7 ms·

Comcast uses MITM JavaScript injection to serve account related information

219 points by Deinos 10y ago

aftbit 10y ago
Click-bait title. The article itself even says "Comcast is only currently using their javascript injection ability to serve customer account related information". Also, Private Internet Access is far from a disinterested party here. While we should all be outraged that AT&T, Comcast, Verizon and the like are MITMing our HTTP connections, nobody should be surprised at their ability to do so. In this post-privacy world, only strong end-to-end encryption can provide security. Also, don't forget that PIA and other VPNs are just as able to do this as Comcast.
- dvdhnt 10y ago
  "Post-privacy"; a little dramatic don't you think? > The concept of universal individual privacy is a modern construct primarily associated with Western culture, British and North American in particular, and remained virtually unknown in some cultures until recent times. According to some researchers, this concept sets Anglo-American culture apart even from Western European cultures such as French or Italian. Most cultures, however, recognize the ability of individuals to withhold certain parts of their personal information from wider society—closing the door to one's home, for example. > The distinction or overlap between secrecy and privacy is ontologically subtle, which is why the word "privacy" is an example of an untranslatable lexeme, and many languages do not have a specific word for "privacy". https://en.m.wikipedia.org/wiki/Privacy https://en.m.wikipedia.org/wiki/Privacy
  - mindslight 10y ago
    I think it'd be more fitting to call it "post-decency".
helixten 10y ago
Use HTTPS when it is available
- Washuu 10y ago
  Unfortunately when hitting a data limit that causes these Comcast pop ups it breaks HTTPS connections. The only way to regain internet access is to visit a HTTP site such as example.com to get the pop up.
  - ekimekim 10y ago
    I've had this experience too. I complained to the FCC about it, and for my efforts got a likely-cookie-cutter mail response from comcast explaining that they provide these "rare, important messages" "for my own good". edit: to clarify, I was complaining about the fact it broke all my connections, not that it was going on in the first place (which i'm also livid about)
- not_kurt_godel 10y ago
  https://www.eff.org/HTTPS-EVERYWHERE https://www.eff.org/HTTPS-EVERYWHERE is an absolute must-have browser extension for this.
  - xj9 10y ago
    I have this extension and Comcast. I didn't even notice they were injecting things
    - a3n 10y ago
      I don't have that extension, I do have Comcast, and I don't see injected Comcast content. Either uBO or another blocker (belt and suspenders) is blocking that, or they don't do it in my region, or my block, or whatever.
      - striking 10y ago
        They only inject when you're on "xfinitywifi" networks and if you've pirated something and they want to inform you that you've been caught, iirc.
Hondor 10y ago
> ... has access to your browsing history, your search history, your entire internet history ... That's a bit over the top. They'll only have access to data that you already knew lots of people have access to anyway. Not HTTPS sites where they'll only have the domain name. So they won't have your Google search history but will for Bing which bizarrely defaults to HTTP.
- ggggtez 10y ago
  Good guess but you're wrong. They also get meta data like size of page loads Wich is more than enough to find out what Wikipedia entry you are looking at [there's a paper].
  - rishabhparikh 10y ago
    Citation?
    - smallnamespace 10y ago
      https://users.ece.cmu.edu/~vsekar/Teaching/Spring15/18731/papers/webappsidechannel.pdf https://users.ece.cmu.edu/~vsekar/Teaching/Spring15/18731/pa...
Swizec 10y ago
It's really annoying when they inject warnings of the "You downloaded so and so TV show illegally". Comcast, all my p2p traffic is encrypted. How do you know what it is? What're you trying to tell me about the safety of using your pipes for encrypted communication? Switching to https makes the warnings go away. At least there's that. (before anyone gets up in arms, I pay for cable as part of my subscription, I just don't have a TV to plug said cable into and I don't like broadcast TV, so i download)
- BoorishBears 10y ago
  I hear people say their "so and so" traffic is encrypted all the time but that doesn't mean it's not trivial to know what you're doing with it. To me encrypting torrent traffic is like encrypting your SSH connection to a machine where everyone has root access. Your ISP might not know what you're doing on the machine, but another guy SSH'd into it can, and copyright enforcement companies will gladly login to find what you've been up to.
- diminoten 10y ago
  They (the RIAA) have contractors that seed the torrents you've downloaded with permission from the copyright holders to do so. Comcast is forwarding notices given to them by the RIAA.
- karlshea 10y ago
  > Comcast, all my p2p traffic is encrypted. How do you know what it is? 1. You start torrenting (over an encrypted connection) a pirated movie 2. A movie studio is connected to the same swarm, advertising chunks of that movie 3. Your client connects to the movie studio's server, giving them your IP address 4. They send a letter to your ISP Encrypting P2P traffic is pretty much a waste of time. This scenario goes away if you download over a VPN, since the movie studio can't send your ISP the letter.
  - discreditable 10y ago
    Or more simply, most trackers (even private ones) haven't picked up that using HTTPS for announce URLS is a good idea. A passive listener can discover what torrents your client is downloading and seeding if they're interested.
qwertyuiop924 10y ago
If this was another ISP, I might be irritated, or even angry. But I can't work up the effort. I mean, this is Comcast we're talking about. Even by the very low standards of ISPs, they're pretty nasty and generally unpleasant. What did you expect?
- pzxc 10y ago
  Because TimeWarner and Cox are just as bad on customer service, and AT&T/Verizon are losing marketshare fast and may become obsolete. (DSL being behind the curve on bandwidth and fiber not available in 99% of areas) At this point I'm starting to think the best shot we've got is if Tesla swoops in and saves the day with very-low-earth-orbit satellite internet service. Even that's not a guarantee because who knows how they'd operate as an ISP, maybe no better than what we've already got. Add onto that the fact that attempts at net neutrality are being rolled back and we may face the prospect of internet slow lanes, and the picture may be getting very bleak.
  - JoshGlazebrook 10y ago
    ATT is deploying FTTH in some areas where Google Fiber is at. I know here in Austin their 1Gbit fiber is available in quite a number of apartments (including mine). Verizon isn't really expanding FIOS anymore. But overall, ATT and Verizon are selling off their legacy DSL lines and are focusing on fixed "5G" being the next step in home broadband. And then of course both have their wireless subsidiaries where they are pushing people to so they can charge $$$ per GB.
- paulddraper 10y ago
  I have no love for Comcast. But I don't see how Century Link is any better.
- manyxcxi 10y ago
  I love to bag on Comcast/Xfinity as much as the next guy, but, honestly, I would lump all of the cable and DSL companies together at the bottom of a latrine as far as customer service and 'value' go. However, I'd be willing to bet that in most areas Comcast is probably your most reliable and fastest choice- unless you can get fiber, then always do that. I was spoiled in Portland for years with Verizon (then later Frontier) fiber. When I moved to Seattle I was shocked that the best I could do was Comcast. After 5 years with them I had one incident that involved an actually shitty customer experience that was saved by one of the best customer support experiences I've ever gotten anywhere (thanks Joe in Seattle Comcast Tier 3 tech support). I've been using my own modem since before it was cool, so I never got hit by the monthly rate hikes or the 'free wifi' hotspot you can't disable. If I didn't have fiber in my area now I'd begrudgingly get Comcast (if only just for internet) as my next choice.
ams6110 10y ago
I've blacklisted Xfinity WiFi on my phone. Just isn't worth it.
- chadgeidel 10y ago
  Android? I'm having a hard time preventing my iOS devices from connecting. Once connected it seems that it "remembers" even though I've deleted it from both the phone and my Mac. I'm blaming cloud sync.
reilly3000 10y ago
Then that means they are persistently logging everywhere you go on the web.
bexp 10y ago
Article Summary by AI bot http://hntop.org http://hntop.org For years, Comcast and other large telecommunication companies around the world have injected javascript into your web browsing experience to serve advertisements and account notices. While Comcast is only currently using their javascript injection ability to serve customer account related information, the same message sending vector could be used to serve phishing expeditions, or other types of attacks. Not to mention that whoever your ISP is has access to your browsing history, your search history, your entire internet history unless you use a VPN. A long history of Comcast ads via MITM Javascript injections Comcast Xfinity popup The evidence shows that they’ve been doing this since 2014 and earlier. Unwanted man-in-the-middle (MITM) code insertion now happens in Xfinity connected homes, as well – a stark reminder that such an attack vector exists.
- ams6110 10y ago
  I'm not doubting this but I've had Comcast internet for years and have never seen this happen. Perhaps because I don't use their DNS? Or because I use ad blockers (but only for the past couple of years). I supposed I might not have noticed if they were replacing ads, but I've never seen an account pop-up.
  - michaelmrose 10y ago
    I believe the ad injection has to do purely with users of the xfinity wifi feature wherein you as a customer get to connect via other comcast customers wifi enabled routers which provide a paid guest network.
lightlyused 10y ago
WOW does the same thing. Although you can opt-out, they still let you know they are there by hijacking requests to let you know about upcoming service outages. I guess they don't know about email.
spaceribs 10y ago
I made a special javascript for website operators to implement and take advantage of this a while back: https://github.com/spaceribs/unjector https://github.com/spaceribs/unjector
- ianlevesque 10y ago
  Why target just one javascript hack with a counter-hack when you can just use HTTPS and stop any of these shenanigans?
  - spaceribs 10y ago
    I'm not disagreeing, but this modal doesn't disappear until you've actually hit the close button. It will continue to attempt injection at any page which is not encrypted unless you acknowledge it.
unfortunateface 10y ago
Someone should start a campaign similar to wirecutters. ABC - Anyone But Comcast
kevincox 10y ago
Is it just me or is it a GPL license notice that links to the LGPL?
anaganisk 10y ago
In India it's done by Airtel, they apparently outsourced the job to a company from Dubai.
lormayna 10y ago
This is done by dedicated hardware network box that can inspect HTTP with DPI like Allot, Sandvine or Procera. These boxes can inject a custom javascript in the http client page.
jploh 10y ago
The largest ISP here in the Philippines does the same thing. Is this some sort of new feature with carrier grade routers?

219 points by Deinos 10y ago

Click-bait title. The article itself even says "Comcast is only currently using their javascript injection ability to serve customer account related information". Also, Private Internet Access is far from a disinterested party here. While we should all be outraged that AT&T, Comcast, Verizon and the like are MITMing our HTTP connections, nobody should be surprised at their ability to do so. In this post-privacy world, only strong end-to-end encryption can provide security. Also, don't forget that PIA and other VPNs are just as able to do this as Comcast.

dvdhnt 10y ago
"Post-privacy"; a little dramatic don't you think? > The concept of universal individual privacy is a modern construct primarily associated with Western culture, British and North American in particular, and remained virtually unknown in some cultures until recent times. According to some researchers, this concept sets Anglo-American culture apart even from Western European cultures such as French or Italian. Most cultures, however, recognize the ability of individuals to withhold certain parts of their personal information from wider society—closing the door to one's home, for example. > The distinction or overlap between secrecy and privacy is ontologically subtle, which is why the word "privacy" is an example of an untranslatable lexeme, and many languages do not have a specific word for "privacy". https://en.m.wikipedia.org/wiki/Privacy https://en.m.wikipedia.org/wiki/Privacy
- mindslight 10y ago
  I think it'd be more fitting to call it "post-decency".

helixten 10y ago

Use HTTPS when it is available

Washuu 10y ago
Unfortunately when hitting a data limit that causes these Comcast pop ups it breaks HTTPS connections. The only way to regain internet access is to visit a HTTP site such as example.com to get the pop up.
- ekimekim 10y ago
  I've had this experience too. I complained to the FCC about it, and for my efforts got a likely-cookie-cutter mail response from comcast explaining that they provide these "rare, important messages" "for my own good". edit: to clarify, I was complaining about the fact it broke all my connections, not that it was going on in the first place (which i'm also livid about)
not_kurt_godel 10y ago
https://www.eff.org/HTTPS-EVERYWHERE https://www.eff.org/HTTPS-EVERYWHERE is an absolute must-have browser extension for this.
- xj9 10y ago
  I have this extension and Comcast. I didn't even notice they were injecting things
  - a3n 10y ago
    I don't have that extension, I do have Comcast, and I don't see injected Comcast content. Either uBO or another blocker (belt and suspenders) is blocking that, or they don't do it in my region, or my block, or whatever.
    - striking 10y ago
      They only inject when you're on "xfinitywifi" networks and if you've pirated something and they want to inform you that you've been caught, iirc.

Hondor 10y ago

> ... has access to your browsing history, your search history, your entire internet history ... That's a bit over the top. They'll only have access to data that you already knew lots of people have access to anyway. Not HTTPS sites where they'll only have the domain name. So they won't have your Google search history but will for Bing which bizarrely defaults to HTTP.

ggggtez 10y ago
Good guess but you're wrong. They also get meta data like size of page loads Wich is more than enough to find out what Wikipedia entry you are looking at [there's a paper].
- rishabhparikh 10y ago
  Citation?
  - smallnamespace 10y ago
    https://users.ece.cmu.edu/~vsekar/Teaching/Spring15/18731/papers/webappsidechannel.pdf https://users.ece.cmu.edu/~vsekar/Teaching/Spring15/18731/pa...

Swizec 10y ago

It's really annoying when they inject warnings of the "You downloaded so and so TV show illegally". Comcast, all my p2p traffic is encrypted. How do you know what it is? What're you trying to tell me about the safety of using your pipes for encrypted communication? Switching to https makes the warnings go away. At least there's that. (before anyone gets up in arms, I pay for cable as part of my subscription, I just don't have a TV to plug said cable into and I don't like broadcast TV, so i download)

BoorishBears 10y ago
I hear people say their "so and so" traffic is encrypted all the time but that doesn't mean it's not trivial to know what you're doing with it. To me encrypting torrent traffic is like encrypting your SSH connection to a machine where everyone has root access. Your ISP might not know what you're doing on the machine, but another guy SSH'd into it can, and copyright enforcement companies will gladly login to find what you've been up to.
diminoten 10y ago
They (the RIAA) have contractors that seed the torrents you've downloaded with permission from the copyright holders to do so. Comcast is forwarding notices given to them by the RIAA.
karlshea 10y ago
> Comcast, all my p2p traffic is encrypted. How do you know what it is? 1. You start torrenting (over an encrypted connection) a pirated movie 2. A movie studio is connected to the same swarm, advertising chunks of that movie 3. Your client connects to the movie studio's server, giving them your IP address 4. They send a letter to your ISP Encrypting P2P traffic is pretty much a waste of time. This scenario goes away if you download over a VPN, since the movie studio can't send your ISP the letter.
- discreditable 10y ago
  Or more simply, most trackers (even private ones) haven't picked up that using HTTPS for announce URLS is a good idea. A passive listener can discover what torrents your client is downloading and seeding if they're interested.

qwertyuiop924 10y ago

If this was another ISP, I might be irritated, or even angry. But I can't work up the effort. I mean, this is Comcast we're talking about. Even by the very low standards of ISPs, they're pretty nasty and generally unpleasant. What did you expect?

pzxc 10y ago
Because TimeWarner and Cox are just as bad on customer service, and AT&T/Verizon are losing marketshare fast and may become obsolete. (DSL being behind the curve on bandwidth and fiber not available in 99% of areas) At this point I'm starting to think the best shot we've got is if Tesla swoops in and saves the day with very-low-earth-orbit satellite internet service. Even that's not a guarantee because who knows how they'd operate as an ISP, maybe no better than what we've already got. Add onto that the fact that attempts at net neutrality are being rolled back and we may face the prospect of internet slow lanes, and the picture may be getting very bleak.
- JoshGlazebrook 10y ago
  ATT is deploying FTTH in some areas where Google Fiber is at. I know here in Austin their 1Gbit fiber is available in quite a number of apartments (including mine). Verizon isn't really expanding FIOS anymore. But overall, ATT and Verizon are selling off their legacy DSL lines and are focusing on fixed "5G" being the next step in home broadband. And then of course both have their wireless subsidiaries where they are pushing people to so they can charge $$$ per GB.
paulddraper 10y ago
I have no love for Comcast. But I don't see how Century Link is any better.
manyxcxi 10y ago
I love to bag on Comcast/Xfinity as much as the next guy, but, honestly, I would lump all of the cable and DSL companies together at the bottom of a latrine as far as customer service and 'value' go. However, I'd be willing to bet that in most areas Comcast is probably your most reliable and fastest choice- unless you can get fiber, then always do that. I was spoiled in Portland for years with Verizon (then later Frontier) fiber. When I moved to Seattle I was shocked that the best I could do was Comcast. After 5 years with them I had one incident that involved an actually shitty customer experience that was saved by one of the best customer support experiences I've ever gotten anywhere (thanks Joe in Seattle Comcast Tier 3 tech support). I've been using my own modem since before it was cool, so I never got hit by the monthly rate hikes or the 'free wifi' hotspot you can't disable. If I didn't have fiber in my area now I'd begrudgingly get Comcast (if only just for internet) as my next choice.

ams6110 10y ago

I've blacklisted Xfinity WiFi on my phone. Just isn't worth it.

chadgeidel 10y ago
Android? I'm having a hard time preventing my iOS devices from connecting. Once connected it seems that it "remembers" even though I've deleted it from both the phone and my Mac. I'm blaming cloud sync.

reilly3000 10y ago

Then that means they are persistently logging everywhere you go on the web.

bexp 10y ago

Article Summary by AI bot http://hntop.org http://hntop.org For years, Comcast and other large telecommunication companies around the world have injected javascript into your web browsing experience to serve advertisements and account notices. While Comcast is only currently using their javascript injection ability to serve customer account related information, the same message sending vector could be used to serve phishing expeditions, or other types of attacks. Not to mention that whoever your ISP is has access to your browsing history, your search history, your entire internet history unless you use a VPN. A long history of Comcast ads via MITM Javascript injections Comcast Xfinity popup The evidence shows that they’ve been doing this since 2014 and earlier. Unwanted man-in-the-middle (MITM) code insertion now happens in Xfinity connected homes, as well – a stark reminder that such an attack vector exists.

ams6110 10y ago
I'm not doubting this but I've had Comcast internet for years and have never seen this happen. Perhaps because I don't use their DNS? Or because I use ad blockers (but only for the past couple of years). I supposed I might not have noticed if they were replacing ads, but I've never seen an account pop-up.
- michaelmrose 10y ago
  I believe the ad injection has to do purely with users of the xfinity wifi feature wherein you as a customer get to connect via other comcast customers wifi enabled routers which provide a paid guest network.

lightlyused 10y ago

WOW does the same thing. Although you can opt-out, they still let you know they are there by hijacking requests to let you know about upcoming service outages. I guess they don't know about email.

spaceribs 10y ago

I made a special javascript for website operators to implement and take advantage of this a while back: https://github.com/spaceribs/unjector https://github.com/spaceribs/unjector

ianlevesque 10y ago
Why target just one javascript hack with a counter-hack when you can just use HTTPS and stop any of these shenanigans?
- spaceribs 10y ago
  I'm not disagreeing, but this modal doesn't disappear until you've actually hit the close button. It will continue to attempt injection at any page which is not encrypted unless you acknowledge it.

unfortunateface 10y ago

Someone should start a campaign similar to wirecutters. ABC - Anyone But Comcast

kevincox 10y ago

Is it just me or is it a GPL license notice that links to the LGPL?

anaganisk 10y ago

In India it's done by Airtel, they apparently outsourced the job to a company from Dubai.

lormayna 10y ago

This is done by dedicated hardware network box that can inspect HTTP with DPI like Allot, Sandvine or Procera. These boxes can inject a custom javascript in the http client page.

jploh 10y ago

The largest ISP here in the Philippines does the same thing. Is this some sort of new feature with carrier grade routers?