ISP Advertisement Injection - CMA Communications

Post by betterunix » Wed, Apr 03, 2013, 7:09 PM UTC

ChuckMcM wrote: post #22

This is an interesting problem. On a broadcast channel, when a local station attempts to replace the ads the network has put in their shows, with their own ads, the network has some leverage to shut down that process. But on the Internet there are a bunch of web sites and they don't have any leverage at all. They could do an IP filter, which is to say put up a page "This site unavailable on this ISP's network" when a…

Post by alepper » Wed, Apr 03, 2013, 7:15 PM UTC

jiggy2011 wrote: post #25

ConstantineXVI wrote: post #23

"knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period" Injecting or replacing ads in other people'…

Wouldn't this depend on the TOS of the ISP? Perhaps by signing the contract you "authorise" this. This sort of thing doesn't surprise me any more. AFAIK DNS on every major ISP in the UK is broken, there is no NXDOMAIN. Unresolvable domains are simply redirected to a specific IP address which happens to host a page of ads and a search bar on port 80. This might not matter to most people, but it's a huge PITA when I'm…

Post by brownbat » Wed, Apr 03, 2013, 7:43 PM UTC

jiggy2011 wrote: post #25

ConstantineXVI wrote: post #23

"knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period" Injecting or replacing ads in other people'…

Wouldn't this depend on the TOS of the ISP? Perhaps by signing the contract you "authorise" this. This sort of thing doesn't surprise me any more. AFAIK DNS on every major ISP in the UK is broken, there is no NXDOMAIN. Unresolvable domains are simply redirected to a specific IP address which happens to host a page of ads and a search bar on port 80. This might not matter to most people, but it's a huge PITA when I'm…

Post by rwg » Wed, Apr 03, 2013, 7:57 PM UTC

astrodust wrote: post #38

joshAg wrote: post #28

Earlier quoted context omitted.

https is the wrong solution. that is for preventing others from seeing what you're sending/receiving, not verifying the integrity of what is sent/received. well, it does do that too, but it adds extra unneeded overhead by encrypting everything. Besides, the ISP can easily man-in-the-middle any connection you make and then inject their ads into the webpage, even if you use https. The correct solution is signing the we…

If TLS could negotiate certificates instead of supporting one and only one, the backbone of any sane "virtual host" system, then https: wouldn't be a big deal. It'd be the default. Now you need a separate IP (expensive) or port (annoying) for each virtual host configured with a different SSL cert. This has to stop, but it will not be easy to fix.

Post by ttrreeww » Wed, Apr 03, 2013, 8:21 PM UTC