Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

251–260 of 288 posts

Re: Comcast injecting JS

#251

Post by testtata »

jakub_g wrote: post #211

I live in France and I'm a customer of Orange. I was really surprised to see on my mobile, on Facebook (m.facebook.com - I've noticed it only there, but perhaps there are more pages like that) they're injecting a HTML with "Return to Orange World" link in the footer directing to orange.fr. Not sure if anything more though - I have a plain old mobile with Opera Mini. I'm curious if they have some deal with FB to do it…

It could be the fact that you have a strange combination of both an old phone and (what could be a customized) Opera Mini.

I have an iPhone at Orange and never saw this.

Re: Comcast injecting JS

#252

Post by danyork »

cookiecaper wrote: post #215
augustl wrote: post #205

Earlier quoted context omitted.

They would either need the private key of the certificate holder (which they don't have), or a certificate signed by one of the roots installed on the system, which they also won't have. I suppose the logical next step is that Comcast requires you to install a "Comcast Internet Helper" program that also installs a Comcast root certificate into the system so they can mitm anything.. But Firefox and Chrome would probab…

Most people are going to click through any security warning because they just want to get to the site they wanted to go to. If Comcast does this, it would make EVERY SSL site display the warning, making it utterly meaningless. Alternatively, it's not that outrageous to think that Comcast et al could get certs into the major browsers if they wanted to do so. It's not even implausible to think that at some point, brows…

As I noted in a comment elsewhere in this thread, Comcast (or any other vendor) doesn't need to go through the work of getting certs into major browser. They just need to purchase and use a root signing certificate that works under the existing root CAs that are already in all the browsers.

This is part of why the trust model of the current CA system is fundamentally broken. We need to add a layer that can ensure that we are in fact using the SSL certificate that the site owner wants us to use.

There are multiple solutions being proposed out there to add this trust layer. I am a strong advocate of DANE ( http://www.internetsociety.org/deploy360/resources/dane/ ) but there are others out there, too.

There was a good talk about this at Black Hat USA 2011 on "SSL and the Future Of Authenticity" at: http://www.youtube.com/watch?v=Z7Wl2FW2TcA

Re: Comcast injecting JS

#253

Post by tokenadult »

Ladies and gentlemen, this is why if you are hiring a programmer, you always ask for a work-sample test before making the hiring decision final.

https://news.ycombinator.com/item?id=5227923

Yes, the code sample suggests someone clueless about programming in general, even more than being clueless about the particular language of this program. So on what basis was the coder hired?

Re: Comcast injecting JS

#254

Post by api »

Major web sites should sue for theft of service. They are modifying someone else's copyrighted content to steal their advertising revenue.

Also: https everywhere, now.

Re: Comcast injecting JS

#255

Post by tonyb »

STRML wrote: post #66
tonyb wrote: post #57

This is probably part of their "Web Notifcation System". They have a published RFC talking about how it works (RFC6108). Using that system they can selectively notify customers. Like if they detect your system is infected with a virus. Or warn you your service will be discontinued if you don't pay your bill. http://tools.ietf.org/html/rfc6108

Look at all the work that went into that RFC. Unbelievable that they couldn't get a half-decent developer to verify that the notification is coded well enough to even show properly .

I agree. The entire concept is about trying to be less invasive in the web browsing experience (by adding a popup instead of redirect the entire web session) but that all falls apart because of crappy JavaScript.

Re: Comcast injecting JS

#256

Post by RKearney »

mbreese wrote: post #176
yellowbkpk wrote: post #145

Has anyone other than OP actually seen this in the wild? None of the systems I know about on Comcast here in Chicago have had HTTP manipulated at all today. Maybe they're not doing it here because the 250GB bandwidth cap is "temporarily suspended"?

This is the real question. We can laugh all we want to a out their crappy code, but what I want to know is where this code is actually in the wild. If I see this coming down my Comcast connection, I'm likely to cancel my service that day.

If you search for the GIUD that's part of one of the URL's in the code, you can find other places online including someones "Top 404 pages" log. While not widespread (yet), it is indeed happening. This post was from last year, but this month Comcast bumped me up to 100Mbps so I will be purposefully reaching my 300GB limit to test if it's still in production.

Re: Comcast injecting JS

#257

Post by nobleach »

ancarda wrote: post #73
STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

Ethical stuff aside, I can't imagine hiring someone to actually produce code THIS bad. Where the hell did they find the coder to make this?

http://www.w3schools.com/

Re: Comcast injecting JS

#258

Post by Achshar »

lgp171188 wrote: post #227
Achshar wrote: post #167

Earlier quoted context omitted.

That's rediculous. Airtel in India also used to do this. Annoying as hell. Miss-type the domain and type all of it again.

Afaik, Airtel still does it and people still put up with it. I think they do the usage % notification hijacking as well without understanding even a bit that that internet is a pipe and people use applications other than web browsers and protocols other than http.

Yea I was not sure. I left them after their data cap for "high speed" "unlimited" internet cap was 3 gb per month. I can put up with js injection but ridiculous data caps are something I can't live with.

Re: Comcast injecting JS

#259

Post by Phlarp »

executive wrote: post #184
Phlarp wrote: post #98

Earlier quoted context omitted.

>They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. I'm an intern, just moving past S.O. copy-pasta jobs and generally get scared at what the hacker news crowd might s…

You should be scared... what's with the hardcoded login info exposed on github? https://github.com/Machtap/_ctv/blob/master/_www/model/commo...

The database doesn't accept external connections, out of curiosity, what is the proper way to pass connection credentials?

Re: Comcast injecting JS

#260

Post by cookiecaper »

mattmanser wrote: post #219
cookiecaper wrote: post #215

Earlier quoted context omitted.

Most people are going to click through any security warning because they just want to get to the site they wanted to go to. If Comcast does this, it would make EVERY SSL site display the warning, making it utterly meaningless. Alternatively, it's not that outrageous to think that Comcast et al could get certs into the major browsers if they wanted to do so. It's not even implausible to think that at some point, brows…

I think you're a bit out of touch as those browser warning pages have changed a lot the last few years. It's actually pretty hard to get through those warnings now in most of the browsers.

I watched someone do it in one click yesterday.
Post reply on HN