Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[popper]

im trying to work out how best to determine if it is, the best way i think is to ask the Wireshark people on IRC perhaps ?.

im not good with it (mear layman infact), but several wireshark "proxy" plug-in's exist apparently (but the one's i found were pay for add on's) and if anything can help us, Wireshark will probably be the App to use (if we can get some basic step by step training etc).

i assume the WS guys dont like this Phorm/NebuAd any more than we do, so hope they will be more than willing to help in the tech side, and perhaps capture, or even write a new plug-in extension if one doesnt already exist...for Phorm/NebuAd etc as information comes to light.

"DePhormation Pete" carrys a lot of sway alongside many others here, perhaps you can go and ask them to help in real time IRC, or point you in the right direction at least,

here ?
"An IRC channel dedicated to Wireshark can be found at irc://irc.freenode.net/wireshark. "

[isf]

Originally Posted by Dephormation

What I suspect is going on here is this. First the date header indicates the server at Gyron is set to a date in November 2007. If so, that's just an amateurish schoolboy type error.

The date on servers should be set via NTP on a cron job, important that timestamps match when reporting abuse or investigating a system compromise. I wouldn't call it a schoolboy error, I'd call it plain sloppy.

If one of the servers is acting as a proxy, wouldn't it have the mtime from the others HTTP header?

[pseudonym]

Originally Posted by Phormic Acid

I read things like,

Charter Will Monitor Customers’ Web Surfing to Target Ads

Mr. Dykes said that the company also examines other information about users’ computers in order to identify when an I.P. address is changed. But he declined to explain what that information is and how it is used.

And, I thought the best explanation was that an ISP’s DHCP servers would pass on changes of IP address, the other information being the MAC of the modem or similar. If the whole process is bootstrapped using a tracking cookie, then, fundamentally, it’s a cookie tracking system. NebuAd and Mr Dykes are far more opaque than Phorm. I agree that NebuAd are Phorm’s evil twin. Phorm may be wrong, but at least they’re trying. Richard Clayton found them very trying.

My initial thought when I first read stuff like that was that they might be doing something a bit questionable like permanently storing hashes of users cookies for popular sites or even doing the same with email account log-ins, (basically the more obvious techniques available to MITM exploits to passively track multiple users) so I was relieved to read about the use of a master tracking cookie!

I'm still puzzled why the a.faireagle and b.faireagle cookies they set when I've visited the opt-in page are different http://pathogenrush.blogspot.com/200...s-opt-out.html - my best guess was it might be some kind of hash from the IP address and either the time or a counter. Perhaps they don't even use the b subdomain cookies they set. Phorm have "a", "b", and "c" webwise.net subdomains but apparently only use a.webwise.net.

Phorm managed to get a test of PageSense up and running without injecting cookies, by seeding the cookies through an advert delivery system. If, once NebuAd have tied an IP address to a particular cookie, the system is passive, I have to wonder at the need to inject packets at all. Could they not seed cookies through their advert delivery system, as Phorm did? NebuAd’s system will notice any IP address change as soon as one of their adverts is requested.

A user might fo a fair amount of time and do quite an amount of browsing without visiting a site carrying a Nebuad advert - I guess you could track a user if he follows link to other sites by checking for the referal header, but once he enters a URL in address bar you'd no longer be certain if it was the same user, or another user at the same address sharing the connection, or even if the IP address has been freed-up and allocated to another user. This could result in a lot of valuable data either being discarded or allocated to the wrong user. So it would make sense to at least ocassionally inject some code, or use a redirection, or even keep hashes of user's cookies for popular sites.

[phormwatch]

Originally Posted by SelfProtection

What if the problem turns out to be the profiler leaking your data, I believe Phorm has gifted that to the ISP.

So the ISP would be responsible not Phorm?

Don't forget Steve Gibson should be commenting on Phorm & similar technologies tomorrow.

Ooooohh. Where? Where?

[tdadyslexia]

Originally Posted by popper

its pritty useful infact, in effect a hosts file is very much like a phonebook, you want to talk to a website/person you look them up in the Hosts file/phonebook by name.

now your local hosts file, just like your phone book is the very first thing you check, and if you cant find the name there,or dont have one, you use your ISP given DNS server/ring Directory Enquirys.

now instead of always using the ISPs DNS or the DE to find the right No, you make your own local Hosts file/DE that will always be the very first thing your browser uses to lookup and find the No.

for the bad sites, whatever that might be, you dont use the real No. in there, you replace it with a local Ip adress false No instead.

so any time www.badWebsite.com is referenced by any webpage, instead of going to the real webside IP address, it now gets sent to the local IP 127.0.0.1 ,and so cant access any of the content on that bad sites pages ,you are not connecting to it, so it cant send you anything.

as an example of forcing a URL look up to direct to somewere else.

if for instance you have a hosts file with this in it

87.106.129.133 www.cableforum.co.uk

that would work and send your browser to CF, as its the right current IP No.

However if you instead had this IP No. in your hosts file.

91.186.24.166 www.cableforum.co.uk

no matter how many times you tryed it, you would not get to CF but rather www.CableHell.co.uk instead.

the names are the same But the browser now thinks 91.186.24.166 IS CableForum not CH.

just as
127.0.0.1 www.cableforum.co.uk

wouldnt go past the local machine, never mind make it on to your LAN or the wider WAN/ISP

direct IP No.s always override the website name as found in any DNS list, be it the Hosts file or an ISP/3rd party DNS server.

Thank you for your instrukshons I have Killd Ded http://www.webwise.com Yip Eeeeeeeeeee IOU

[Phormic Acid]

Originally Posted by pseudonym

A user might fo a fair amount of time and do quite an amount of browsing without visiting a site carrying a Nebuad advert - I guess you could track a user if he follows link to other sites by checking for the referal header, but once he enters a URL in address bar you'd no longer be certain if it was the same user, or another user at the same address sharing the connection, or even if the IP address has been freed-up and allocated to another user.

I managed to attribute the previous quote to the wrong New York Times blog entry about NebuAd. It should have been:

NebuAd Observes ‘Useful, but Innocuous’ Web Browsing

Mr. Dykes said that the company also examines other information about users’ computers in order to identify when an I.P. address is changed. But he declined to explain what that information is and how it is used.

Dykes also goes on about the benefits of the vagueness inherent in using only IP addresses. That article is dated early in April. It looks like things have moved on. I remember being puzzled by:

Infighting At ISPs Over Using NebuAD

I’m told NebuAD is even able to build profiles of individual people using the same IP address (ex: users behind a NAT device).

While it may have once been an IP address tracker, it certainly looks like a cookie tracker now. As you say, it’s not how often you can read the cookie, but when you read it. You only have to read the cookie when there is no referrer header. You can link up all the subsequent pages, with a high degree of reliability, using only the IP address and later referrer headers. You’ll have a root page and a fairly sparse tree.

I imagine only a handful of such root pages cover a very large proportion of all web browsing graphs.

[Anonymouse]

Originally Posted by BadPhormula

I don't think anyone should worry too much about super computers trying to break crypto systems.

(OT for a bit) Don't worry about it at all, because even if you have a supercomputer, you're not going to break public-key encryption this side of the Sun going nova, at least not until someone proves the Riemann Hypothesis* - and trust me, that ain't gonna happen any time soon because no-one on this planet has the slightest idea as to how to prove it, or even disprove it (it's believed to be true, and mathematicians are praying to God that it is true, because a number of major theorems are based on the assumption that it is!). They can spend as much dosh on it as they like, and waste years of computer time (that's computer-years, not man-years) - the difficulty in breaking encryption is mathematically fundamental.

The only known method of deriving the prime factors is to systematically check all the possibilities, because there is zero correlation between them (that is, neither prime tells you anything about the other) - and there are so many possibilities that the power or speed of the computer is entirely irrelevant. Without a proof of the Riemann Hypothesis, there's no known way to derive a faster method, so there aren't any shortcuts - mathematics doesn't work that way. They really are wasting their time and money; the reason you never hear of public keys being broken is that it simply does not happen. Planting a trojan is cheating and can be prevented in any case by a) decent AV software, b) not using an administrator account so the damn trojan can't install in the first place, and c) being careful - but that is not breaking encryption. I don't know offhand how many 60-digit primes there are, but I recall reading that there are enough to see us through several million years without repeating even once. The computer does not exist that can crack that problem in the time available, i.e. approx. 5,000,000,000 years.

If it could be done, it would have been by now and the news would have been all over the world in less than an hour. Encryption per se is perfectly safe unless some unsung mathematical genius turns up. Bear in mind that it takes over 300 pages of symbolic logic, starting from first principles, just to prove 1 + 1 = 2.


* If you're into recreational mathematics and/or popular science, you've probably heard of it and might even understand it. If not - to borrow from Arthur Dent, don't ask me how it works or I'll start to whimper...

[Deko]

Today @

http://www.independent.co.uk/news/bu...et-851133.html

Phorm to use BT customers to test precision advertising system on net

By Sarah Arnott
Friday, 20 June 2008

The first live trial of the controversial Phorm internet advertising system is expected to start imminently with the participation of up to 10,000 BT broadband customers.

The technology, to be launched by BT as "Webwise", allows sites to run ads based on individuals' surfing history rather than the content of the page being viewed. If successful, its unprecedented precision in tailoring commercial content to its audience could turn the standard advertising model on its head, and open up a new revenue stream for internet service providers (ISPs).

BT's test will confirm the system can cope with large numbers of users and is due to end before the autumn. It will be closely watched by TalkTalk and Virgin, which are both also considering Phorm's potential.

The system works by using ISP data about a customer's movements to build up a profile. It links to an ad exchange that runs two parallel auctions – one between advertisers and one between websites – in order to set the cost of each slot, and the differences between the two prices is the cut taken by Phorm and the ISP.

If successful, Phorm could give the broadband providers a cut of online ad revenues for the first time, just as the industry is caught between downwards pressure on prices and the need for major network upgrades to cope with video services such as the BBC iPlayer.

Francesco Caio, who is conducting the Government's broadband review, has said that ISP-funded "backhaul" is the main bottleneck in infrastructure, and there have been suggestions that content providers should contribute to bandwidth costs. "Phorm's model... brings ISPs into a value chain that didn't exist before," said Nicki Lynas, from PricewaterhouseCoopers.

Phorm could also bring more money into the ad market. By targeting surfers rather than pages, the system enables small sites that lack a broad user base – the fabled "long tail" – to run commercial content. About 60 advertising agencies are interested in signing up.

"Accurate behavioural targeting is worth a fortune because it cuts out the wastage," Nigel Gwilliam, from the Institute of Practitioners of Advertising, said. "Instead of buying 1,000 impressions to find the one you want, you can just buy 10, which leaves the remainder to be sold elsewhere."

Privacy concerns are the biggest hurdle because the system tracks people's movements. Earlier this year critics branded the system "illegal", but the Information Commissioner says that, while developments will be monitored, "there does not appear to be any detriment to users".

Kent Ertugrul, Phorm's chief executive, says all data is held against a randomly generated number, rather than identifying a name or computer address. "We are not tracking everywhere you go or everything you do," he said. "The purpose is not to understand who you are, but only to distinguish one individual from another."

[Dephormation]

Originally Posted by Deko

Today @

http://www.independent.co.uk/news/bu...et-851133.html

There's an absurd statement in that article

"Phorm's model... brings ISPs into a value chain that didn't exist before"

ISPs add little or no value to the transmission of page content from a site to its visitors.

And they impair that value chain by spying on it and corrupting the integrity of it.

This has to be stopped. Absolutely has to be stopped.

[thebarron]

Originally Posted by Deko

Today @

http://www.independent.co.uk/news/bu...et-851133.html

Privacy concerns are the biggest hurdle because the system tracks people's movements. Earlier this year critics branded the system "illegal", but the Information Commissioner says that, while developments will be monitored, "there does not appear to be any detriment to users".

So loss of privacy is not detrimental then.
So loss of trade to none OIX websites is not a detriment then.
So profiling protected none https website areas is not a detriment then.

I could go on - see you all at the protest.

[phpscott]

Everyday it seems that I have reason to bang my head against the keyboard in disgust at the prospect of phorm going live.
Been lurking and reading and informing family, friends and collegues about this. None of them think it is a good idea. Most are not currently on BT but a couple are on Virgin so I have told to keep there ears open, because it could be coming.

I had the same respone from my MP as Hank got a couple of pages ago. Hogwash and twaddle.

I have been trying to keep a low profile in the hope that BT will ask me to particapte in their "official" trail. Have a laptop at home that is clean with nothing on it but the basics waiting to see what kind of fudge BT/phorm try to put in it.
If, and I hope I am, invited to the trail, any and all information will become available to the anti-phorm/dpi community.

Everyone keep up the good work.

As much as I would love to come to London for the demonstration, work will not allow me the time off. If there is anything I can do quitely from work, let me know and I will do my best on the day. Otherwise letters keep going out to the relevant people.

As they say in Canada, phorm, take off eh! you hoosier.
Yes, I am a canuck, but now live in england. Short explanation is wife.

[rryles]

Originally Posted by isf

The date on servers should be set via NTP on a cron job

Actually I think the recommended method these days is using the ntpd daemon in continuous mode. </pedant>

Just having the clock set to the right year would be a start though. Very amateurish and probably a symptom of a rushed job.

---------- Post added at 09:37 ---------- Previous post was at 09:33 ----------

The first live trial of the controversial Phorm internet advertising system is expected to start imminently with the participation of up to 10,000 BT broadband customers.

I don't think much of their editor. Shouldn't that be:

The third live trial of the controversial Phorm internet advertising system is expected to start when BT get enough courage up with the participation of up to 300,000 BT broadband customers.

?

[HamsterWheel]

I see that Alex Hanff, the Anorak in Chief, is suggesting that I have been posting on this site in support of Phorm.
Once again, Alex is incorrect. This is my first post on this forum. But Alex is no stranger to unsubstantiated inaccuracies.

If you want to read more about Alex, try this link for an amusing read :

http://www.consumeractiongroup.co.uk...apitalone.html

[vicz]

Today @

http://www.independent.co.uk/news/bu...et-851133.html

As usual it doesn't make it clear that it is the content that is analysed, not the destinations. Also I see that the Ertugral spin of the day has changed to "We are not tracking everywhere you go or everything you do" - WHICH IS CLEARLY A LIE - rather than the previous more honest boasting that "We can see the whole Internet".

I bet BT customers are pleased to read about the 'imminent' trials first in the press rather than direct from BT.

[Wild Oscar]

Originally Posted by HamsterWheel

I see that Alex Hanff, the Anorak in Chief, is suggesting that I have been posting on this site in support of Phorm.
Once again, Alex is incorrect. This is my first post on this forum. But Alex is no stranger to unsubstantiated inaccuracies.

If you want to read more about Alex, try this link for an amusing read :

http://www.consumeractiongroup.co.uk...apitalone.html

.. and your point is ??