Covert BT Phorm Trial Report Leaked

stavros-59 writes "An internal BT report on the BT secret trials of Phorm (aka 121Media) Deep Packet Inspection has been revealed on Wikileaks today. The leaked document shows that during the covert trial a possible 18 million page requests were intercepted and injected with JavaScript and about 128 thousand charity ads were substituted with the Phorm Ad Network advertisements purchased by advertisers specifically for the covert trial period. Several ISPs are known to be using, or planning to use, DPI as a means of serving advertising directly through Layer 7 interception at ISP level in the USA and Europe. NebuAd claim they are using DPI to enable their advertising to reach 10% of USA internet users." CT: nodpi has updated their page with a note that says that the charity ads were "purchased and not hijacked"- read there to see what the latest is.

Ouch

[mrbluze (1034940)]

That's a big leak and a big privacy breach, but can this realistically lead to legal action against BT?

Re:Ouch

[KnightMB (823876)]

That's a big leak and a big privacy breach, but can this realistically lead to legal action against BT?

Whether it does or not, someone has already taken the initiative to setup a page to generate fake web pages (or real ones) to pollute the data they collect. So if you can't get them out legally, you can make the data they collect useless, which hits them in the pocketbook and might be more effective than legal countermeasures. You'll find the site here: http://wanip.org/anti-nebuad/ [wanip.org] in which every browser becomes a data-mining polluter when it's run. Get enough those on a suspect ISP and watch the CEO's have a heart attack from the "pollution attack".

Re:Ouch

[EvilMonkeySlayer (826044)]

Looking at the site it appears to be pretty easy for phorm here, all they'd need do is do a simple domain lookup. If it doesn't exist they filter it out.

If it doesn't exist then it's generated by this, since all it does is randomly create addresses. It'd be better if it just loaded random websites. Of course, that'd eat up a lot more of the users bandwidth though.

Re:Ouch

[Janos421 (1136335)]

The browsed pages do not exist, so you never download pictures or js files. It's very easy for an ISP to filter these requests, they can filter the HTTP response code.
Two FF exntensions generate fake queries on search segines to pollute the collected data (at search engine level, but it also pollute ISP data). SquiggleSR [mozilla.org] and TrackMeNot [mozilla.org]. Notice that the former also clicks on non-sponsored results and may deceive cookie tracking.

Re:Ouch

[siddesu (698447)]

not sure what the situation in the UK is, but in Japan some mobile phone operators have been doing this for a while with some phones. since probably half of the internet usage here happens over phones, it doesn't look like a small market.

to make it even worse, my current provider not only injects ads while I browse, they also supply the advertiser with a unique ID, which I can't easily turn off. since the image is inserted on the server i also assume the phone is sending referer headers, so the advertiser can collect your browsing history (and, that being a phone, your URL session cookies too) for good measure.

when i complained, i was told to go away, because there was no such thing as "personal" information being disclosed to the advertiser. to me such arrogance calls for more encryption as a kind hint to the ISPs to go and do the job i'm paying em for.

unless, of course, that option is also defeated by the copyright cretins and the gubbermint, working hard together to prevent child pr0n and terrorists.

in which case, thicker tinfoil will also be necessary.

Re:Ouch

[Dark Kenshin (764678)]

Of course is won't. If a private person were to develop and test this out, he would likely be spending the next 20 years in prison (looking less and less "exaggerated" as time goes on.) The fact that this is for cooperate gains; it will be largely over looked. Yes, I might be lost in cynicism, but life seems to be supporting my case thus far.

Re:Ouch

[MindKata (957167)]

"realistically lead to legal action against BT"

Legal action strong enough to totally stop them is unlikely, as the power seekers who run a lot of countries unfortunately seem to be rushing towards building their own Big Brother, so as they make the rules, they choose whats considered legal. So they simply need to change the laws, which is what they keep doing. It seems nearly every week now we are getting ever more stories of new grabs for information and/or power over people. At this rate, 2008 should go down in history as the start of a Worldwide Big Brother.

Its ironic that our so called free countries appear to be building Big Brother as fast, if not faster than other countries. Maybe we just have better technology. Its also ironic that the war on terrorists is a war against people who wish to force others into their point of view. Yet now the people already in power are seeking to clamp down and hold control over everyone. Its like all of us who don't seek power are caught up in a power struggle between the different groups of power seekers who do seek to impose their views on everyone.

I guess the ones in power in some way fear some lost of power, as it can't be just about protecting us. Its got to be about seeking more power, which is what they do thoughout their political lives and all of us who don't seek power are not going to be heard by them. Especially as most people don't seem to even see how much harm can be done with so much power and no way to tell them they are behaving unfairly. They are becoming like a machine which is loosing its feedback mechanism and so running towards ever more extremes.

Re:Ouch

[aproposofwhat (1019098)]

I came up with this as a concept in 2000, when layer 7 switching was just becoming economically feasible for a startup ISP.

It never flew, because the people I was dealing with weren't complete cunts.

From the document: The advertisements were used to replaced [sic] a 'default' charity advertisement (one of Oxfam, Make Trade Fair or SOS Children's Villages) when a suitable contextual or behavioural match could be made by the PageSense system.

So not only are the bastards hijacking our traffic, they are overwriting paid-for charity ads as well.

I repeat, CUNTS!

Re:Ouch

[mikael (484)]

By their own admission a leading UK telecoms company has deprived several charities of a legal revenue stream to line their own corporate pockets.

Given the outrage following the several Audiocall staff kept 100K of children in need cash for itself [thisislondon.co.uk], I hope BT get the same treatment.

Re:And created a copyright violation

[Jason Levine (196982)]

I think it is actually worse than copyright violation. It is fraud. When I have an ad on my website, it is an indicator that I either a) really like the product/service the advertised company is providing, b) will profit from viewing/clicking the ad, or c) really think that the charity being advertised is worthwhile. Phorm ads wouldn't fit any of those categories and yet are purposefully being injected into pages to make it look like A, B, or C are true. It is giving the impression of me approving/profiting from an ad that I am not approving and profiting from. In addition, it is taking money out of my pocket (or a charity's pocket) to make Phorm money. That's fraudulent activity in my book.

Re:And created a copyright violation

[mikael (484)]

This was discussed in the forum digitalspy.co.uk

Phorm in the UK [digitalspy.co.uk]

One business user was updating the website for his home business. He used his home network connection to inspect the appearance of his website. To his surprise, he could not understand why the format of his website was consistently different from what he had intended. Disturbed by this, he reinstalled the OS on all his servers in fear of being rootkitted, rechecked all his security settings, reconfigured his firewall, and performed a packet trace on every connection made. In the end he noticed that various links on his webpages were being changed and that in particular some were coming from dns.sysip.net. Basically, this system redirected any links to adverts back to Phorm servers.

Customer who was Phormed [adslguide.org.uk]

Re:

[mabhatter654 (561290)]

the EU has already rule against Google for selling ads that do just that in generic Google Ads blocks on sites. I'd say they're already breaking the law.

Re:Ouch

[Jellybob (597204)]

So if I had an ad-funded website (unlikely in the current climate, but stick with me) Phorm would be screwing me out of the money I'd make for those ads, but replacing them with there own.

Something tells me that if I did the same thing with a billboard - charging customers for me to go out and paste their adverts over the top of paid for adverts at night - Clear Channel would quite quickly be attempting to sue me.

Advertisement Injection

[TheMeuge (645043)]

So let me see - if I am paying for bandwidth (which will soon be metered), and my ISP in injecting its ads into the webpages I am requesting, then the ISP is running down my bandwidth on purpose?

Isn't that sort of like someone from the electrical company who breaks into your house to turn the lights on while you're gone?

I won't even mention the privacy issues, cause those aren't "in" nowadays, nor are they likely to be a sufficient cause to nip this practice in the bud. Cheating people out of money, on the other hand, is always a great way to apply the US tort law to the cause.

Re:Advertisement Injection

[Rhys (96510)]

If you're paying for metered bandwidth, why are you accepting ads in the first place? AdBlock+ solves that problem very quickly.

Past that, maybe we can start seeing more "regular" traffic served over https -- DPI or not, it looks like garbage unless you can break the encryption. If someone comes up with a way to do that, there are a lot more serious problems to worry about than ad injection.

Re:Advertisement Injection

[QUILz (1043102)]

They could still hijack SSL/TLS sessions if users aren't paying any attention to warnings.

Re:Advertisement Injection

[Ed Avis (5917)]

Doing man-in-the middle attacks on SSL connections is beyond the technical ability of ISPs, even if users don't bother to check certificates. And the potential for them to get in trouble for it is a lot higher (e.g. if they ended up intercepting financial information, and then the ISP's servers got cracked...). So https is still the right answer here.

It's 2008, why aren't most websites just using https by default? A low-volume site can handle the load with today's superfast CPUs, and high-volume sites can afford to buy one of those crypto engine thingies.

Re:Advertisement Injection

[Ed Avis (5917)]

Yeah it sucks that you have to either pay money or endure scary messages from the web browser. There should be a way to label your site as self-signed where it wouldn't get the special secure icon or magic green glowing bar in the web browser, but on the other hand the user wouldn't be pestered about an invalid certificate (unless the cert offered really has changed since last time the user visited the site).

Re:Advertisement Injection

[Nursie (632944)]

I like that idea actually.

A sort of "You probably shouldn't trust me that much, but at least nobody's eavesdropping or screwing with the datastream" setting.

Re:

[VC (89143)]

Actually its a terrible idea. SSL only works because you know that the connection is encrypted between you and the person you're talking to. SSL to an untrusted host is just as bad as no ssl because the man-in-the-middle (which is kind of the definition of an ISP) could easily produce a certificate that says, "hey, I'm what ever page you wanted to look at". And the insert ads.

Re:

[saigon_from_europe (741782)]

We don't (AFAIK) have a free signer with a widely distributed public certificate at present.

I've heard that BT is willing to do that for free...

Re:Advertisement Injection

[jonaskoelker (922170)]

You could do something almost good enough, though, that's done completely on the client side:

Let's say you're sending index.html. Take a hash of the page, put the hash early on the page.

In the bottom of the page, insert javascript code that removes the hash value, hashes the page, and compares it to the removed hash. If they mismatch, do an alert("warning: the page has been tampered with since it left Foocorp.com's servers."). The hash function doesn't have to be overly secure; here is actually a good time to write your own bad crypto.

The ISP would then have a hard time modifying the page, because they would have to generate the hash value of the modified page before seeing the page they want to modify only slightly.

They could, of course, buffer the whole page (if the server sends it out, or it could spoof your ACKs) and run the javascript on their modified version to compute the hash function. But how are they to know which functions to call? Include an infinite loop and some exploits that you never call yourself if you want to be really disruptive.

Re:Advertisement Injection

[Albanach (527650)]

A possible solution would be opportunistic encryption [wikipedia.org]. It would allow some sites to serve encrypted traffic without changing anything at the apache/squid end of things. No change is needed at the browser level either, and cache's can still be used.

There's still a cpu overhead, but at least we don't lose all the other methods needed to keep http traffic flowing quickly.

Re:Advertisement Injection

[nuzak (959558)]

Once advertisers and web sites see a sizable percentage of their advertising being siphoned off and replaced by ads financially benefitting nobody but the ISP's, you'll start seeing more web sites using https.

No, you will see more lawsuits.

Advertisers paid for their ads to be served. Phorm is theft.

Re:

[Stewie241 (1035724)]

I don't necessarily trust the ISP's JavaScript either... leave my pages alone thank you very much.

Glad I have a small ISP that likely won't do this, but I wonder if this means that random routers across the internet can use this to inject code into web pages.

Misrepresentation

[Rob T Firefly (844560)]

There's another issue. Say I post a banner for Charity X on my site, with a note saying "I support these guys with all my heart and soul, and I urge my readers to do all they can for this cause." You go to my site, but your ISP swaps said charity banner for an ad for personal ads or punching the monkey for a ringtone or some other damn thing, making it appear to you as though I'm imploring you to purchase something I would never willingly endorse.

The ISP is then responsible for using my image to endorse their product to my readership, without my permission. Do I have recourse against them for perpetrating such a fraud? IANAL, etc.

Loss of Common Carrier Exemption?

[OmniGeek (72743)]

It occurs to me that, at least in the US, an ISP that does ad injection *may* be losing its common-carrier status by changing the information that they convey from a Web site to the subscriber.

Consider that the data is being edited on-the-fly based on its content -- i.e., whether or not it's a banner ad. I think a good case could be made that this violates the conditions for a common carrier.

Question is, does this have any legally useful consequences in trying to prevent ISPs from doing it?

Re:Loss of Common Carrier Exemption?

[Red Flayer (890720)]

It occurs to me that, at least in the US, an ISP that does ad injection *may* be losing its common-carrier status by changing the information that they convey from a Web site to the subscriber.

Newsflash: ISPs do not have common carrier status.

This means that whatever safeguards you associate with common carriers, are not enforceable wrt ISPs. A lot of the big ISPs are very happy with the current situation, since they basically get the benefits of common carriers, without the drawbacks (such as not be allowed to throttle certain users).

Is that legal?

[Opportunist (166417)]

Changing content and injecting different ads? I could see two possible violations here, one being copyright (altering content without the consent of the provider of the content), the other one dealing with fraudulent ad change (someone other than the one paying for the ads being displayed).

It's like a cable company changing the channel ads with their own. I doubt any channel would sit and bear it, especially since their customers (i.e. ad buyers) won't accept that.

Re:

[porkThreeWays (895269)]

It's like a cable company changing the channel ads with their own. I doubt any channel would sit and bear it, especially since their customers (i.e. ad buyers) won't accept that.

Which Comcast already does here in the US...

Re:

[corsec67 (627446)]

How could a consumer opt-in with a company to violate a copyright held by a third party?

Take /. for example. How could I opt-in with my ISP to modify the page /. sends to me? Wouldn't that be a derivative, and a copyright violation?

Re:

[corsec67 (627446)]

Derivative works are protected under fair use.

So I could take a song, add "Buy Coke" in the middle, and release that? No, especially not for commercial gain.

Some derivative works are protected by fair use, but they generally have to be mostly newly created content, and can't just be the website with a little bit changed, per Wikipedia [wikipedia.org].

For the uninitiated

[by Anonymous Coward]

BT stands for "British Telecom," Something they failed to mention, except in TFA

I hate it when people use too many arbitrary abbrivations. Let's start actually typing out names to set a context, then let people abbrivate in comments...

Re:

[Stooshie (993666)]

Over here in the UK, nobody needs to expand BT. Everyone knows what it means. (I assume you are not from the UK).

I'm sure stavros-59 just used it out of habit.

Re:

[Richard_at_work (517087)]

Actually, BT stands for nothing - its a contraction of 'BT Group plc'. British Telecom stopped trading in 2001 when mmO2 plc and BT Group plc diverged and started trading as two separate companies.

Um, Replacing Charity Ads?

[DigitalSorceress (156609)]

Wow, talk about low:

In addition to the 18 million regular advertising injections or hijackings, it appears charity advertisements were hijacked and replaced with Phorm advertisements.

        "The advertisements were used to replaced [sic] a 'default' charity advertisement (one of Oxfam, Make Trade Fair or SOS Children's Villages) when a suitable contextual or behavioural match could be made by the PageSense system."

Re:Um, Replacing Charity Ads?

[zwei2stein (782480)]

Its actually good thing they did this.

Great way to influence public opinion against them and convince even usually non-caring people that something evil was going on.

Now if only major news picked this up and made big deal out of it...

Mod Parent Up!

[Cassini2 (956052)]

I noticed that quote too. It is completely despicable that they would remove charity advertisements. Actually, I think the entire system boils down to theft and unlawful interception of traffic.

What if the phone company inserted commercial adds when you were talking to someone on the phone?

Re:Mod Parent Up!

[Nursie (632944)]

"Hi Jim, I just a bought a great new handheld console"
"Oh yeah, what did you get"
"A Sony Pzzzzzzzzzzzzzz^^^^^T Nintendo DS proudly sponsors this phonecall! Your pal loves Nintendo DS! bzzzzzt *click* so yeah you should totally get one so we can play against each other dude!"

Re:Mod Parent Up!

[vux984 (928602)]

What if the phone company inserted commercial adds when you were talking to someone on the phone?

That's nothing. What if they intercepted and changed what was said:

You say: Hey Jim, How are ya?
He hears: Hey Jim, I wish I was eating a tasty Mars bar.

He says: Ok.
You hear: Ok.

You say: Wanna go see a movie?
He hears: Wanna go see Superbad, and get some popcorn?

He says: Uh... sure.
You hear: Uh... sure.

You say: Cool see ya.
He hears: Cool. Can you pick me up some Laramie cigarretes. They take me to flavor country!

He says: Uh... say what?
You hear: Uh... you too.

Re:

[fhage (596871)]

TFA says BT purchased the ads they replaced. The Charities got free advertisements if they were not replaced.

I like how it's charity ads that were intercepted

[3-State Bit (225583)]

It's like the thinking goes "let's substitute out something utterly inconsequential and that will have no ramifications whatsoever". No, a charity isn't going to sue your pants off, so I guess it's okay, right?

What's next, Nike tests shoes (leaked codename: "rental") that deteriorate in 30 days -- on retarded children. Through a charity donation. That they write off their taxes the full value of.

Seriously: these are the times I'm glad to procrastinate about being an internet activist[1], because YOU CAN'T MAKE THIS STUFF UP. I couldn't have warned of this if I had tried.

[1] CHILL, guy with the sig 'whenever I hear the word activist I reach for my revolver' It's going to be all right.

Oxfam ads substituted

[andyh-rayleigh (512868)]

I could see Oxfam (and the other charities who had their ads substituted) getting their lawyers to shakedown BT for a substantial "donation" as an alternative to being sued.

Possible temporary fixes....

[postbigbang (761081)]

1) write a checksum to a page; if it doesn't match (or another hashing method doesn't match) warn the user that the page has been intercepted and corrupted; the code might not be too tough

2) Use page receipts to vet page authentication

3) litigate, especially for copyright violation as the page has been misused by an intermediary for a purpose not intended by the page's author

4) other solutions that someone will think of; stop the page vandals NOW!

Re:Possible temporary fixes....

[kvezach (1199717)]

Intermediate term fix: Tunnel everything over IPsec. If ISPs are going to act like Eve or Mallory, let's treat them as such.

Brief Overview

[skinfitz (564041)]

Interesting - whole system runs on RHEL (told you it was evil..) and multiple Squid processes. Adds some latency into browsing (obviously...) Old system dropped javascript tags into URLs but later version did not (resulting in some users having some javascript appearing in their forum posts - like that guy on the motorbike phorum if anyone remembers that incident) Apple.com among the 'download target' sites (page 49) but surprisingly due to Evil, not Microsoft or Google.

Term and conditions

[TheP4st (1164315)]

Excerpt from chapter 4 titled Terms and Conditions of the document.

Also consideration must be given to the opt-out procedure enabling user to circumvent the system. The latter issue regarding op-out could not be specifically trialed since BTRT concucted this test as a stealth trial.
The system does provide an opt-out mechanism and this was laboratory tested and verified. However the method of opt-out requires consideration. Since it involves the dropping of a web-cookie on the users machine to indicate an opt-out preference, which if wiped by the user means they will be opted back in.

The solution would of course be to make it a opt-in instead of opt-out. Most users would of course not opt-in without seeing a clear benefit for doing so. One obvious benefit would be that those that opt-in recive a discount on their internet connection. Simple and fair.

Pot calling the kettle black?

[Duncan Blackthorne (1095849)]

ISPs complain that BitTorrent users are eating up all the bandwidth, and the MPAA and RIAA complain about "stealing" of IP through filesharing. Meanwhile, the RIAA and MPAA are breaking the law trying to turn a profit with their (pseudo) legal engine, and the ISPs are breaking the law with DoS/MITM attacks, and altering content on the fly! This is bullshit, complete and utter bullshit, and it needs to stop, NOW. Net Neutrality needs to be the LAW, and ISPs need to have the hammer dropped HARD on them over bullshit like this.

I love it--use SSL for everything

[phr1 (211689)]

There is just too much unencrypted web traffic on the net, and too much snooping and now man-in-the-middle attacks. SSL/TLS fixes that (unless Phorm subverts a certificate authority, which would REALLY be playing with fire). So now there's finally more incentive to start using it. Authentication and privacy in one now-fairly-simple operation. SSL isn't nearly widely enough used because years ago it was hard to set up and cpu-expensive. But the heavy computation is just during the session negotiation, and CPU's are fast enough now that it's just not significant (about 1 millisecond server-side on today's Core 2 processors vs a good fraction of a second in the early web era, to set up the key for the whole browsing session).

Re:I love it--use SSL for everything

[TheGratefulNet (143330)]

SSL fixes nothing. the user is still stupid.

I interviewed at a company (a few years ago) that had designed a hardware 'appliance' that intercepts SSL web comms and fools the user into accepting a fake cert that looks VERY VERY much like the real thing. he clicks 'ok' and whammo - he FEELS safe but his link is now MITM attacked and compromised. and he didn't even know it.

technically, SSL didn't break but the middle box (cough cough) did some very evil things and asked both ends to talk to it, instead. essentially.

how many people really scrutinize the MESS OF TEXT that comes up in those cert popups? even experts tend to say 'yeah yeah, OK' and click it away.

morale: assume your company is using one of these boxes and go from there. over time, more and more companies WILL be snooping on their employees or users using these 'SSL feel good' faker boxes.

be advised.