have to be watching the traffic.
So they're giving themselves the basis for monitoring your URL surfing later too.
So when they inject adverts, or sell your surfing habits to others, they can point to this and point out that they've been monitoring web surfing and injecting message 'for service quality purposes' for a long time. And thus the change is actually minor, because you like quality service don't you?
Remember phone logs? Tony Blair demanded that phone records for everyone be kept for 2 years and available on demand, he pushed it through the EU when the UK had the chair. His argument was that 'this data is already kept for billing purposes so it changes nothing'. So he opened the basis for spying on everyone, just in case sometime in future they commit a crime. And his lawyer game was, "well it's recorded for billing" so it's only a minor change. The minor change being to keep it for 2 years and replace the warrant with a RIPA letter from one of Murdochs employees in the police.
Your surfing is already monitored, so it makes no difference if we also monitor it on behalf of Govt/RIAA/Voting Corp/Marketing Corp/Fox News/News International...