Slashdot Mirror
AT&T Hotspots Now Injecting Ads
An anonymous reader writes: Computer scientist Jonathan Mayer did some investigating after seeing some unexpected ads while he browsed the web at an airport (Stanford hawking jewelry? The FCC selling shoes?). He found that AT&T's public Wi-Fi hotspot was messing with HTTP traffic, injecting advertisements using a service called RaGaPa. As an HTML pages loads over HTTP, the hotspot adds an advertising stylesheet, injects a simple advertisement image (as a backup), and then injects two scripts that control the loading and display of advertising content. Mayer writes, "AT&T has an (understandable) incentive to seek consumer-side income from its free Wi-Fi service, but this model of advertising injection is particularly unsavory. Among other drawbacks: It exposes much of the user's browsing activity to an undisclosed and untrusted business. It clutters the user's web browsing experience. It tarnishes carefully crafted online brands and content, especially because the ads are not clearly marked as part of the hotspot service.3 And it introduces security and breakage risks, since website developers generally don't plan for extra scripts and layout elements."
Soon someone will have a script or browser extension for this.
Mod me down, my New Earth Global Warmingist friends!
Free WiFi is a trap, news at 11!
Why is modifying a web site in this way not copyright infringement? Is not AT&T creating an unauthorized derivative work?
"National Security is the chief cause of national insecurity." - Celine's First Law
AT&T is initiating a man-in-the-middle attack. Can you really trust those ads? I mean they're injecting scripts. Who knows what those do, right?
This behavior should be prosecuted by the FCC as interfering with a communication. Anyone who is not an endpoint to a connection, either virtual or physical, has no business adding or deleting (or even monitoring) that connection.
So, basically AT&T is placing their advertising on someone's web site without paying for the privilege? Were I the content owner, I'd be speaking to my lawyers first thing. The sad thing is that major companies don't even seem to worry breaching the public's trus or their reputations anymore. How long until Comcast decides to force extra advertising into my cable internet browsing. Oh! That's right, I cancelled them after the NetFlix throttling episode. So now, I guess I have to cancel DirecTV (AT&T) too.
I am shocked, SHOCKED I say, by this news, which I never, NEVER in ONE MILLION YEARS expected to happen.
ZZZzzzzZZZzz
...needs to wonder no more.
Time for https on all websites.
...oh wait...
Somebody else tried this a while back too. Verizon? Uproar. I guess AT&T didn't learn from that.
https://www.eff.org/Https-everywhere
So when I browse Pirate Torrent sites at an AT&T hotspot, then AT&T can get sued for profiting from piracy?
and you wonder that they push ads ? Provide your own connection and stop using free ones. While I think it is low class, what do you expect for FREE ?
errr....umm...*whooosh* *whoosh* Is this thing on ?
Didn't they claim to just be a carrier in order to not being held liable for what the users do with that connection? By delivering content they've created aren't they having their cake and eating it, too?
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
We need google wifi hotspots now. Everywhere. I know, I know, they study everything I do and supply me ads that are more and more disturbingly relevant. But I still trust them more than all the others companies. Actually, I don't use an ad blocker cuz I get a kick out of seeing what their new Skynet initiative is cooking up for me ...
Simply put, Noscript blocks the scripts, thus preventing the ads from loading. I don't care if the damn thing is pushing a custom CSS page, if it's not from the site I'm visiting, then it's not going to be loaded.
Zero dollars go to that company from me. I own zero AT&T branded devices.
A more interesting story than WiFi spam is AT&T radio towers beaming waves directly through residences and inhabited buildings. A friend of mine was an engineer for AT&T for many years. He explained to me how when AT&T thinks they need a tower in a location they pay whoever is necessary to get it there. I have never confirmed if he was joking or not... but he did tell me they put a tower up in one location... beaming straight through a high-rise in very close proximity... and all the kids in the building were being born girls.
The free ATT hotspots I've found to be basically unusable tarpits of service that would make me grateful for the whine and hiss of a 9600 baud modem.
I've mostly encountered them at McDonalds where they were almost always unusable. I kind of wonder how they get their Internet service for these, whether they just steal from whatever the specific franchise might have or whether it's something more retarded, like an ancient 3G hotspot above the ceiling.
Anybody who is surprised by shit like this is an idiot.
Everybody setting up "free" hotspots wants to monetize with anayltics and ads.
Google wanting to sell you a router they can control is also going to lead to monetizing and ads.
The problem is unless we have really good quality tools to block this shit, we're never going to stop it. And this is why we can't trust ad infrastructure at all and need to block it .. because it's being done by people who want money, and don't give a crap about your security of your privacy.
Until this shit is deemed illegal (ie the computer fraud and abuse act), it will continue. Because the assholes at AT&T feel it is their right to do anything they want with your internet traffic.
Never trust that "free" doesn't come with strings like this. And never trust than any corporation won't revert to being sociopaths and decide they can do anything they want to.
Lost at C:>. Found at C.
mint update manager seems to query for descriptions of package updates via http. So wifi that interferes with http somtimes causes mint to give nonsonse descriptions for updates.
breaking end-to-end connections is really really really bad.
SURELY NOT!!!!!
Time Warner Cable has been doing this for over a year on their public networks in California.
Vonal Declosion
Always assume that the network is hostile, even when you're pretty sure that it's not. There are countermeasures available. VPN, Tor Browser, etc. Be smart out there.
So, basically AT&T is placing their advertising on someone's web site without paying for the privilege? Were I the content owner, I'd be speaking to my lawyers first thing.
Comcast has been getting away with this for a year now, where are those lawsuits? Comcast Using JavaScript Injection To Serve Ads On Public Wi-Fi Hotspots
Web site owners could potentially sue AT&T for copyright infringement, essentially creating a "derivative work" of original copyrighted material dynamically by injecting ads/scripts/content. SUE THEM! SUE THEM!
We might wonder if AT&T is injecting ads in the user data they are belching forth to the government sons of Satan. After all, snoops shop too. Advertisers will pay for anything, anything at all.
https://www.youtube.com/watch?...
(Yeah, it's not 9600, sorry.)
Of the several wifi hotspots I've used, you have to browse through a webpage, which includes 'terms and conditions', which tend to include a prohibition on using the free wifi for piracy.
Except that it's not free. This service is for paying customers. Which makes this behavior even worse, actually.
> what do you expect for FREE ?
The Internet, like the Interstate Highways.
Both were designed to carry military traffic when an attack is impending or underway.
Both have ample capacity to handle anything a citizen could possibly want to carry on them in peacetime.
Both are clogged up by far too many far too large corporate shipments, by this point in time. Put your little bitty car in among those double-length trucks and pray a lot. Put your data and web page out among Comcast's traffic and do the same.
Those curve and bridge clearances on the Interstates?
"... In developing minimum design standards for the Interstate System, the State highway agencies and the Bureau of Public Roads (BPR) agreed in July 1956 to include a minimum vertical clearance of 14 feet in Policy on Design Standards - Interstate System prepared by the American Association of State Highway Officials (AASHO) and adopted by the BPR for use on Interstate projects. This figure wasn't pulled out of thin air. The DOD had previously indicated, in 1949 and 1955, that a 14-foot vertical clearance was adequate for most military vehicles. However, after the Soviet Union launched its Sputnik satellite in October 1957, the DOD determined that a 17-foot vertical clearance was needed for some larger equipment, such as the Atlas intercontinental ballistic missile, that could not be transported by rail."
AT&T's hotspots used to be faster back when they were non-free.
I used them a few times back then, generally at McDonald's, as an AT&T customer ("free" for me).
They seemed backed by a T1, based on speeds and traceroute guessery in an empty store. And that was generally better than the alternatives at that time (3G or nothing), so was certainly welcome. But that was a different time...
These days a T1 with multiple freeloading users is painfully slow. Overall experience can be helped considerably with some very careful QoS at the endpoint to prioritize small data streams over more lengthy streams but this is something they apparently aren't doing.
The last time I was at a McDonald's and wanted a cup of free WiFi I had far better results turning my cell phone into a 4G hotspot and paying by the gigabyte.
Same with the local public library: They have free Wifi, and welcome you to use it, but it's so slow that it's useless.
Kid-proof tablet..
My home ISP -- China Telecom -- does this to me, for the service that I pay for. And no, I can't use a VPN 100% of the time because China is getting pretty good at killing VPN connections. It doesn't even matter if I use a non-ISP DNS server, because it's standard in China to poison DNS results (I've not tried experimenting with DNSSEC yet).
In my case I'll try to load Bing (which isn't blocked by Golden Shield), and the only content will be a meta reload instruction. The rest of the "real" page will have been served via an injected javascript with a shitty Chinese ad at the bottom. Reloading will fetch the real page, as the ads aren't injected 100% of the time, but only seemingly randomly.
--Jim (me)
Once again, I'm shocked, SHOCKED I tell you!!
Just cruising through this digital world at 33 1/3 rpm...
I once got a 300 baud modem to handshake with me by whistling the carrier tone.
Seven puppies were harmed during the making of this post.
There *IS* a reason I spend $200/mo for LTE Internet access for my devices.
No it is free. They are talking about the free AT&T wifi at places like McDonalds. You don't need to be a paying customer of AT&T or McDonalds to use it.
I once got a 300 baud modem to handshake with me by whistling the carrier tone.
I was going to say something snarky like "women must have been fighting over each other for you", but you know what ? That's actually damn cool!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Why did people mod you funny? Do they all know something about you that I don't? I could have written that myself, and I would've been sociopathically dead serious. All human social hierarchies suck, and the reason they suck, the sole reason, is because sociopaths always wind up in charge of them. If we had a prenatal test for sociopathy or a gene therapy cure, I'd be advocating eugenics like there was no tomorrow!
There *IS* a reason I spend $200/mo for LTE Internet access for my devices.
Your work pays for it?
Oh you little crybaby geeks. Shut up. We're AT&T, we can do whatever we want.
https://www.eff.org/Https-ever...
Website Just Down For Me? Find out
redirect users to a page that says:
*** BROWSER SESSION HIJACKED **
Your browser session has been hijacked and web page contents has been edited and/or amended to include additional code belonging to the hijacker.
To protect you, your privacy, and the integrity of our webiste, we have directed you to this page.
The company hijacking your browser session has been identified as:
AB&C
We have identified the companies telephone number as 1-800-XXX-YYYY.
If you have any concerns, you can call them to confirm if they are intercepting and editing the web pages served to you.
They may inject their referral code to other people's/companies legimate ads soon, that is what spyware developers did back in the day. That (topmoxie) was the lowest level spyware could get.
Let's hope a clever law company sue them on behalf of effected parties and make billions.
People who took this decision surely knows about extensions, VPN and even Tor. They know only 0.001% may care too. This is the magic formula which runs spam&spyware industry.
Remember Sony rootkit, nobody were aware of anything until they were absurdly unlucky to hit World's most advanced Windows kernel hacker Mark Russinovich. https://en.m.wikipedia.org/wik... .I remember reading that story on /. That was the last drop for Sony shareholders. I hope the same for AT&T too.
Down around where the actual channel normally puts it's text ads (Watch New Show X!!! It's Exciting!!!)
And now a word from our NSA loving ISP friends who help the NSA break the law even more than those friends are required to.
Soon as my UVerse contract is up I am going elsewhere.
Let's face it, this story would still exist in the same tone if the ads were clearly made out as ATTs ads for supporting the wi-fi spot, and it was all transparent to the end user.
Even if it was only ATT servers. Even if they were merely text ads on a little strip at the top of the webpage that was completely sandboxed from the rest of the webpage and doesn't interfere with any of it.
Even if those ads were related to the webpage in some way.
People like bitching because they get free stuff, regardless of how nicely it is presented to them.
More at 11.
Sheesh.... Just install Pale Moon, AdBlock edge and NoScript already.
I haven;t seen an ad for ages. Not interested in them, they're not using my bandwidth and CPU to display all that crap.
Website owners generally claim copyright over their content. AT&T is in violation of those rights by modifying that content without obtaining written permission of the copyright holder.
I only tried using them when I first got my cellular-enabled iPad. Because it was an ATT cellular model, they would automatically associate with ATT hotspots and I figured that was better than the buy-as-you-go data I used at the time.
I gave up when I realized how unusable they were and just disabled the ATT hotspot association and used LTE, which was much faster.
There's also a trademark issue. Suppose I load Bruce Schneier's web site and his site has an ad for some bogus "security" software. That reflects poorly on Bruce because it appears that Bruce is endorsing, or at least tolerant of, the scam software. Similarly, suppose I load DaveRamsey.com and his page contains ads questionable financial products. Dave's brand is damaged by falsely associating those products with his trademarked brand.
Anybody who is surprised by shit like this is an idiot.
Um, no. Naive, maybe, but not necessarily an idiot.
You, however, appear to be an arrogant prick, purely based on empirical observation.
The reality may be different, with you being a very nice guy.
I hope it's the latter. Your response, if any, will show.
These days a T1 is painfully slow, even without multiple or even a single other user. I can't think of any reason to still use a dedicated circuit like that unless you absolutely positively need the guaranteed bandwidth and SLA service...or there was absolutely no other option.
Can websites be copyrighted? Can they sue for having their copyrighted work altered and redistributed for profit?
I get access to AT&T hotspots because I am an AT&T customer, So I am wondering about this use of the term "free". Access to these access points was a selling point when I signed up. In what world is something I am paying for called free?
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
http://www.ribbonfarm.com/2009...
I assume the irony in your enthusiasm for eugenics as an antidote to sociopathology was intentional.
The whole idea that you can be secure on the internet if you only visited "trusted sites" is wrong. The NYT, Yahoo!, Google and others have let in malicious advertisers before. Security comes by way of bug fixes and users applying updates. It's just that simple.
Now if you don't like AT&T injecting advertisements don't use there service. That's obviously part of the agreement.
Essentially this is like complaining that some websites have advertisements. That's just part of the deal.
You can thwart this via SSH tunnel, VPN, and other mechanisms. Or just use your phone as an access point. You'll pay for it, but there won't be (presumably) advertisements injected.
Now I do have to say I don't like my paid for ISP's interfering with traffic. Including non-compliance with DNS, etc (ie returning an IP of an ISP controlled ad-server when no domain exists). However this practice with access points injecting advertisements is less concerning. AT&T owes me nothing and it's part of the price if I want to use there service.
Free at McDonalds? You're telling me that I can register copyright on web pages, walk a few blocks away, and immediately get solid evidence of criminal copyright infringement that I can sue for hundreds of thousands of dollars minimum? This is sounding better all the time!
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
What the hell. Don't use it if you don't want to. When will these folks pull their heads and realize that nothing at all is entirely free.
How is this significantly different from the old NetZero free dial-up business model? If you don't want to use "free" internet access paid through ad revenue, then don't join the network.
“Common sense is not so common.” — Voltaire
browser extension by EFF to automatically switch to HTTPs.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Wouldn't adding ad source adapi.ragapa.com to a hosts file 0.0.0.0 blocked work to stop this?
Note: You can take 10% off all slashdot deals with coupon code "slashdot10off." X
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT
Painfully slow for what?
For /.? For email? Gaming? Streaming audio? Facebook? Youtube? Netflix? Downloading Linux ISOs from TPB?
1.544Mbps is plenty for lots of things and insufficient for some other things.
Kid-proof tablet..
Which doesn't mean I don't find this digusting.
There's no time like the present. Well, the past used to be.
But is it copyright infringement, or just annoying enough that we're all sure that there must be something illegal about it?
Kid-proof tablet..
Painfully slow by today's broadband standards.
Yeah. I think you mentioned that.
Thanks for the clarity!
Kid-proof tablet..
Or you want lower latency. My U-Verse service using FTTN has 3 to 4 times the latency to the gateway than my old SDSL had and the SDSL upload speed was half of the current U-Verse speed so it was not that much slower. Upload bandwidth has doubled but latency has increased 4 times.
Add ad source used to hosts, as blocked, via 0.0.0.0 adapi.ragapa.com
* :)
APK
P.S.=> For the BEST hosts file possible vs. threats online & for more speed using hardcoded favorites @ the TOP of your custom hosts file it creates (which cache into LOCAL ram for best possible resolution speed):
APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
FREE & adds speed, security, + reliability, doing more with less, more efficiently vs. browser addons & locally installed DNS servers @ home + fixes DNS' redirect security issues - obtaining its data vs. online threats & adbanner blocking from 10 reputable sites in the security community - using something you already have vs. "bolting on browser addons 'MOAR' that's usermode slower & increases messagepassing, cpu + ram overuse overheads!
* :)
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
... apk
McDonalds does not care about latency, and that is the context of this thread.
And yes, AT&T U-Verse's VDSL seems to be more latent than AT&T's own ADSL and SDSL. It's still fast (non-latent) enough, at least according to the girls I go out with.
Kid-proof tablet..
These days it is not even that. For more than a year now my U-Verse FTTN service has suffered from congestion during peak times with peak times being more than 1/3rd of the day and congestion yielding download speeds (upload not affected) below 1 Mb with attendant packet loss. I responded by downgrading my service to the slowest service they provide since anything faster is not usable.
The latency (and various mysterious failures like suddenly being unable to pass HTTP but not other protocols) still make me long for the days of SDSL.
Have noted zero congestion issues, at 4 different locations. Did have one location which had ancient (lead-jacketed, even) copper and took forever (easily 100 man hours) for them to get it to work properly, but they did.
Ever have a look at your stats at http://192.168.1.254/xslt?PAGE=C_1_0?
The bitloading graph at the bottom of http://192.168.1.254/xslt?PAGE=C_5_3 is instructive, too: It's a representation of the spectrum currently being used on your circuit.
Kid-proof tablet..
The congestion is further into AT&T's network. My local FTTN connection is perfect other than having a power backup time of seconds or less in the event of loss of power. My side is backed up but the DSLAM or something further into the network is not.