Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

231–240 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#231

Post by Brybry »

Comcast is not alone in this. Cox Communications has been injecting code into HTTP traffic for years.

I think sometime around 2008 I first saw them do it (I noticed NoScript blocking a script on a page that it wouldn't normally). If I remember correctly, following it to its source hinted that it was a test for some alert system.

In 2012 I saw them injecting a script to notify people that their email servers were down ( https://www.dslreports.com/forum/remark,27826161 ) though the paranoid in me thinks that was an innocuous way to test how acceptable altering traffic would be.

The escalation I've seen in the last couple of years is the ability being used for Cox customer surveys.

As far as I know they haven't injected anything into my SSL/TLS traffic... yet.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#232

Post by pbhjpbhj »

tzs wrote: post #214
sumeno wrote: post #123

Earlier quoted context omitted.

If only there were some way to notify your users that wasn't so scummy... like via email or regular mail

Regular mail, yes. Email, though, is largely just a waste of time. Way too much non-spam disappears down overeager spam filters, which most people only check if they are specifically expecting some particular mail and it does not show up as expected--and even then many won't check their filters. An ISP could white list their own mail in their spam filters but that would only help with the customers who use their ISP…

They could sign their messages? Also needs users to have easy to use mua that handles signing and shows "this is genuinely from your ISP unless they/you've been hacked".

For critical service info I'd want SMS personally, from a verified number with a link on the company main domain to verify the info.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#233

Post by sova »

tootie wrote: post #210
jlivingood wrote: post #112

Earlier quoted context omitted.

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

As a web developer this feels like an absolutely terrible practice. I have to support contracts for website performance, quality and behavior with clients and you could be putting us in breach. If I got a bug report of unexpected ads popping up, we'd probably waste thousands trying to figure this out.

So many tickets with status "unable to reproduce" ugh

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#234

Post by octalmage »

tootie wrote: post #210
jlivingood wrote: post #112

Earlier quoted context omitted.

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

As a web developer this feels like an absolutely terrible practice. I have to support contracts for website performance, quality and behavior with clients and you could be putting us in breach. If I got a bug report of unexpected ads popping up, we'd probably waste thousands trying to figure this out.

Exactly. The first thing I thought about when I saw this was the implications of having JavaScript that has not been tested in the context of a website running. You have no clue how it will conflict.

As a website owner you should have the right to verify all code that will run on your website to be sure that it won’t cause issues since only you have the context needed to make that call. What if there’s a global DIV selector that hides the close button, the website visitor is screwed! And they’ll just think it’s a problem with your website.

One more note, there are way better ways to do what they’re trying to do. Even with how terrible IFrames are, they prevent CSS and JavaScript conflicts. A simple position fixed div at the bottom of the screen containing an iframe seems more appropriate. If you are going to run code on my site, make sure it’s as small as possible. This could have been accomplished in 2 lines of code (excluding iframe host).

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#235

Post by userbinator »

thaumaturgy wrote: post #61
glenstein wrote: post #31

Earlier quoted context omitted.

>As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.

This is just about the worst possible way to notify a customer of any issue anyway, because it legitimizes those stupid ad-based malware popups that have become so prevalent. As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a…

As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a whole bunch of unsuspecting Comcast customers.

To be a devil's advocate, Comcast customers have been phished before via email too:

http://technology.pitt.edu/news-and-alerts/phishing-alert-em...

...and then there's the various phone and even door-to-door scams, but I'd consider the latter to be much harder to do.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#236

Post by pbhjpbhj »

NelsonMinar wrote: post #204
metaphor wrote: post #25

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only…

I think it's amazing Comcast documented their MITM attack as an RFC. Are those still literally Requests for Comments? Are the comments collected anywhere?

You're wildly OT, I suggest Wikipedia.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#237

Post by zwily »

_jal wrote: post #195
jlivingood wrote: post #112

Earlier quoted context omitted.

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

First, thanks for participating. Second, I am a Comcast customer who will never see these messages precisely because you do things like MITM unprotected traffic. Because I can't trust you to leave my traffic alone, all my traffic is tunneled. So at the very least, if you feel this is a critical service you are offering (as implied by the RFC), you need an alternative communications channel for people like me who don'…

They do say they try to email you a bunch of times first... Email seems like a decent enough alternate channel.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#240

Post by jsmthrowaway »

_jal wrote: post #195
jlivingood wrote: post #112

Earlier quoted context omitted.

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

First, thanks for participating. Second, I am a Comcast customer who will never see these messages precisely because you do things like MITM unprotected traffic. Because I can't trust you to leave my traffic alone, all my traffic is tunneled. So at the very least, if you feel this is a critical service you are offering (as implied by the RFC), you need an alternative communications channel for people like me who don'…

> Snailmail is fine; you try to upsell me constantly through that channel already.

Implying you’d probably miss it and, if not you, the customers they’re trying to reach.

Post reply on HN