how-to block ads
|
Karl Bode
News Guy
join:2000-03-02
Host:
Road Runner
PC gaming GAMES
PC gaming Tech
| Re: Past BBR stories established Nebuad only monitoring I'm sure Robb will correct me if I'm wrong, but you're talking about two different things.
The "injection" you're thinking of consisted of a Texas ISP named RedMoon using a NebuAD banner technology reserved for free Wi-Fi advertising in general broadband use. That resulted in banners being superimposed over existing websites and ad relationships...That was part of a "Fair Eagle" project that NebuAD stopped.
This is different and speaks to the system fundamentals. Topolski is saying the system as a whole forges IP packets so their JavaScript code is written into source code trusted by the Web browser. | |
|  jimness000
join:2005-03-28
West Chicago, IL
| Re: Past BBR stories established Nebuad only monitoring What concerns me on the surface is the common practice of using web-based email. My company and my wife's both have web portals into their email systems. My wife, an HR person in her company, has access through web portals to payroll and other private employee information.
It sounds as though this technology could be used to gain access to proprietary info which is assumed to be secure (via HTTPS connections).
Am I wrong? | |
| | 
TKJunkMail
Enjoy the sun
Premium
join:2002-03-03
Avalon, NJ
 ·Sprint Mobile Broa..
 ·Comcast
1 edit | Re: Past BBR stories established Nebuad only monitoring said by jimness000  :It sounds as though this technology could be used to gain access to proprietary info which is assumed to be secure (via HTTPS connections).Am I wrong? Yes. I think you are. The Nebuad device has no decrypting capabilities and can't see inside encrypted packets. They could tell the end points of the conversation but not see the data.
--
My BLOG .. .. Internet News .. .. My Web Page | |
| | | 
funchords
Hello
Premium,MVM
join:2001-03-11
Washington, DC
 ·Verizon Online DSL
 ·Skype
2 edits | Re: Past BBR stories established Nebuad only monitoring said by TKJunkMail :said by jimness000 :It sounds as though this technology could be used to gain access to proprietary info which is assumed to be secure (via HTTPS connections).Am I wrong? Yes. I think you are. The Nebuad device has no decrypting capabilities and can't see inside encrypted packets. They could tell the end points of the conversation but not see the data. The device is inserted in the middle, so it can see the entire transaction, including the cryptographic key exchange. **
That said, I have no evidence that it decrypts https, and I personally believe that it would use precious CPU time in a middlebox where processing speed must be an issue.
We also have NebuAd's word that they won't try it, FWIW.
[Edit: I'm not sure this really means anything, SSL is not my strong point. It includes client sending of a code that can only be decrypted by a server's private key, but also includes several flavors of encryption of various strengths. In a cytological attack, my understanding is that the MITM can affect which get negotiated. All the more reason that we SHOULD be able to trust our ISPs and their vendors.]
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon
HTTP is the new Bandwidth Hog...
| |
| | | | | | | | | | | | 
knightmb
Everybody Lies
join:2003-12-01
Franklin, TN
·AT&T DSL Service
| said by funchords :The device is inserted in the middle, so it can see the entire transaction, including the cryptographic key exchange. That said, I have no evidence that it decrypts https, and I personally believe that it would use precious CPU time in a middlebox where processing speed must be an issue. We also have NebuAd's word that they won't try it, FWIW. I have to agree, they wouldn't need to waste CPU time to do this. That would actually give it a dual purpose perhaps. Serve ads and secret wiretaps. Either way, we might not be able to do anything about the secret wiretap, but at least we can make the regular stuff all look like garbage. As usual in this type of stories, I chime in the link in my signature. 
--
Fight NebuAD and the like:
Click Here to pollute their data | |
| | | | |
TKJunkMail
Enjoy the sun
Premium
join:2002-03-03
Avalon, NJ
·Sprint Mobile Broa..
·Comcast
| Re: Past BBR stories established Nebuad only monitoring said by knightmb :said by funchords :The device is inserted in the middle, so it can see the entire transaction, including the cryptographic key exchange. That said, I have no evidence that it decrypts https, and I personally believe that it would use precious CPU time in a middlebox where processing speed must be an issue. We also have NebuAd's word that they won't try it, FWIW. I have to agree, they wouldn't need to waste CPU time to do this. That would actually give it a dual purpose perhaps. Serve ads and secret wiretaps. Either way, we might not be able to do anything about the secret wiretap, but at least we can make the regular stuff all look like garbage. As usual in this type of stories, I chime in the link in my signature. I think espaeth already answered the HTTPS issue here:
»Re: Past BBR stories established Nebuad only monitoring
--
My BLOG .. .. Internet News .. .. My Web Page | |
| | |
funchords
Hello
Premium,MVM
join:2001-03-11
Washington, DC
·Verizon Online DSL
·Skype
| Re: Past BBR stories established Nebuad only monitoring said by TKJunkMail :said by Karl Bode :This is different and speaks to the system fundamentals. Topolski is saying the system as a whole forges IP packets so their JavaScript code is written into source code trusted by the Web browser. Some observations on the Topolski study: 1. He turned off the anti-phishing feature in IE. This may have made the attack possible where it normally might not have if turned on by default as it usually is. No, it is off by default, but the user is insistently bugged to turn it on until the user gives a definitive "yes" or "no."
The reason I said "no" is so not to cloud the issue with extra packets.
I'll let you figure out what setting that users who are concerned with privacy are likely to choose.
said by TKJunkMail :2. If a user blocks ALL cookies not originating at specific list of web site domains, the injected cookie from "faireagle.com" could not be put on the client system for tracking purposes. I assume from reading his writeup that the system he tested with allowed temporary cookies and that is how Nebuad could put cookies on the system. I never allow my system to do that. Good for you. However, that is not what most users do, nor is that the default.
3. If using Firefox with the "noscript" addon, then any injected javascript from faireagle.com wouldn't be executed.
Good for you. However, that is not what most users do, nor is that the default.
Do you have a reason on attacking this report?
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon
HTTP is the new Bandwidth Hog...
| |
| | |
TKJunkMail
Enjoy the sun
Premium
join:2002-03-03
Avalon, NJ
·Sprint Mobile Broa..
·Comcast
| Re: Past BBR stories established Nebuad only monitoring said by funchords :Do you have a reason on attacking this report? Not attacking the report. Just pointing out that following reasonable browser security settings can make the Nebuad monitoring moot.
If I was really paranoid about security I would subscribe to a public VPN service for all web access and then all traffic would be encrypted and untouchable unless someone got a Nebuad device between the VPN server and the internet at large.
--
My BLOG .. .. Internet News .. .. My Web Page | |
| | | |
funchords
Hello
Premium,MVM
join:2001-03-11
Washington, DC
·Verizon Online DSL
·Skype
| Re: Past BBR stories established Nebuad only monitoring said by TKJunkMail :Not attacking the report. Just pointing out that following reasonable browser security settings can make the Nebuad monitoring moot. Cool. That advice is always valuable.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon
HTTP is the new Bandwidth Hog...
| |
| | | | 
swhx7
Premium
join:2006-07-23
Elbonia
·RoadRunner Cable
| said by TKJunkMail :following reasonable browser security settings can make the Nebuad monitoring moot.
By "make moot" I understand you to mean that avoiding the injected cookies and Javascript interferes with client-tracking efforts. That much is true, but it does not avoid having all one's packets going thru the data-mining machine. Theoretically (if the spybox company diverges from what they publicly say they'll do) it could still assemble a per-individual browsing history.
Also it seems to me (though I've only briefly glanced at the materials) that the user can avoid the Nebuad cookies only by manually evaluating each cookie, because the fraudulent ones are inserted in headers via forged packets. The browser can't tell that they're not from the site the user intends to accept cookies from.
And in the case of the Javascript, even with Noscript, I'm not sure there is any way to run JS from the real site without running the injected JS. | |
| | | | |
TKJunkMail
Enjoy the sun
Premium
join:2002-03-03
Avalon, NJ
·Sprint Mobile Broa..
·Comcast
| Re: Past BBR stories established Nebuad only monitoring said by swhx7 :Also it seems to me (though I've only briefly glanced at the materials) that the user can avoid the Nebuad cookies only by manually evaluating each cookie, because the fraudulent ones are inserted in headers via forged packets. The browser can't tell that they're not from the site the user intends to accept cookies from. And in the case of the Javascript, even with Noscript, I'm not sure there is any way to run JS from the real site without running the injected JS. From my reading of the tests done as laid out in the linked PDF report, blocking the cookies is possible because the cookies involved are clearly identified as coming from faireagle.com. Also the javascript is an addon at the end that also is marked as executing from the faireagle.com domain. So the javascript can be avoided.
Could Nebuad chg that? Maybe. But the way it is setup now, blocking is easily achieved.
--
My BLOG .. .. Internet News .. .. My Web Page | |
| | | | | |
funchords
Hello
Premium,MVM
join:2001-03-11
Washington, DC
·Verizon Online DSL
·Skype
| Re: Past BBR stories established Nebuad only monitoring said by TKJunkMail :From my reading of the tests done as laid out in the linked PDF report, blocking the cookies is possible because the cookies involved are clearly identified as coming from faireagle.com. Also the javascript is an addon at the end that also is marked as executing from the faireagle.com domain. So the javascript can be avoided. Could Nebuad chg that? Maybe. But the way it is setup now, blocking is easily achieved. Sure. They can change the faireagle domain to something else, to thwart your blocking. Domains are very cheap and you can't block the dictionary. Hell, they could inject 10 different javascripts into each page, until one eventually gets followed.
They can forge HTTP redirects to drive you to the nefarious code, instead of using javascript to do it. I think this is similar to what Phorm is reportedly going to do now.
They could also make deals with web portals so that the nefarious script doesn't have to be forged at all. They buy ad space or even a 1x1 pixel, that ad server realizes you're from an IP address with a NebuAd deal, the ad server loads you up with their profile-identification cookies, and no forgery ever takes place. Fortunately, this won't be allowed to happen by the best services. Most Yahoo's and Google's of the world actually are fans of the Internet and ultimately side with the user, despite our cookie-erasing habits. They don't want 24/7/365 eavesdropping on the internet, either.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon
HTTP is the new Bandwidth Hog...
| |
| | | | | | | 
deitarion
@teksavvy.com | Re: Past BBR stories established Nebuad only monitoring And NoScript is based on Javascript whitelisting, so they'd have to embed the JS into the page and hope that the user is viewing a site they've granted JS execute permission to. | |
| | | | | | | |
funchords
Hello
Premium,MVM
join:2001-03-11
Washington, DC | Re: Past BBR stories established Nebuad only monitoring I actually have it on this computer... disabled. There's a less agressive plug-in that I'm used to using, but it hasn't been updated for FF3. :-( | |
| | 
RARPSL
join:1999-12-08
Suffern, NY
| said by TKJunkMail :3. If using Firefox with the "noscript" addon, then any injected javascript from faireagle.com wouldn't be executed. Since their box is screwing with the web page HTML will noscript even know that the JavaScript is coming from faireagle.com? I think that they insert the script directly into the HTML Header..\Header area so it is inline not loaded via a LINK tag (which noscript would be able to block by refusing to allow the Link's URL from being executed). | |
| | | |
|
