Slashdot Mirror

← Back to Stories (view on slashdot.org)

Comcast Using JavaScript Injection To Serve Ads On Public Wi-Fi Hotspots

Posted by Soulskill on from the perfectly-in-character dept.

An anonymous reader writes: For some time now, Comcast has setting up public Wi-Fi hotspots, some of which are run on the routers of paying subscribers. The public hotspots are free, but not without cost: Comcast uses JavaScript to inject self-promotional ads into the pages served to users. "Security implications of the use of JavaScript can be debated endlessly, but it is capable of performing all manner of malicious actions, including controlling authentication cookies and redirecting where user data is submitted. ... Even if Comcast doesn't have any malicious intent, and even if hackers don't access the JavaScript, the interaction of the JavaScript with websites could "create" security vulnerabilities in websites, [EFF technologist Seth Schoen] said. "Their code, or the interaction of code with other things, could potentially create new security vulnerabilities in sites that didn't have them," Schoen said."

16 of 230 comments (clear)

  1. JavaScript by Anonymous Coward · · Score: 4, Insightful

    Yet another reason to disable JavaScript from your computing devices.

    1. Re:JavaScript by bondsbw · · Score: 5, Insightful

      Better yet, disable HTTP. This is a MITM injection attack and SSL was invented to help prevent this.

      --
      All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
    2. Re:JavaScript by Anonymous Coward · · Score: 4, Informative

      A lot of browser addons like NotScript and NoScript even allow you to easily whitelist javascript permissions by domain trying to do so on a page, so if things are not happy you just click the icon, and click allow for the domains that are pertinent to the site and not the ad networks et al.

  2. Copyright violation? by crow · · Score: 5, Interesting

    Does this violate the copyright of the sites the user is visiting? By modifying the content stream, they're creating a derivative work without authorization.

    On the other hand, user-controlled plugins and ad blockers do that all the time, so I wouldn't be too quick to make that argument in court.

    1. Re:Copyright violation? by thieh · · Score: 4, Insightful

      There is a subtle difference: user modification on visit is personal use and mostly not shared, what Comcast is doing is broadcasting modified content.

    2. Re:Copyright violation? by taustin · · Score: 4, Informative

      And doing so for a commercial purpose. Which, in theory, could make it criminal.

    3. Re:Copyright violation? by Em+Adespoton · · Score: 5, Interesting

      And doing so for a commercial purpose. Which, in theory, could make it criminal.

      If I recall correctly, Comcast is currently arguing just this in court -- but for third parties stripping ads from their cable streams.

      I think they're going to try really hard to differentiate between the goose and the gander here.

    4. Re:Copyright violation? by Charliemopps · · Score: 4, Interesting

      Does this violate the copyright of the sites the user is visiting? By modifying the content stream, they're creating a derivative work without authorization.

      On the other hand, user-controlled plugins and ad blockers do that all the time, so I wouldn't be too quick to make that argument in court.

      I'd argue against that... except... by modifying the content en-route, they are likely pushing legitimate ad-content out of the users view. i.e. If I ran a search engine, and paid for that service by placing a banner add at the bottom advertising chicken wings... and then Comcast did their injection attack and pushed that add further down, they would most certainly be affecting my commercial revenue.

      If the user chose to block that add themselves, that would be entirely different. They made a choice to do so, or to scroll their screen. But this is an intermediary company forcing that content out of the users view for a profit. I'd say the EFF should throw up a page, visit it on one of these networks and then sue the living crap out of Comcast.

    5. Re:Copyright violation? by jamesjw · · Score: 4, Funny

      STFU

      Why is ComCast's marketing dept posting as 'AC'? :)

      --
      -- If at first you don't succeed, lie!
    6. Re:Copyright violation? by Jason+Levine · · Score: 4, Funny

      Well, then obviously, you charge those ad distributors for a silver ad plan that gets by the filters.

      Then charge customers for a silver ad blocking plan that blocks them.

      But a gold ad plan will get by that.

      But a gold ad blocking plan will block that.

      But a platinum ad plan will get by even that....

      Queue Comcast's CEO singing "We're In The Money!"

      --
      My sci-fi novel, Ghost Thief, is now available from Amazon.com.
  3. so don't use them! by lophophore · · Score: 5, Funny

    Don't use random hot spots. It's like safe sex, only for your computer. Stay away from sketchy connections.

    --
    there are 3 kinds of people:
    * those who can count
    * those who can't
    1. Re:so don't use them! by dissy · · Score: 4, Funny

      Don't use random hot spots. It's like safe sex, only for your computer.

      [me] Aight baby, play with that packet. You know how I like it
      [ap] tee hee *beep*
      [me] oh yea, deeper inspection, deeper inspection! oh yea!
      [ap] *56k carrier sound*
      [me] That's what I like to hear! Now, I put on my robe and wizards hat
      [ap] ... *stp-broadcast* ...
      [me] baby-aye-pee you still there? Where'd ya go??

  4. Content Security Policy by Lightn · · Score: 4, Interesting

    It would be interesting to see what would happen if you browsed a website with Content Security Policy headers on a Comcast public Wi-Fi hotspot.

    The technology is new enough that the injection technology might not handle it and thus the browser would block the ad. But if they did, by changing the CSP headers, the website might have a stronger case for suing Comcast since they would be explicitly bypassing a security technology.

  5. Copyright violation? by j127 · · Score: 5, Insightful

    Yes, definitely. Also, it violates the policies of ad-free sites to not subject their visitors to ads. Websites will not be able to maintain their terms of service. For example: if you pay the website for an ad-free subscription, and Comcast then injects ads, your customers are screwed.

    An ad-blocker is for personal use -- kind of like marking a page in a book that you're reading or removing a picture because you don't want to see it. Systematic modification of copyrighted content before delivery to customers is definitely criminal.

  6. JavaScript by j127 · · Score: 4, Insightful

    That would be nice, but it's impossible to use the modern web and HTML5 without JavaScript. Maybe Privacy Badger or Ghostery can block it.

  7. Until today, I didn't see the point... by kylemonger · · Score: 5, Insightful

    ... of using https for everything. I do now.