How One Man Fought His ISP's Bad Behavior and Won

An anonymous reader writes "Eric Helgeson documents his experience with an unscrupulous ISP that was injecting affiliate IDs into the URLs for online retailers. 'It appears that the method they were using was to poison the A record of retailers and do a 301 redirect back to the www cname. This is due to the way apex, or 'naked' domain names work.' Upon contacting the ISP, they offered him access to two DNS servers that don't perform the injection, but they showed no indication that they would stop, or opt-out any other subscribers. (It was also the only wireless provider in his area, so he couldn't just switch to a competitor.) Helgeson then sent the data he gathered to the affiliate programs of major retailers on the assumption that they'd be upset by this as well. He was right, and they put a stop to it. He says, 'ISP's ask you to not do crummy things on their networks, so how about they don't do the same to their customers?'"

Comments

Use public DNS

[DigiShaman]

Google DNS is 8.8.8.8. and 8.8.4.4
Open DNS is 208.67.222.222 and 208.67.220.220

Norton Safe Connect (personal use, not for business) is 199.85.126.10 and 199.85.127.10. Supposed to protect against malware, phishing sites, and scams.
https://dns.norton.com/dnsweb/homePage.do

Re:Use public DNS

[Nerdfest]

You can try this tool to check your existing DNS for performance and behaviour. Google's is very well behaved by the way, so please don't spread FUD.

Re:Use public DNS

[Nerdfest]

I should add that both Google DNS and OpenDNS support DNS-SEC which is nice as well. OpenDNS also supports a form of DNS request encryption which hides even the sites you go to.

Re:Use public DNS

[adolf]

A good suggestion, though I wouldn't trust Google not to do the same or worse with their DNS.

Trust? Why is trust necessary? Because it's hard to look at the address bar and see that you haven't wound up at an affiliate link?

Re:Use public DNS

[arth1]

You can try this [google.com] tool to check your existing DNS for performance and behaviour. Google's is very well behaved by the way, so please don't spread FUD.

I think his point was that Google's DNS is very well behaved now, but that there is no guarantee that any DNS run by a major advertisement funded business won't, in the future, be tempted to put profit over principles.
Blind trust is seldom a recipe for long term success. Uncertainty and doubt might be in order.

Re:Use public DNS

[Anonymous Coward]

I think the point is that Google pwns every bit of information about you.

It's not good enough that they track you at every site that uses Analytics, every site that uses AdWords, every site you go to from their search engine, every site you visit with their Toolbar in play. (I'm forgetting a hundred other ways they suck your data.)

Nah, not good enough. Why not tell google every single DNS lookup you ever make??

Why do people mistrust the NSA so much and yet think Google is some kind of sparkly-super-shiny white hat? They work very hard to provide you with tons of free services that give them this wealth of information about you. WHY do they give you these????

Re:Use public DNS

[number17]

The privacy policy for Google Public DNS is different than that for the rest of Google. It's also public. You can, you know, read it, then you can stop spreading FUD. https://developers.google.com/speed/public-dns/privacy

That's like saying the NSA won't spy on you because the Constitution is public and you can read it.

Not wireless

[Anonymous Coward]

(It was also the only wireless provider in his area, so he couldn't just switch to a competitor.)

No, the blog says:

You may be asking why don’t I switch ISPs? Well they are the only one besides a wireless provider in my area.

Which means there are 2 ISPs. The one he's using is not wireless, and the other one is wireless.

Public DNS considered harmful

[kriston]

Saw this in Reddit this morning but thanks for reposting it.

Seriously, the drawback to using public DNS like OpenDNS and Google DNS is that they present a serious performance problem.

Even though the physical DNS servers are "anycast" and geographically diverse, the IP addresses are still the same. Threrefore, the large content delivery networks (CDNs) like Akamai and LimeLight still use the IP address of the DNS server to judge your location.

Therefore, any service that uses a CDN (even Google's use them in spite of their own network) will really serve your content out of a data center that is not geographically or logically near your machine's location.

The article (if you read it) mentions that his ISP, like most that have similar revenue-extracting services, really does offer alternative DNS servers that do not pack affiliate cookies. You should use those if you want to enjoy high-performance, edge-serve content via Akamai (AKAM) and LimeLight (LLNW).

Otherwise, you'll all get your edge content served from some random data center in the central USA.

Re:Public DNS considered harmful

[drmofe]

I commented on the reddit thread in the same vein as you and got downvoted. So I did some research. Several contributors to that thread suggest that Google DNS has solved the CDN problem by adding and original IP field that the CDN can use to geolocate the subscriber. This is due to Google implementing edns-client-subnet EDNS0 extensions as of late-2011.

Illegal behavior

[WaffleMonster]

It would have been better to contact FBI and report this fraud. Whoever the hell runs fwdsnp.com needs to spend some time in jail.

Re:Illegal behavior

[Anonymous Coward]

I think you are confused.

It was a CORPORATION that was scamming money out of affiliate links, so everything is A-OK!

Of course, we punish the little people for exactly the same thing:

http://www.justice.gov/usao/can/news/2012/2012_06_19_kennedy.sentenced.press.html

Re:Repost!

[228e2]

I think I read 75% of the things here elsewhere around a day in advance.
Slashdot isn't (well, in its prime) where you come for breaking news, it's where you go (again, back in its prime) for great intellectual technological discussions.

Re:DNSSEC

[SuricouRaven]

It's scheduled for widespread deployment some time between the domestic service rollout of IPv6 and the year of linux on the desktop.

Both Amazon and other affiliates

[dutchwhizzman]

First of all, Amazon doesn't get a very high percentage of affiliate tagged traffic/purchases. If every ISP would do this, it would get 100% and the whole business model wouldn't work any more. Amazon would have to pay out way too many affiliate bonuses. Second, any affiliate that the user might choose, would lose out because their tag would get replaced by that of the ISP.

Fraud

[MrL0G1C]

To be clear, the ISP has committed a criminal act (fraud), it is obtaining financial gain by deception - the concealment of the fact that no person willingly used an affiliate link.

I think that if they weren't prosecuted then they committed a crime and got away with it. The victims being the retailers and any legitimate affiliates who lost out (if that is the case).

Re:Repost!

[rroman]

How is it possible, that this post was modded Funny? Slashdot is exactly what this post describes. Slashdot is mainly great because of great comments and well done comment rating system.

Re:What exactly happened?

[hey!]

Short, simplistic answer: the ISP found a way to fraudulently skim a percentage from online retailers for every purchase made by the ISP customers.

Slightly more detailed answer: the ISP directed users looking for online merchants like "amazon.com" to it's own bogus server. That bogus server then re-directs the user's browser to the merchant's server in such a way the consumer doesn't notice and the merchant thinks the customer is following a product referral from an advertising partner. Thus the ISP collects a kickback intended for people who make product recommendations and referrals, without actually having made any recommendation or referral.