4 ms·

How do we suspect AT&T are able to determine when a device is being used to tether?

by stanleydrew 16y ago

gte910h 16y ago
I'm guessing web browsing on browsers that are clearly PC/Mac desktop versions.
- stanleydrew 16y ago
  So you think they are parsing user agent strings out of HTTP requests? Seems unlikely.
  - gte910h 16y ago
    Just periodically run a log scanner for requests for SWFs, etc. Lots of simple non-constant log scans will reveal this information.
    - vlisivka 16y ago
      I will use VPN or HTTPS proxy and will sue you if you will use that information for non-technical purposes.
      - gte910h 16y ago
        If you're using a VPN, that ALSO is a dead giveaway protocol wise. Good luck suing them. They offer tethering for a price, you're not paying it. I think the chance you'll get away with invasion of privacy on something that they technically should only see from flagged account is about 0.
  - deleted 16y ago
    [deleted]
  - barrkel 16y ago
    Most mobile web access systems run through an explicit or transparent web proxy to downgrade image quality (=> reduce size) at least. Filtering on user agent would be trivial, though easy to work around.
orev 16y ago
I'd watch for a spike in bandwidth use and connections to Windows or Apple update servers -- at least to start hunting down suspects.
- TylerBrock 16y ago
  They just Keep track of max simultaneous connections. 100+? Computer.
Dobbs 16y ago
On the reddit thread there is speculation that they are observing the TTL of the packets. All iphones will send them out with the value of 'x'. When packets start leaving with 'x-1' then the person is obviously tethering.
pak 16y ago
One reddit user suspects that they are looking for TTL's on packets that do not match what iOS uses. I would love for somebody more knowledgeable about TCP/IP on HN to evaluate the likelihood of this... http://www.reddit.com/r/technology/comments/g62wv/i_woke_up_this_morning_to_this_lovely_email_from/c1l6ixe http://www.reddit.com/r/technology/comments/g62wv/i_woke_up_... If this is the case, user agent spoofing will not work, and it would be quite a bit of hackery to trick iOS' IP stack into spoofing TTL's for packets from tethered devices.
- signa11 16y ago
  hmm, apart from ttl, you can use other tcp fields e.g. windows, tcp-options, packet-length etc. then, from a captured trace run passive os fingerprinting to find out with reasonable certainty the device generating the traffic. these can/may be manipulated via ip-tables, but then you still have a huge data-volume to account for...
  - bostonvaulter2 16y ago
    Not to mention things like adobe checking for updates
  - drdaeman 16y ago
    Can iPhone just route all your traffic through some encrypted VPN? I've heard there's a port of OpenVPN for iOS — that should be sufficient. At least you'll be sure telco guys are not inspecting your packets by any means, be it "teethering detection", blocking some kind of traffic, or something more malicious, like profiling your Google searches. (Timing analysis may still apply.)
  - vlisivka 16y ago
    Yeah, it is trivial to analyze traffic of somebody else when you are working in FBI with court order...
- drdaeman 16y ago
  > [from Reddit link]> well there's no way you can set it to 256. With GNU/Linux iptables it's just one rule in the "mangle" table with TTL target. On *BSD with pf "packet normalization" can be done with pf's "scrub" directive with min-ttl option. Unfortunately, I've never used iOS and/or OS X/Darwin, so I don't know what are possibilities are there. But I believe there should be some.
deleted 16y ago
[deleted]
A1kmm 16y ago
Just to brainstorm a few possibilities for people to rule out: * They don't know, and the SMS / e-mail went to everyone using more than a certain amount of bandwidth. * They sniff HTTP User-Agent: headers, Accept: headers, or similar. * They look at the TTL and other IP header fields to see if they are as expected for iOS. * They fingerprint TCP window size behaviour to see if it looks like traffic is coming from the iOS TCP stack. * They inject Javascript into occasional HTTP responses to query the navigator object and screen.height, screen.width, send it back, and sniff for the response, or have a deal with some sites to include the Javascript for them. If the screen size is too big, it triggers the tethering detector. So there are lots of possibilities - and they could combine more than one of the above.
baddox 16y ago
I would guess they're only looking at bandwidth usage. For one thing, that would be the easiest (and least creepy) thing for them to monitor. Additionally, it should be the only thing they really care about regarding tethering (why should they care if you're using the same bandwidth as a non-tetherer?).
- unwind 16y ago
  "Should" is, I guess, depending on your perspective here. As a bandwidth user (=carrier customer), I don't think it should matter. As a bandwidth provider (=carrier), I would probably think that different use cases provide different levels of value to the customer, and thus can motivate different prices. You might argue that bandwidth to a computer is "more worth" than bandwidth to a smart phone, since the computer has more power do to things with that bandwidth. That also means that, to a first approximation, customers can just plain use more bandwidth from a computer, which of course also makes it interesting to charge more for the ability to do that. And so on.
rbxbx 16y ago
From the comments in the original thread: "I helped my boss through this one... I had him call AT&T and explain that he received a message about something called "tethering" and to act dumb and explain that he is a heavy pandora and Netflix user and doesn't understand why he's going to be billed more for it. _Bottom line they couldn't prove it so they apologized and removed issue from his account with no changes._ Good luck to everyone. (my boss was on 4.2.1 and he is using about 25gb per month) AT&T is hoping people will either ignore the message or call to apologize (Don't act guilty and you'll be fine)"
deleted 16y ago
[deleted]

How do we suspect AT&T are able to determine when a device is being used to tether?

gte910h 16y ago

I'm guessing web browsing on browsers that are clearly PC/Mac desktop versions.

stanleydrew 16y ago
So you think they are parsing user agent strings out of HTTP requests? Seems unlikely.
- gte910h 16y ago
  Just periodically run a log scanner for requests for SWFs, etc. Lots of simple non-constant log scans will reveal this information.
  - vlisivka 16y ago
    I will use VPN or HTTPS proxy and will sue you if you will use that information for non-technical purposes.
    - gte910h 16y ago
      If you're using a VPN, that ALSO is a dead giveaway protocol wise. Good luck suing them. They offer tethering for a price, you're not paying it. I think the chance you'll get away with invasion of privacy on something that they technically should only see from flagged account is about 0.
- deleted 16y ago
  [deleted]
- barrkel 16y ago
  Most mobile web access systems run through an explicit or transparent web proxy to downgrade image quality (=> reduce size) at least. Filtering on user agent would be trivial, though easy to work around.

orev 16y ago

I'd watch for a spike in bandwidth use and connections to Windows or Apple update servers -- at least to start hunting down suspects.

TylerBrock 16y ago
They just Keep track of max simultaneous connections. 100+? Computer.

Dobbs 16y ago

On the reddit thread there is speculation that they are observing the TTL of the packets. All iphones will send them out with the value of 'x'. When packets start leaving with 'x-1' then the person is obviously tethering.

pak 16y ago

One reddit user suspects that they are looking for TTL's on packets that do not match what iOS uses. I would love for somebody more knowledgeable about TCP/IP on HN to evaluate the likelihood of this... http://www.reddit.com/r/technology/comments/g62wv/i_woke_up_this_morning_to_this_lovely_email_from/c1l6ixe http://www.reddit.com/r/technology/comments/g62wv/i_woke_up_... If this is the case, user agent spoofing will not work, and it would be quite a bit of hackery to trick iOS' IP stack into spoofing TTL's for packets from tethered devices.

signa11 16y ago
hmm, apart from ttl, you can use other tcp fields e.g. windows, tcp-options, packet-length etc. then, from a captured trace run passive os fingerprinting to find out with reasonable certainty the device generating the traffic. these can/may be manipulated via ip-tables, but then you still have a huge data-volume to account for...
- bostonvaulter2 16y ago
  Not to mention things like adobe checking for updates
- drdaeman 16y ago
  Can iPhone just route all your traffic through some encrypted VPN? I've heard there's a port of OpenVPN for iOS — that should be sufficient. At least you'll be sure telco guys are not inspecting your packets by any means, be it "teethering detection", blocking some kind of traffic, or something more malicious, like profiling your Google searches. (Timing analysis may still apply.)
- vlisivka 16y ago
  Yeah, it is trivial to analyze traffic of somebody else when you are working in FBI with court order...
drdaeman 16y ago
> [from Reddit link]> well there's no way you can set it to 256. With GNU/Linux iptables it's just one rule in the "mangle" table with TTL target. On *BSD with pf "packet normalization" can be done with pf's "scrub" directive with min-ttl option. Unfortunately, I've never used iOS and/or OS X/Darwin, so I don't know what are possibilities are there. But I believe there should be some.

deleted 16y ago

[deleted]

A1kmm 16y ago

Just to brainstorm a few possibilities for people to rule out: * They don't know, and the SMS / e-mail went to everyone using more than a certain amount of bandwidth. * They sniff HTTP User-Agent: headers, Accept: headers, or similar. * They look at the TTL and other IP header fields to see if they are as expected for iOS. * They fingerprint TCP window size behaviour to see if it looks like traffic is coming from the iOS TCP stack. * They inject Javascript into occasional HTTP responses to query the navigator object and screen.height, screen.width, send it back, and sniff for the response, or have a deal with some sites to include the Javascript for them. If the screen size is too big, it triggers the tethering detector. So there are lots of possibilities - and they could combine more than one of the above.

baddox 16y ago

I would guess they're only looking at bandwidth usage. For one thing, that would be the easiest (and least creepy) thing for them to monitor. Additionally, it should be the only thing they really care about regarding tethering (why should they care if you're using the same bandwidth as a non-tetherer?).

unwind 16y ago
"Should" is, I guess, depending on your perspective here. As a bandwidth user (=carrier customer), I don't think it should matter. As a bandwidth provider (=carrier), I would probably think that different use cases provide different levels of value to the customer, and thus can motivate different prices. You might argue that bandwidth to a computer is "more worth" than bandwidth to a smart phone, since the computer has more power do to things with that bandwidth. That also means that, to a first approximation, customers can just plain use more bandwidth from a computer, which of course also makes it interesting to charge more for the ability to do that. And so on.

rbxbx 16y ago

From the comments in the original thread: "I helped my boss through this one... I had him call AT&T and explain that he received a message about something called "tethering" and to act dumb and explain that he is a heavy pandora and Netflix user and doesn't understand why he's going to be billed more for it. _Bottom line they couldn't prove it so they apologized and removed issue from his account with no changes._ Good luck to everyone. (my boss was on 4.2.1 and he is using about 25gb per month) AT&T is hoping people will either ignore the message or call to apologize (Don't act guilty and you'll be fine)"

deleted 16y ago

[deleted]