Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Security » ISP Based Contextual Advertising
Search Topic:
Uniqs:
3794
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
Odd Packets »
« On line back up not accessable for Norton 360  
page: 1 · 2 · 3
AuthorAll Replies

SUMware
Premium
join:2002-05-21

reply to ilago
Re: ISP Based Contextual Advertising

said by ilago See Profile :

Thanks SUMware, I've been following the Register information fairly closely
No problem. Kinda stumbled upon that Reg page without expecting it.
said by ilago See Profile :

As far as I can see from the Hardware Architecture Diagram, there is NO way that the first hop can avoid the Phorm interception, regardless of the protocol being used for accessing the network. It is the Phorm equipment, not the ISPs, determining whether you've opted out.
Yep. Agreed. Do ya think we can trust them?
said by ilago See Profile :

I find giving a known malware developer access to all users' internet activities at hardware level in the name of advertising to be appalling.
Yes, absolutely.

As you've previously indicated, it's amazing that this stunning issue, and its related security/privacy/technology/legal implications, haven't (yet?) attracted the attention that it deserves. Even here many readers seem to be ignoring this.

Your post did attract my attention immediately. Thanks again!

SUMware
Premium
join:2002-05-21

reply to ilago
Security firms split over Phorm classification

Keeping score: an update from The Register
14th March 2008 -
quote:
Security firms are split about whether they will classify Phorm's targeting cookies as adware.

Kaspersky Lab, whose anti-virus engine is licensed to many other security vendors, said it would detect the cookie as adware. However, AVG, developer of the most widely used free of charge anti-virus scanner, said it would not detect Phorm's cookie even though the Czech firm's CTO Karel Obluk describes the technology as "borderline".

As previously reported, Trend Micro said there was a "very high chance" that it would add detection for the tracking cookies as adware. PC Tools echoed Trend's concerns about privacy and security, urging Phorm to apply an opt-in approach.

Specialist anti-spyware firm Sunbelt Software also expressed concerns, saying Phorm's tracking cookies were candidates for detection by its anti-spyware software.

Webroot, another prominent anti-spyware firm, reported difficulties at getting samples of Phorm's tracking cookies for evaluation purposes.

We polled a number of security firms on their attitudes to Phorm. We are waiting for responses from Symantec and McAfee, the two largest anti-malware vendors, as well as Check Point, which markets the popular Zone Alarm personal firewall.


ilago
Premium
join:2005-06-28
Australia
·Internode

A further reference I dug up which is somewhat scary if anyone doesn't think this has further to go.

quote:
Hi all,

I've been seeing lots of hits from Russia on Dephormation.org.uk from
IP
address 78.110.48.130. Badphorm.org.uk is getting the same.


»groups.google.com/group/news.adm···f106739b

Phorm's share price seems to be taking a dive, but that doesn't mean this issue is going away.

SUMware
Premium
join:2002-05-21

Well, that puts a potentially very interesting spin on things!

Today's news:
BT confesses lies over secret Phorm experiments
17th March 2008 -
quote:
BT has admitted that it secretly used customer data to test Phorm's advertising targeting technology last summer, and that it covered it up when customers and The Register raised questions over the suspicious redirects.

The national telecoms provider now faces legal action from customers who are angry their web traffic was compromised.
FIPR claims Phorm technology breaches UK law
March 17, 2008 -
quote:
The Foundation for Information Policy Research (Fipr) has issued an open letter to the Information Commissioner Richard Thomas, claiming that Phorm’s ad serving technology is illegal in the UK.

According to Nicholas Bohm, general counsel at Fipr, both parties must consent to interception in order for it to be lawful, according to the Regulation of Investigatory Powers Act.

He says that Phorm’s system is like the Post Office opening letters to see what the recipient is interested in, and then targeting them with relevant junk mail.


ilago
Premium
join:2005-06-28
Australia
·Internode

In amongst the "usual" on Slashdot today was this little gem in a thread on Tim Berners-Lee objections.

»yro.slashdot.org/comments.pl?sid···22777122

Whole thread also has some other references that are starting to pull more of the story together »yro.slashdot.org/article.pl?sid=···/1259234

Thanks for the Techwatch link, I hadn't got to that one yet

SUMware
Premium
join:2002-05-21

said by ilago See Profile :

In amongst the "usual" on Slashdot today was this little gem in a thread on Tim Berners-Lee objections.
I'd read the Berners-Lee piece at BBC "Web creator rejects net tracking". Thanks.
This article "Some notes from the Phorm sales pitch" is excellent and highly revealing! Great post. Thank you.

Mele20
Premium
join:2001-06-05
Hilo, HI

said by SUMware See Profile :

.
This article "Some notes from the Phorm sales pitch" is excellent and highly revealing! Great post. Thank you.
God, that article is absolutely bone chilling.

From the above article:

"Even if Phorm is stopped dead tomorrow, the business conditions and legal loopholes are still present to encourage ISPs to try this again and again, and it will certainly be much worse in the US where there is absolutely no legal protections at all, and a ready market for personal data."

I'm sure my ISP (big cable company) is probably salivating at the idea of using this. I installed the Dephormation Firefox extension but it only protects Fx if my ISP were to institute this. Phorm could read everything else on my computer including emails and Instant Messaging. From other posts in this thread, I read which AV vendors will be detecting the phorm cookies and which won't (AVG!) and my AV vendor was not mentioned so I have posted in the Avira forum and asked if they are/will block the cookies and if they say "no" then I will get another AV that does.

The truly depressing and frightening thing here though is that while Phorm may die after what Berners-Lee and others are saying, it will only mean they will reincarnate later with a different name, and slightly different approach, and the ISPs, especially here in the USA, will try again to institute this total tracking of their users and it will easier going here.
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason


ilago
Premium
join:2005-06-28
Australia
·Internode

reply to SUMware
quote:
This article "Some notes from the Phorm sales pitch" is excellent and highly revealing!
*mind boggling* when you think about how they are doing it. They will be completely untouchable legally once the information leaves the ISP, regardless of the national laws the ISPs are operating under.

I wish I could believe that this is only three ISPs in the UK. I think Phorm have doing a lot of hard work below the radar. I don't think for a moment there is no return on this for them.


Just Basics

join:2003-06-08
Painter, VA

reply to ilago
Re: ISP Based Contextual Advertising

Many of use have already given our ISP the rights to do most anything they want by using their services. I don't use them but here is the T.O.S. from NetZero as an example:

Collection and Use of Personal Information. NetZero will collect, store, compile and utilize information about you, your computer, your phone number and your use of the NetZero Services including, without limitation, information regarding the Web sites you visit and information that you provide in response to NetZero questionnaires, surveys and registration forms. NetZero may provide this information to third parties including advertisers, clients, marketing organizations and others as further set forth in NetZero's Privacy Statement.

Again, I don't use NetZero but my ISP has a similar T.O.S. - check yours and you may be surprised at what you will find.

Some ISP's are already using:

»www.nebuad.com/
»www.adzilla.com/

My ISP was using the Coretel network and the transparent proxy from adzilla - here is a link to a rant about their services:

»www.sendcoffee.com/minorsage/adzilla.html

A way to detect any page changes made by your ISP:

»vancouver.cs.washington.edu/#results

I've never seen any but I still check occasionally.


CalamityJane
Premium,VIP,MVM
join:2002-08-27
Eustis, FL

reply to ilago
Oh wow, I had never heard of Phorm until one our Researchers asked me to proofread a blog post he was preparing for the Lavasoft Research Blog. He was livid about this practice (and his blog post was just fine )
»www.lavasoft.com/support/securit···g/?p=203

He was wondering if he was ranting too much LOL.

I'll be sure to point him to this topic! Thanks guys, I know he'll be interested.
--
It takes a disaster to make a woman out of a female
Microsoft MVP/Windows Security 2003-2008
Proud Member of ASAP (Alliance of Security Analysis Professionals)


ilago
Premium
join:2005-06-28
Australia
·Internode


1 edit
quote:
My ISP was using the Coretel network and the transparent proxy from adzilla - here is a link to a rant about their services:

»www.sendcoffee.com/minorsage/adzilla.html

A way to detect any page changes made by your ISP:

»vancouver.cs.washington.edu/#results
Thanks Just Basics the detection page is an excellent way to pick up the html changes. My ISP has reasonable ToS for the time being and Australia isn't a big target for advertising yet, but it will come. We have proposals at Government level for the same type of hardware level filtering. To be used as a control against open access to "unsuitable" material

That's not quite the same issue, but just as serious in a different way and it's why I started researching this issue.

quote:
He was wondering if he was ranting too much LOL.
I think he was being very restrained CJ

edit: corrected Just Basics handle


ilago
Premium
join:2005-06-28
Australia
reply to ilago
I wonder when the "Phorm Comms Team" or the "Tech Team" will post in this thread?

They have posted in almost every other forum I've found that relates to Phorm.

Mele20
Premium
join:2001-06-05
Hilo, HI

reply to Just Basics
said by Just Basics See Profile :

l
A way to detect any page changes made by your ISP:

»vancouver.cs.washington.edu/#results

I've never seen any but I still check occasionally.
That page says it detected a change on every page. But it is a poorly constructed web page with nothing to click on to see the "further information". Plus, what is there is text on top of text and boxes on top of boxes. I assume that the changes it picked up were from the Proxomitron. I used Fx 1.5 which is my main browser. It said it assumes one uses a "modern" browser and only evidently likes Fx 2. Well, Fx2 has just been proven yet again to be inferior to 1.5 privacy wise. That page should accept Fx 1.5 I think. I'm not sure the version of Fx is why there is nothing clickable there. The page refused to stop loading also even when it said "done" in the status bar.
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason

Just Basics

join:2003-06-08
Painter, VA

reply to ilago
Taken from a discussion at this link:
»www.digitalspy.co.uk/forums/show···t=759341
-----------
Quote
Whether you "opt-out" by having the actual "opt-out cookie" or by simply blocking Phorm/Webwise cookies, your data is still mirrored to the "Profiler" equipment located at the ISP, which although allegedly owned by the ISP still runs Phorm's software & exists solely to profile your browsing data. "Opting-out" just means that you don't get the "benefit" of targeted adverts, plus allegedly your data does not pass from the "Profiler" to Phorm's own servers.
End quote

Quote
I think this is the much more worrying side to the problem, and something a lot of people seem to be missing. The opt-out given by Phorm really isn't an opt-out at all - it stops the targeting advertising, but all your requests are still going through their servers, you no longer have a direct internet connection, and they still get to profile you.

The cookie and the firefox addon are just saying "dont show me targetted advertisements", it isn't stopping what's happening behind the scenes, your privacy is still being violated, and because it's on the ISP network there's not really anything you can do about it.
End quote

Although the delivery is somewhat different than Adzilla which uses a transparent proxy the end result is still the same. You will be sharing your browsing habits and will be profiled by a third party.

This all could really be a great selling point for an ISP that does not Create a Richer Browsing Experience for their customers. I'd sign up in a minute!

Mele20
Premium
join:2001-06-05
Hilo, HI

reply to ilago
According to the NY Times, Phorm will be coming to major USA broadband ISPs very soon:

"A Company Promises the Deepest Data Mining Yet

Amid debate over how much data companies like Google and Yahoo should gather about people who surf the Web, one new company is drawing attention — and controversy — by boasting that it will collect the most complete information of all.

The company, called Phorm, has created a tool that can track every single online action of a given consumer, based on data from that person’s Internet service provider. The trick for Phorm is to gain access to that data, and it is trying to negotiate deals with telephone and cable companies, like AT&T, Verizon and Comcast, that provide broadband service to millions."

»www.nytimes.com/2008/03/20/busin···business
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason


ilago
Premium
join:2005-06-28
Australia
·Internode



This is not good.

There's a little bit more today in The Register, including a link to the UK Privacy Report that Phorm has been using to justify how good they are at privacy.

»www.theregister.co.uk/2008/03/19···8020_pi/

And some more comment here
»www.politicalpenguin.org.uk/blog/cat,25/

SUMware
Premium
join:2002-05-21


2 edits
reply to Just Basics
Possible Regulation?

said by Just Basics See Profile :

The opt-out given by Phorm really isn't an opt-out at all - it stops the targeting advertising, but all your requests are still going through their servers, you no longer have a direct internet connection, and they still get to profile you.
This angers the NSA/CIA/FBI who want to be the first in line to monitor your entire data stream.
-

A Push to Limit the Tracking of Web Surfers’ Clicks
quote:
After reading about how Internet companies like Google, Microsoft and Yahoo collect information about people online and use it for targeted advertising, one New York assemblyman said there ought to be a law.

So he drafted a bill, now gathering support in Albany, that would make it a crime — punishable by a fine to be determined — for certain Web companies to use personal information about consumers for advertising without their consent.

And because it would be extraordinarily difficult for the companies that collect such data to adhere to stricter rules for people in New York alone, these companies would probably have to adjust their rules everywhere, effectively turning the New York legislation into national law.

“Should these companies be able to sell or use what’s essentially private data without permission? The easy answer is absolutely not,” said the assemblyman who sponsored the bill, Richard L. Brodsky, a Democrat who has represented part of Westchester County since 1982.

Mr. Brodsky is not the only lawmaker with this idea. In Connecticut, the General Law Committee of the state assembly has introduced a bill that focuses on data collection rules for ad networks, the companies that serve ads on sites they do not own.

The New York bill, still a work in progress, is shaping up as much broader. Although it is likely to see some tinkering before it comes to a vote — which Mr. Brodsky hopes will happen this spring — it aims to force Web sites to give consumers obvious ways to opt out of advertising based on their browsing history and Web actions.

If it passed, computer users could request that companies like Google, Yahoo, AOL and Microsoft, which routinely keep track of searches and surfing conducted on their own properties, not follow them around. Users would also have to give explicit permission before these companies could link the anonymous searching and surfing data from around the Web to information like their name, address or phone number.

Because there is no federal legislation on these subjects, Mr. Brodsky’s bill — and, to a lesser extent, the one in Connecticut — could set interesting precedents.

In recent weeks, Microsoft and Yahoo have sent lobbyists to meet with Mr. Brodsky, and AOL, a unit of Time Warner, is planning a meeting. Unlike most Web companies, Microsoft favors legislation about online privacy and advertising practices and has lobbied federal lawmakers to establish regulations, said Michael Hintze, associate general counsel for Microsoft.

Microsoft asked Mr. Brodsky to broaden his bill to include all sorts of companies that serve ads around the Web, not just those that show ads based on users’ behavior. Such a change would create a bill that more clearly includes Microsoft’s chief competitor, Google.

Mr. Brodsky says he has asked the Web companies point-blank if they would support legislation similar to what he has proposed. Microsoft gave him a firm “yes,” but Yahoo, he said, seemed to be opposed to any sort of regulation. Yahoo declined to comment on its meeting with Mr. Brodsky.
-

ISP Tracking: The Mother of All Privacy Battles
quote:
Big companies like AOL, Microsoft and Yahoo, and smaller ones like Revenue Science, are gathering various crumbs about online behavior to use in their advertising systems. They are limited to gathering data from their own sites and their networks of affiliates.

Eventually, cellphone companies will start to face the same choice. If there is a G.P.S. unit in your phone, it will be able to keep track of what stores you visit, among many other things.

All these partial schemes may well be rendered as useless as a blindfolded spy by some new companies that want to tap into the records of Internet service providers. Their objective: following every single click users make. That way, in theory, they have the best ability to find ads that can indulge each users passion of the moment. Among the companies trying to build out this sort of system are Phorm, NebuAd, FrontPorch.


ilago
Premium
join:2005-06-28
Australia
·Internode

This is on the news page here. It refers to the Register article I linked to earlier.

"Rootkit and spyware developer turned behavioral advertising firm Phorm has agreed to let an independent analyst inspect the source code for their controversial browsing history tracking technology. Like NebuAD in the States, the company pays ISPs to install deep packet inspection hardware on their network to track user behavior. Unlike NebuAD, Phorm has a pretty shady history in spyware, and is trying to convince UK users that the ISP money-grab is really an anti-phishing solution. Both companies are fighting an uphill battle in gaining consumer trust."

»Phorm Opens Source Code For Inspection

I don't have much faith in the code inspection. It needs ongoing compliance and independent auditing. It could be changed remotely within a few minutes once it's in place. These guys are experts at that

Thanks for this reference SUMware.

quote:
If it passed, computer users could request that companies like Google, Yahoo, AOL and Microsoft, which routinely keep track of searches and surfing conducted on their own properties, not follow them around. Users would also have to give explicit permission before these companies could link the anonymous searching and surfing data from around the Web to information like their name, address or phone number.

Because there is no federal legislation on these subjects, Mr. Brodsky’s bill — and, to a lesser extent, the one in Connecticut — could set interesting precedents.

Just Basics

join:2003-06-08
Painter, VA

reply to SUMware
SUMWare, I don't care if a Federal Agency monitors my every movement on the internet - but that is just my own opinion. There have already been many discussions on this topic and what it boils down to is whether using the internet is a right or a privilege. I consider it a privilege and pay my ISP for that privilege.

What I do care about is that my information is shared with a third party for profit without my knowledge which has already happened. Whether it happens at the ISP level or a server along the line makes little difference to me.

What really concerns me is the apathy that is apparent in this thread about a subject that could forever change the internet.

Where are the indignant people who object strenuously when a website sets a tracking cookie? Where is the outrage that was caused by the Sony rootkit or Windows validation? And the list goes on.

It leads me to think that most really don't care whether their connection to the internet is compromised at the ISP level and their ISP is willingly co-operating with what is no more than an advertising agency.

Do you really trust your ISP enough to not share even more of your personal information with this third party? How about your name, address and even credit card information they have on file? What is to prevent them from doing so?

SUMware
Premium
join:2002-05-21


2 edits
said by Just Basics See Profile :

What really concerns me is the apathy that is apparent in this thread about a subject that could forever change the internet.

Where are the indignant people who object strenuously when a website sets a tracking cookie? Where is the outrage
I agree.
Forums » Up and Running » Security » SecurityOdd Packets »
« On line back up not accessable for Norton 360  
page: 1 · 2 · 3


Saturday, 28-Nov 12:06:40 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [122] Time Warner Cable Fires Broadside At Broadcasters
· [112] New AT&T Ad Campaign Hits Back At Verizon
· [96] Apple Joins AT&T Verizon Snark Fest
· [87] New Bill Takes Aim At Higher Verizon ETFs
· [72] TiVo Sees Record Customer Losses
· [69] In-Flight Internet Headed For Bumpy Landing?
· [69] Verizon CEO: Hulu Will Be Dead Soon
· [62] Thanksgiving Open Thread
· [58] Weekend Open Thread
· [40] EFF Wages War On Fine Print
Most people now reading
· So we need a legitimate reason to use a lot of bandwidth? [TekSavvy]
· Windows 7 boot manager editing questions [Microsoft Help]
· Using AirMax to provide triple play services? [Wireless Service Providers]
· Using DIR-615 C1/3.01 with Trendnet TEW-652BRP in N Mode [D-Link]
· MagicJack Error Broken Storage [MagicJack]
· Once infected, Impossible to detect [Security]
· Why would I want an e reader? [General Questions]
· Is Gear Score now the new requirement to get pug invite? [World of Warcraft]