Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Florence]

Originally Posted by Wildie

great means slower web access more bandwidth used and all for what freaking adverts we all avoid.
we do not want your service of added value it is not from any ISP

That just about sums it up in a nutshell looking at BT tracerts at present seems BT customers are already getting a raw deal they are already batted from piller to post with IP's very close together and all in BT midband range also shoddy work none resolve to any n ames so can't say what they are but a waste of space...

[Rchivist]

I see we have about 57 guests. Welcome aboard and great to see you. Don't panic if it all looks rather technical. I don't understand this stuff either!



If some of you are here after hearing about Phorm/Webwise for the first time, and want to do a bit of reading on the subject, then there are some links here which will get you up to speed quite quickly.

http://www.cableforum.co.uk/board/34...post11849.html

Remember - don't just read- but join in, and make contact with your ISP, your MP, your MEP and all your friends who might be affected if the three current "interested" ISP's, BT, Virgin Media, and TalkTalk, decide to go ahead and implement Phorm/Webwise using DPI technology.

And if you are an MP, or an MEP, (or one of their Lordships - nearly forgot you, which would be very remiss - you've been working the hardest on this!) very pleased to have you aboard - if all you've read so far is the Phorm PR, then there's a lot to learn. Don't get DEphormed, but get INphormed, by the information we can give you.

[gnilddif]

Originally Posted by rryles

Here is my attempt at a layman's guide to traceroute. It omits many details, to the point of being technically incorrect, but hopefully not in a way that matters.
...snipped..

Very helpful. Thanks. Can someone now explain what a proxy does please, and why they are used?

Btw someone on the BT Beta Webwise forum posted the following to The World at One, quoted here with permission. If more did the same, in the context of all the current publicity re ISPs and file-sharing it might help raise awareness of phorm/Webwise:

<B>Comments: Isn't it very hypocritical that whilst major ISPs are prepared to respect and protect the copyright of musicians and record companies, they are proposing to implement a scheme called Webwise devised by a company called Phorm, that has a history of peddling spyware, that will intercept the data that private individuals input in the course of their browsing, a sceme all dressed up to look like an anti-phishing package, but which will in reality engage in multiple browser redirects by stealth, and will compromise the copyright of material that belongs to millions of website owners?</B>

gnilddif

[Kymmy]

a proxy is a system somewhere that'll take your internet requests and issue them to the destination address as though it's thier own requests. They can be anonymous or not. The final destination therefor can only see very limited data about your system and even the IP they see will be the proxy's IP

Kymmy

[Dephormation]

Originally Posted by gnilddif

Very helpful. Thanks. Can someone now explain what a proxy does please, and why it's there?

A proxy handles a request on your behalf.

So your request for a page goes to the proxy. The proxy makes the request on your behalf, and returns the results to you.

Legitimate reasons why you might have a proxy, include security (the proxy is the exposed part of your network), or privacy (the proxy may filter out undesirable content, eg Privoxy), or speed (the proxy may cache content which is often requested).

In the case of a transparent proxy, the proxy is supposedly invisible to you. The proxy actively intercepts your network requests (you don't have the option of setting the proxy details in your browser for example) and applies security/filtering/caching measures.

Phorm used transparent proxies to capture and modify web traffic in their 2006/7 trials. In 2006 they inserted Javascript code into pages, in 2007 they captured pages for profiling.

In late 2006 I complained to Virgin that I had detected network performance characteristics which might suggest transparent proxying was going on (slow web page loading, nothing else affected). Other people complained of the same fault.

At the time Alex Brown explicitly denied that Telewest were using transparent proxies (I've still got a copy of his statements).

Virgin now claim they were using transparent proxies at that time, through til January 2007, but deny they were involved in Phorm trials.

Yet Roman Gaufmans CV mentions that he installed Phorm products in several ISPs.

So I have my own suspicions about what was going on. And it isn't the same as Virgin's, put it that way.

[gnilddif]

Originally Posted by Dephormation

Important to note there are two levels of 'redirection' that might relate to Phorming.

There's redirection at the application (http web) layer - which is what Phorm described to Richard Clayton. You'd see this in your web browsers as an unexpected page load from webwise.net (used to set phorged cookies).

..and that's what S Mainwaring experienced - but with sysip.net - bottom left of the browser window?
gnilddif

[rryles]

One of the reasons for my interest in doing traceroutes that look like http web page requests is that they might highlight a transparent proxy. Such a proxy might decrease the number of hops to a website, because you would actually only be communicating with the proxy so traceroute would never leave your ISP.

[gnilddif]

Thanks Kymmy and Dephormation for your explanations.
g

---------- Post added at 16:20 ---------- Previous post was at 16:13 ----------

Originally Posted by rryles

One of the reasons for my interest in doing traceroutes that look like http web page requests is that they might highlight a transparent proxy. Such a proxy might decrease the number of hops to a website, because you would actually only be communicating with the proxy so traceroute would never leave your ISP.

Is there a program such as Wireshark that does all that tracert does, and records all the routing? I've been trying Wireshark, and recording the logs from time to time, but it doesn't seem to provide all the information that tracert or that more sophisticated version reveals.
gnilddif

[Dephormation]

Originally Posted by rryles

One of the reasons for my interest in doing traceroutes that look like http web page requests is that they might highlight a transparent proxy. Such a proxy might decrease the number of hops to a website, because you would actually only be communicating with the proxy so traceroute would never leave your ISP.

One of the tests I coded up on Dephormation uses a deliberate delay to test the speed of a slow (3 sec) server response. If the response is returned in <3 secs you know that something en route has tried to bluff a reply.

Its a bit rough and ready at present. It depends heavily on client side code (which is always fraught with browser compatibility issues).

Try it without redirection.

Or the exact same test with a deliberate redirection.

[rryles]

Using the same analogies as my trace route explanation:

A proxy opens your letter, reads it, then rewrites it and puts it in a new envelope with the proxies return address. When a reply is sent, it gets sent to the proxy which again opens it, rewrites it and sends it in a new envelope to you.

A normal proxy only opens letters that are actually sent to its address. Similar to using care /off on a letter. It is also honest when it forwards replies to you, that they have come from it. A transparent proxy on the other hand opens letters regardless of where they are addressed to. It also pretends that the reply it is forwarding back to you came direct, when it didn't. The proxies used as part of phorm are even less truthfull than transparent proxies.

Has there been any trace of Webwise or Phorm in any of these traces?

If these redirections are just a "normal" part of internet usage and are not the result of any interfence from Phorm maybe it would help to make this thread a little more accessible if the trace results were only posted that are either known to be or are suspected of relating to Phorm.

It's getting increasingly difficult to find Phorm related material on this thread and general discussions about redirections really ought to be on another thread with just the relevent points being posted here.

If we are seen to be looking for Phorm connections that don't exist we will be accused of desperation - in fact we already have on a number of occasions - and we risk being painted as a bunch of over-zealous nerds if we aren't careful.

[rryles]

Dephormation,

I was aware of your speed trap test. It's certainly a useful weapon in our arsenal and quite a clever way of doing it. I think that the tcptraceroute is potentially a useful investigative tool too though. The "production" version of webwise may have changed significantly since the last trials. They might have got rid of the 307 redirects. (Although they might have added some more )

[vicz]

I think this remains a useful tool in the arsenal, if not foolproof, UW CSE and ICSI Web Integrity Checker http://vancouver.cs.washington.edu/

[rryles]

Peter,

I think there are two prongs to the anti phorm campaign.

One is to inPhorm people (public, politicians and officials).

Another is technical. This includes verifying how the system works, gathering evidence and developing countermeasures. A lot of this is going to be hypothetical at the moment as webwise is not operating. We might as well be prepared though.

I'm going to risk upsetting some people here but please bear with me here. I don't think this thread is the best place to inPhorm people. Discuss methods of inPhorming poeple yes, actually do it no - this is not the best communication channel. Pointing people towards something more static like the inphormation desk is going to be much easier for them to digest.

The traces posted so far have not in my opinion suggested that phorm/webwise is present. (Not with any certainty anyway). However I've not seen anyone post a tcptraceroute result yet. That might show something else.

---------- Post added at 16:59 ---------- Previous post was at 16:54 ----------

Originally Posted by vicz

I think this remains a useful tool in the arsenal, if not foolproof, UW CSE and ICSI Web Integrity Checker http://vancouver.cs.washington.edu/

Yup, useful to have, but not a silver bullet.

[Raistlin]

Originally Posted by Peter N

It's getting increasingly difficult to find Phorm related material on this thread and general discussions about redirections really ought to be on another thread with just the relevent points being posted here.

I'm gonna step in at this point (probably making myself even more unpopular in the process ) and say that I tend to agree. My suggestion would be that the whole technical discussion of tracerouting etc should be held in a different thread to avoid diluting this one and making it impossible to pick out the facts pertinent to the Phorm discussion.

If people then want to go away and spend the next 6 months tracerouting every connection that their systems make until they find something Phorm related then that's fine, and I'll look forward to hearing about it in this thread when there's something conclusive to hear