Somebody’s Already Using Verizon’s ID to Track Users

This is so wrong. An ISP is not meant to interject information into a client's request, build profiles of their subscribers, help "provide targeted content," or any such activity. Apparently ISPs are making so little money by providing services they were originally born to provide, they need to go and do totally unwanted activity like this. They're internet service providers, not customer profiling service providers.

It's clear that these companies do not have their customer's best interests at heart, though I'm not sure that they ever have.

ams61103• 12 years ago

Furthermore the notion that the addition of an HTTP header to the request would be a patentable invention is absurd. The protocol explicitly supports it. Nothing was invented here.

hackuser• 12 years ago

They're internet service providers, not customer profiling service providers.

Google is a search engine and application provider, not a customer profiling service provider. Similar things could be said of Facebook, cable/satellite TV, automobiles, retail stores, government agencies. But all are focusing on collecting information and building profiles.

zer0defex2• 12 years ago

Textbook example of escalation. Start with relatively easy to remove cookies. Savvy people clear their caches, the criminals move to automatic localstorage weapons. The savvy people start wearing AdBlock armor and rejoice. The criminals move up to armor piercing injection bullets. The everyday mom and pop don't stand a chance. 1984, yeah right man, orwell is today.

akerl_• 12 years ago

You're aware, of course, that the kind of escalation of force you describe has no connection to the societal changes described in 1984?

zer0defex2• 12 years ago

Yep, I am. I was being facetious. Cheers!

cheezit• 12 years ago

www.runads.com is doing the same for their mobile advertising campaigns.

The ad-tech industry is targeting mobile advertising as the Next Big Thing, and they're right to do so. Anyone not tracking and optimizing ads toward the permacookie will be left behind.

0x0• 12 years ago

Has anyone done any research on how robust their MITMing HTTP handling is?

gnud• 12 years ago

Will the ISPs overwrite this header if already present? If so, isn't that a kind of huge problem? If not, can't someone make a mobile browser that sets these headers to some random value?

gorhill2• 12 years ago

Yes, it will be overwritten. Someone tried it: https://github.com/lightswitch05/Bogus_X-UIDH#update-verizon...

philo23• 12 years ago

What if it had a different case? Eg x-uidh:

I remember for a while the only way to change the User Agent header for iOS UIWebViews was to set the user agent header in lowercase, as long as it's after the actual header, PHP will uppercase both and the later one will win (for $_SERVER atleast, obviously this is PHP specific.)

userbinator3• 12 years ago

If so, isn't that a kind of huge problem?

Make a web service that "coincidentally" uses the same header for something else, or add it as part of a new feature of an existing popular web service. Of course, it should have an app. Tell its users to complain to Verizon when the service breaks for them/the app doesn't work.

atmosx• 12 years ago

Apparently you check your mobile connection here: http://lessonslearned.org/sniff

ams1• 12 years ago

ProPublica reporter/developer here.. There's a tool embedded in the article to see if your carrier is setting a tracking header.

We also published a follow-up about how AT&T has said they will stop using the header: http://www.propublica.org/article/att-stops-using-undeletabl...

analog31• 12 years ago

My provider, TracFone, appears to be sending beacons. This is a low cost pay-as-you-go service that buys airtime from the big carriers. My particular phone uses the Verizon network.

Is there a way to opt out of this?

trvz• 12 years ago

When I've read the first part of the first sentence, "Twitter's mobile advertising arm enables its clients to use a hidden...", I've thought "I'm a client, but never heard of ... oh, nevermind.".

biafra• 12 years ago

It should be possible to counter this by running a proxy somewhere and use that. Privoxy would work for this and while you're at it you can make it remove the ads too.

gorhill2• 12 years ago

Your proxy would need to be after your ISP.

ben1040• 12 years ago

For what it's worth, this article is 2 weeks old and it seems Verizon may have either stopped this or is now respecting opt-outs. I'm curious if others are seeing this.

While I was definitely getting that header added to my outbound traffic two weeks ago, it is not happening to me now. I noticed that a day or two ago, and it still seems to be the case now.

sehugg2• 12 years ago

Nope, they haven't stopped. Reduced a bit, maybe. I'm seeing maybe 5-6% of our HTTP traffic with the X-UIDH header instead of 10% two weeks ago.

AT&T's x-acr header, though, seems to be gone, as others have reported. They were about 0.5% of our traffic.

vonklaus• 12 years ago

How can I check for this?

yclept• 12 years ago

My phone is still sending this stalking header.

joshu• 12 years ago

Just checked, I am still transmitting the X-Uidh header.

gojomo2• 12 years ago

Sometimes the X-UIDH header goes away, but then returns a day or two later – so don't trust any one all-clear check as resolving the issue.

lvs• 12 years ago

For what it's worth, I am no longer seeing the dox header in requests. Something has clearly changed without much fanfare.

mschuster915• 12 years ago

Are you f..ing kidding me? If I pay for Internet access, I demand best-effort of the provider to transfer the data packets unmodified (except, for IPv4, NAT usage), shortest way, to the target IP address.

I do not pay and then want to get tracked so that the provider or some other dickheads can data-mine me and make even more money. If I want this, I can choose a free plan (e.g. unlimited 3G, but with tracking).

About time everyone switches over to HTTPS with HSTS (so that no provider can perform a SSL MITM attack using its own trusted certs).

ams61103• 12 years ago

Yep it's time to just stop using plain HTTP. Unfortunately I think that the number of people who care enough about this to suffer the pain are not enough to change ISP behavior.

mschuster915• 12 years ago

The people who care enough will begin to use VPNs anyway. A pity that enabling VPN on mobile equals massive battery drain :'(

revelation• 12 years ago

I continue to be baffled at this. It seems like we are just all ok with a communications provider manipulating data?

I was expecting the feds to bust their doors in. This is US Postal opening every package and rewrapping it to insert advertisements.

wyager• 12 years ago

This is US Postal opening every package and rewrapping it to insert advertisements.

No, because ISPs aren't common carriers. It's a pretty common political position (among those who care) that ISPs should be common carriers.

ianlevesque• 12 years ago

Sadly the USPS stuffs your mailbox with advertisements now too. There is no opt out and they've actively discontinued working with third party services that would filter your mail for you.

By mail volume the USPS is basically a government subsidized advertising delivery service these days.

wdr1• 12 years ago

I'm not okay with it, but still use Verizon for broadband. I basically have no other choice.

This is why, despite being a big fan of NN, I wonder if it's going to be enough. We need more competition in markets, so when ISPs do chickenfuckery such as this, we can all vote with our feet.

higherpurpose3• 12 years ago

Does IE even support HSTS?

zyx321• 12 years ago

It's planned for IE 12.

https://status.modern.ie/httpstricttransportsecurityhsts?ter...

domdip• 12 years ago

Nobody has agreed to send your traffic the 'shortest way' to the target IP address (despite your demand). They routinely send it whichever way is cheapest for themselves, which leads to hot-potato routing among other things.

Rizz• 12 years ago

I wonder in how many states doing this is an illegal form of tampering with electronic communications. It seems to me interfering with communications would be illegal unless it is necessary for network operations, which advertising trackers obviously are not.

gergles3• 12 years ago

I still don't understand why I appear to be the only Verizon customer on the Internet that doesn't have this header injected. There is nothing special about my account (other than its age, perhaps, I have only been a Verizon customer since the iPhone 6 release,) but it just doesn't show up for me.

colordrops• 12 years ago

Did you enable Do Not Track in your browser settings?

gergles3• 12 years ago

Amusingly, yes, but other people reported doing the same and still seeing the header be sent.

stock_toaster• 12 years ago

Dumb question, but are you actually using the cellular network while you test it, and not accidentally using some associated wifi network?

ohazi• 12 years ago

FWIW, I'm an old Verizon customer (had a grandfathered unlimited plan until about half a year ago), and I also don't see it. Galaxy S4.

Edit: apparently this is old and they may have stopped for the moment?

gojomo2• 12 years ago

Which site are you using to test?

Are you sure you're not using any proxies, VPNs, or local wifi?

I have seen the header disappear for a brief period, only to return a day later. I've seen another user reporting that the header disappeared after they used all web-based opt-outs, and complained by phone... but then reappeared after traveling to a different region.

So there does appear to be some volatility and inconsistency in what Verizon is doing. Also, reportedly, government and some business accounts may be immune.

So keep checking, especially after travel: even if you haven't seen it so far, you might someday.

jrs235• 12 years ago

Are you connected over Wi-Fi instead of Verizon's wireless network?

Update: I turned off Wi-Fi and still didn't find the header. I wonder if business vs personal accounts makes a difference? I'm on a shared business plan.

Update: Perhaps they are identifying identification sites and not tacking it on in those cases? Quite a stretch and tin foil hatish.

Update: Or perhaps someone else on the shared plan already opted out.

cddotdotslash• 12 years ago

I'm not seeing it either. I have a new 2GB data plan through Verizon with a rooted Galaxy S4 and every "test" site I visit doesn't show it. I'm not on WiFi.

guelo3• 12 years ago

Google has proposed a new Internet protocol called SPDY that would prevent these types of header injections – much to the dismay of many telecom companies who are lobbying against it

Wow, I was pretty ambivalent about SPDY/HTTP2 before but now I really hope it catches on.

mschuster915• 12 years ago

Actually a binary format (designed to be machine-friendly) is better for MITM injections as it's easier to parse and manipulate... the only benefit of HTTP2/SPDY is that iirc it requires TLS.

I'm waiting for the first carrier to perform SSL MITM.

guelo3• 12 years ago

HTTP2 doesn't require encryption but it does compress the headers. I'm guessing compression makes it too CPU-intensive for telecoms to manipulate the headers on the fly.

jankassens• 12 years ago

They're already planning it: "Involve the user: Obtain user consent to trust service provider to decrypt select HTTPS"

Quote from someone working for a satellite internet provider for airlines.

Source: http://www.atis.org/openweballiance/docs/OWAKickoffSlides051... page 27

girvo2• 12 years ago

I'm waiting for the first carrier to perform SSL MITM.

Nokia, funnily enough, did this on certain dumbphone models. Not a carrier, I know, but still interesting.

http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/

higherpurpose3• 12 years ago

the only benefit of HTTP2/SPDY is that iirc it requires TLS.

Yeah...except the NSA-agent-hiring IETF [1] gave up on that at the last minute.

http://arstechnica.com/security/2014/01/nsa-employee-will-co...

tedunangst2• 12 years ago

telecom companies are actually lobbying against spdy?

softdev12• 12 years ago

they are lobbying because they see anything Google proposes as a direct long term threat to their business model.

guelo3• 12 years ago

This is the anti-SPDY lobbying alliance, http://www.atis.org/openweballiance/index.asp

They seem to be deathly afraid of becoming "dumb pipes".

bcl3• 12 years ago

A solution to this is to setup openvpn on a VM someplace and route all your phone's data traffic through that. I've done this using the Fedora open vpn guide (https://fedoraproject.org/wiki/Openvpn). To get it working on the iPhone I also had to add this to the server config:

push "redirect-gateway" push "dhcp-option DNS 8.8.8.8"

packetslave• 12 years ago

The problem with doing this is that now all your web traffic is associated with the IP of the VM, which is presumably even easier to track back to you.

You'd have to do something exceedingly clever like have the VM automatically route VPN traffic into Tor.

bcl3• 12 years ago

Well, it depends on your goal. In this case it is to avoid Verizon adding stuff to my http traffic.

phkahler• 12 years ago

Another argument for Net Neutrality. Just pass the data through please.

r0m4n0• 12 years ago

Verizon has been pushing their "Smart Rewards" program on me for months (http://www.verizonwireless.com/wcms/myverizon/smart-rewards....). After reading the fine print, you are actually consenting to monitoring of all traffic through your account that will be shared to third parties. I respect the fact they have some sort of opt in that has some return... Inho they are swindling the typical oblivious consumer trolling for a free Jamba Juice gift card

userbinator3• 12 years ago

It's a little amusing and rather sad that the word "smart" now seems to be used to describe products and services that act against their users and often perform surveillance on them, implying that it's somehow a "smart" thing to let this happen.

gallerytungsten• 12 years ago

It appears that there is a huge business opportunity for someone to find a way to defeat this type of tracking. Of course, it would probably need to be a subscription type of service, which bodes well for steady recurring revenue.

MichaelGG4• 12 years ago

Just add some mobile-specific marketing to a VPN service.

MichaelGG4• 12 years ago

"took steps to secure these Device IDs, and began allowing their users to delete them, in the same way they could delete cookies in their desktop Web browser."

That's a joke. Android's permission model encourages users to freely give out their device serial number. The permission to read device ID is hidden behind the permission that allows an app to determine if you're on a call. A totally innocuous permission (which should not be a permission) smuggles in a very intrusive one.

Oh, and for a kicker, device ID permission also gives apps access to the number of who you call or calls you. So even security conscious users that check permissions can easily get tricked. "Sure, I want this flashlight app to turn off if I get a call so I don't blind myself trying to answer" - bam, you just gave away your permanent ID and call logs.

This could be a negligent incompetent mistake on Google's part, but it seems unlikely because it's so nonsensical and they've done nothing to rectify it in years.

higherpurpose3• 12 years ago

I'm also starting to believe that Android's extremely vague permissions are not that vague because of their engineers' incompetence, but because it was done this way on purpose.

Google promised at I/O that a permission system with more fine-grain control would come in Lollipop, but it's still nowhere to be seen.

userbinator3• 12 years ago

Agree with this, especially after their fine-grain control App Ops, which received a very positive response, was completely removed, and the reason they gave for doing so quite nonsensical: "it can break apps" - obviously, that's why people want to use it - to prevent apps from "breaking" their personal privacy.

(My Android's ID/serial number is 0123456789ABCDEF, the same as tens of millions others out there, so I'm not so worried about it. One of the perks of owning an unbranded generic Chinese device, along with a new random MAC address whenever I reset the WiFi...)

tomphoolery• 12 years ago

I suppose...but couldn't they just track you by IP address anyway?

atesti• 12 years ago

It would be possible for Verizon to implement this really bad system without anybody noticing and even if Speedy/HTTP 2 or HTTPS is used:

Currently they inject the header with an ID which changes e.g. daily and charge third parties to associate the ID with a profile. They can only inject in HTTP.

If instead the third party (e.g. an adserver) contacts a Verizon server with the IP (and port number in case of carrier grade NAT) on every request and that server gives back the profile and Verizon charges the adserver for this, then nobody would ever know and there would be not much protection against it (without a third party proxy or vpn to hide the IP).

Somebody’s Already Using Verizon’s ID to Track Users

Related Stories