AT&T Hotspots: Now with Advertising Injection

http://webpolicy.org/2015/08/25/att-hotspots-now-with-advertising-injection/

by jeo1234 • 11 years ago

150 84 11 years ago

jeo1234• 11 years ago

AT&T seems to really not care about their customers trusting them.

urda• 11 years ago

Don't connect to open Wifi hotspots willy nilly then. Is AT&T taking advantage of the situation? Absolutely, but this is what happens when you connect to any WiFi network you find while on the road. Today it's AT&T, tomorrow it'll be someone else.

Someone12342• 11 years ago

And let's be frank, these networks are so insecure anyway even if you can connect you likely shouldn't be using it for anything you care about anyway (and certainly nothing that isn't HTTPS).

But even websites which support HTTPS won't mark cookies secure, so the browser will happily upload it to the HTTP version for the world to see.

Ultimately open WiFi hotspots are a security nightmare, it is quite incredible that nothing has been done about it. There's no reason we couldn't utilise something akin to SSL to secure the WiFi connection itself (since the scenario is identical, two previously unknown parties wanting to communicate securely, and utilising an already trusted CA to facilitate that).

I guess as an industry we're just too lazy to make anything except PSK work.

r00fus3• 11 years ago

Staying off promiscuous mode is one thing, but all AT&T hotspots appear with the same SSID - if you rely on a single one you'll get all of them.

Weak Wifi signal is also a killer - you're using maps and driving near a Starbucks? Data crawls to a halt as your phone tries to connect to a wifi point 30+m away.

Eventually I just gave up on them.

Someone12342• 11 years ago

Individual websites may be able to protect yourselves by:

- Using HTTPS directly, in particular with HSTS set (optimal).

- Use a third party like CloudFlare to add HTTPS via their proxy.

- Alternatively: HTTP with Content Security Policy set (since it will reject their scripts and CSS running as it isn't in the whitelist). This is only a short term solution since they can alter the CSP header, but it will work if you're stuck on HTTP for now. We bounce a lot of advertisers and malware off of our site this way.

Ultimately this is yet another "Use HTTPS!" broken record. But the CSP solution works until they get wise to it.

r1ch• 11 years ago

Unfortunately the first two options aren't really viable if you're an ad supported website. HTTPS will kill your ad revenue since most ad scripts don't work properly over HTTPS.

dogma11384• 11 years ago

That's a problem for site operators not users if more people force sites to switch to HTTP's more AdNetworks will start serving content via HTTPS.

The good thing is that at least most browsers these days are good at blocking mixed content so you won't have HTTP adds growing tumors due to injections anyhow.

What i don't understand is why AT&T has to do injection in the 1st place they can easily setup their own AdNetwork and partner with the large AdNetworks to route through AT&T's own internal servers.

bpicolo• 11 years ago

Ads are fine over https. Choose your ad networks wisely.

phyzome• 11 years ago

Altering the CSP header would be more likely to get them in trouble, I think. So that's good too. :-)

ejdyksen2• 11 years ago

I have just stopped connecting to most wifi hotspots altogether unless I'm going to be somewhere for a few days (hotel, conference, etc). LTE is just faster and more reliable, and tethering is dead simple these days.

enraged_camel• 11 years ago

The problem is that most people's mobile data plans have caps, so if they do any kind of non-trivial web browsing, they need to connect via wifi.

_delirium2• 11 years ago

The prevalence of stuff that likes to auto-update without asking you makes this even more dicey. I ran through 50% of my monthly mobile-data quota once when OSX decided to download a big OS update over tethering (my monthly quota is 1GB). It'd be nice if there were an OS-level service letting me mark certain SSIDs as not suitable for unnecessary data use, the way Android knows not to download app updates over the data connection.

Nowadays I mostly avoid tethering unless I really have to use it, since it's always rolling the dice whether it's going to eat hundreds of megabytes of my data quota without asking. Fortunately, there are so many wifi hotspots around that I'm finding tethering at all increasingly unnecessary. And a VPN takes care of the security issues well enough.

some-guy• 11 years ago

Are you in the US? How lenient are carriers these days when it comes to tethering? I have AT&T and while their bandwidth and coverage is good, I cannot get unlimited data with my plan so I'm SOL.

wtallis2• 11 years ago

Since the new FCC net neutrality rules went into effect, carriers are no longer allowed to actively interfere with tethering.

ejdyksen2• 11 years ago

I have Verizon, and tethering just comes out of my 5GB data cap. I've never even come close to using all my data, but then again, I'm somewhat frugal with my data when I am tethering.

eli2• 11 years ago

My T-Mobile plan comes with 7GB of tethering. Not quite unlimited, but I've never come close to hitting it.

sliverstorm2• 11 years ago

Inexpensive unlimited data is getting scarce, but I think that's reasonable. LTE capacity is by nature more limited & expensive than wired capacity.

For many activity categories- email, light browsing, etc- a few GB per month is more than sufficient.

If you want to torrent terabytes per month or run multiple Netflix streams all day long, you are a three or even six sigma user, and carriers realize that subsidizing your unusual usage with other subscriber's fees increases costs for the average user, making the carrier less cost-competitive. So you are either going to get pushed to hard lines, or you are going to have to pay for those terabytes of data.

My phone (Verizon prepaid) freely allows me to tether, although this relaxation is a recent development so there are probably many older phones that simply have not been updated to allow tethering. My 1GB is definitely a snug limit but not unworkable.

spaceisballer• 11 years ago

I used to have unlimited data on my iPhone but ditched it for 15GB and unlimited talk and text (wife and I split) and its 15 bucks less than we were paying a month and she used to have line 350mb of data. They would not allow me to tether with my unlimited data. Now I don't know if that got lifted or not for grandfathered plans. But I use my tethering all the time with my laptop and it's great.

uptown• 11 years ago

I use Verizon pre-paid, and tethering is included free. You can add-on data-packs that roll-over for up to three months as needed, and I use a LittleSnitch profile to curtail things like backup services and other heavy-data use services when I'm tethered.

rayiner2• 11 years ago

I don't pay anything extra to tether my iPhone to my Mac (on Verizon). And I regularly get 10 Mbps in downtown Baltimore.

sehugg• 11 years ago

I like being able to click web links without wondering if it's going to load a bunch of 3 MB images or autoplay a video.

I agree that LTE is usually orders more reliable than 95% of wifi hotspots, unfortunately.

0x0• 11 years ago

I've seen this on the "xfinitywifi" SSID even when logged in with a valid comcast subscriber ID... :(

Wonder how it handles apps that expect json, or jquery/ajax calls that works with html fragments. Or even someone authoring a wordpress blog post?

eli2• 11 years ago

You would hope it would be checking Content-Type headers or similar... but yeah, I'm sure it must subtly break a lot of stuff.

edwhitesell4• 11 years ago

It's easy to get drawn into doing this kind of intrusive advertising when you have a captive audience on a WiFi network. It's an idea I've discussed or been involved in "testing" a number of times. (background: I've been building/operating wireless/WiFi/Hotspot networks since 2001)

The reality is AT&T probably has no idea how bad this is, and likely would not care. Somewhere, someone sees the potential dollars on the upside and that's the only factor that matters.

There are better ways to monetize free WiFi today. Advertising is a piece of that puzzle, but there are others too.

edwhitesell4• 11 years ago

(replying to myself is probably bad form, but I had another thought to note here)

Most likely, the WiFi provided by carriers like AT&T is meant for offloading. The phones will do EAP-SIM or some other authentication the customer has no idea of. That will get the voice and SMS traffic passing via WiFi and associated backhaul to the Mobile Core, instead of the mobile network.

Assuming that scenario, where WiFi is really a low-cost extension of the mobile network, the carrier has very little incentive to do the "right thing" when it comes to injecting ads and/or content filtering. They are already improving the services their customers pay for. Offsetting that (relatively low cost) with some "bad form" advertising probably won't get a second thought.

JoBrad• 11 years ago

They would likely care if they see how bad the user experience can be.

droopybuns3• 11 years ago

It is 2015. If you're not running your own VPN on aws or if you're not using solutions like Cloak, you get what you get.

https://www.getcloak.com/

I would prefer that carriers didn't do this kind of nonsense, but I'd also prefer that companies like Facebook & Google didn't have the core of their business built around the same function. We live in a world where people expect miraculous technology for "free."

It's trivial to get around this.

falcolas2• 11 years ago

With DPI, it's also rather trivial for WiFi providers to block normal VPN traffic - and they do.

There are ways around the DPI with SSL wrapping and such, but it's not always "trivial".

Point in case, I'm living in a town with a population under 40k, and I know of at least 3 places so far which block OpenVPN traffic over both UDP and TCP.

droopybuns3• 11 years ago

That is novel to me. Thanks for sharing.

Are they really doing flow inspection & identifying protocols? Or is it just that they're watching for standard ports?

blacksmith_tb• 11 years ago

I have seen a fair number of public APs blocking VPN traffic, but my instinct is it's due to incompetence, not malice. It appears they are blocking everything but traffic to 80 and 443, likely due to some sort of turnkey wifi-in-a-box which makes bad assumptions. It is frustrating, as I won't use a public AP if I can't VPN (but I have unlimited data, so it's not a huge problem for me, at least).

intopieces2• 11 years ago

Cloak is pretty, but my goodness their site is light on technical detail. I can't tell where their servers are located, what protocols they support, who owns the servers. It's so vague and hand-wavy that I'm not sure why I'm supposed to trust them.

jwise0• 11 years ago

I downvoted this, but I'd like to explain why. It's not reasonable to expect people to go and get VPNs of their own unless we, as technologists, make it so completely trivial that it's the default. If you ask the average person whether they need a VPN for public wi-fi, they will give you a blank stare. If we believe that it is something that they need, it's our fault that they don't know about it. And, if we believe that they shouldn't need it, it's our fault for not building secure solutions to begin with.

This is either a failure on our part to educate, or a failure to build secure systems, or a failure to regulate the people who would do these things. But either way, it's our failure -- not a failure of the users.

droopybuns3• 11 years ago

I totally disagree, obviously. :)

At least in this situation, you have a mechanism to opt out if you pick up a VPN and disrupt traffic injection.

Your only solution with companies like google & facebook is not to play.

I agree that it is disappointing that the laymen isn't going to be able to disrupt this traffic injection. We are already so deeply into a privacy dystopia that I think think you're focusing on the wrong fight. Some of the most successful companies have more users than customers. They are using TLS to avoid MITM attacks between the client & their infrastructure, but then harvesting data & injecting traffic till the cows come home.

Arguing for other mechanisms to disrupt carrier traffic injection is in essence an argument for defending the privacy invasive business cases of google & facebook.

mp3geek• 11 years ago

Now blocked in easylist.

https://hg.adblockplus.org/easylist/rev/881423eab157

ChuckMcM• 11 years ago

which is why, by default on my laptop, I use an ssh tunnel with a SOCKS proxy to get to the web. Truly sad, nothing you could do with your phone or tablet though.

Not that I begrudge them trying to get some money out of their "free" service, and I choose not to use such services.

Of course you will then get MITM routers which link to the free WiFi, offer their own free WiFi on a different channel, and then swap the 'customer id' on the ads going through to send them the money. Or something like that. I'm sure there is a RasPi build to do something like this.

zrail• 11 years ago

On phone and tablet you can set up a real VPN, potentially through the same host where you're tunneling.

sigjuice2• 11 years ago

It was relatively straightforward to set up an IPSEC VPN on my Digital Ocean VPS using these instructions https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14... . Also, it worked with the VPN clients built into OS X and iOS.

edwhitesell4• 11 years ago

There are Android Apps that will tunnel via SSH and/or SOCKS. I use some now and again to get around connection "issues" like filtering.

JustSomeNobody6• 11 years ago

On Android, you can root and run SSHTunnel.

Things like this are the reason I strongly feel we should have admin privs on our phones without having to root it.

Animats2• 11 years ago

Does this violate the "exceeds authorized access" provision of the Computer Fraud and Abuse Act? AT&T is not acting as a regulated carrier in this instance, and does not have the immunities of a carrier. Also, their terms of service[1] do not permit them to modify the web pages of others. They can block URLs, ask for a payment, or show an ad at connection time as an alternative to a payment. But they did not disclose that they would modify existing pages.

The requirement for arbitration in the AT&T terms does not apply, because the Computer Fraud and Abuse Act is a criminal law. [2]

[1] http://www.att.com/legal/terms.wiFiServices.html [2] http://apps.americanbar.org/litigation/committees/criminal/a...

georgemcbay2• 11 years ago

IANAL, but I don't see how this sort of thing doesn't count as copyright violation on a massive scale.

The users probably agree to it in a terms of service, but the served websites do not, and AT&T is creating what logically seems like a highly derivative (but altered) copy of their content with their own content inserted without permission of the original copyright owners.

While some amount of data rewriting is inherent in the nature of how the Internet works, modifying the content of web page bodies to insert advertisements just feels like it steps way, way over the lines of that, especially when it can easily present situations where you have ads selling products that would be vehemently opposed by the people whose site it seems to be appearing on to the average user.

threatofrain• 11 years ago

I also think this could affect the image or experience of a company or entity, since people might not know this is ATT's doing. In the examples provided, one might think this was an action of Stanford.

rayiner2• 11 years ago

Yeah, the copyright and trademark issues here make this seem pretty risky.

bpodgursky2• 11 years ago

If you get this declared copyright violation, there will be very solid precedent for banning all adblockers as well.

Animats2• 11 years ago

"The users probably agree to it in a terms of service"

No, they didn't. See the link above to the terms of service.

pavel_lishin• 11 years ago

I've seen this happen on a commercial ISP. I used to work for a web dev firm, and our ISP decided to start injecting ads.

Ads that immediately broke all of our javascript that we were testing on QA sites.

It took us an hour to realize what was going on, and that it wasn't our code that was breaking, and another 30 minutes of angry phone yelling before they backed down and turned that shit off.

r00fus3• 11 years ago

I wonder how AT&T's ad injection will fare with iOS9's content blocking capabilities...

dmitrygr• 11 years ago

Holy shit!

They log pretty much ALL of the traffic too. Not just CAN LOG. They DO LOG.

See http://www.ragapa.com "analytics" tab:

Here are some of the analytics RaGaPa device collect:

Geographical Location

Mac Address/Cookie Tracking

User Agent

User Browser

Destination URL

Ad/Message Impressions

Ad/Message Clicks

User Activity with Time

edwhitesell4• 11 years ago

That's not really "logging", but analytics based on the ads. Any ad software/network worth using is going to do at least the items listed here.

hinkley• 11 years ago

There are a bunch of contract renewals coming up in a couple months (including mine, which I've been on the fence about, and now I have an excuse to switch carriers).

I wonder whose bright idea it was to roll this out now.

bsder• 11 years ago

So, basically https and NoScript will block this.

Well, I guess if websites don't want ads crapping all over their stuff, they'd better get on the stick.

jtokoph• 11 years ago

I'm pretty sure all AT&T iPhones pull carrier configurations that set attwifi hotspots as a trusted auto-joined wifi network.

I reset my iPhone the other day without restoring any backup. Later that day I found my phone connected to attwifi without any instructions from me.

JoshM33k• 11 years ago

A smaller ISP near me (Bright House) does a similar thing with their hotspots. There are no ad injections, but they inject a little popup with their logo, that says something along the lines of "hotspot provided by Bright House networks".

The funny thing is, this network requires you to log in with your Bright House username and password, so anyone seeing that little "provided by" intrusion is already a paying customer.

JustSomeNobody6• 11 years ago

"Next, it injects a backup advertisement, in case a browser doesn’t support JavaScript."

Ha! They do a better job of degradation than most web sites!

laurentoget• 11 years ago

What I do not get is why the airport would allow that sort of things. I can understand that providing wifi is a cost that should be mitigated for someone like McDonalds who is running razor thin margins, but considering the cost of operating an airport trying to monetize wifi will probably never make an impact on your bottom line while annoying your users certainly will. It just seem like a foolish move to me.

What am I missing?

makecheck• 11 years ago

You know, I could stomach inserted ads a lot more if they were honest about doing them; something like "the contents of this box were placed by the owners of the free Wifi network you are using".

The infuriating part is that these ads are typically folded into original content as if the original page had the extra garbage in it. When you see an obnoxious ad, you're not thinking "well I guess I won't use this wifi again"; you think "well I guess I'm not going to this site ever again".

We desperately need a way to strongly sign each part of a page so that it is impossible to display a web site with any third-party content that wasn't explicitly added by the site owner (e.g. such as an authorized "Like" button). This naturally means removing i-frames and all other similar mechanisms from browsers, or at least making them a hell of a lot more obvious.

AT&T Hotspots: Now with Advertising Injection

Related Stories