[SOLVED] ISP redirects browsing to own advertising site

catkin · 06-21-2010, 12:15 PM

Hello

I'm trying to figure out exactly what BSNL, India's national telecomms utility, is doing to redirect browsing to www.motive.bsnl.co.in, one of its own advertising sites, as discussed in this India Broadband Forum thread.

It is independent of browser, OS and DNS servers. There are reports of it affecting Windows Media Player as well as browsers.

Workarounds include configuring the browser not to allow redirects and configuring dnsmasq with the advertising site as a "bogus-domain".

Here's dnsmasq logging after restarting the ADSL modem and restarting dnsmasq. There is a Firefox lookup for www.thefreedictionary.com which dnsmasq forwards to all the DNS servers it knows about, presumably to determine the fastest. At 21:48:35, an application on the local machine (127.0.0.1) -- presumably Firefox -- asks for resolution of www.motive.bsnl.co.in. Could it be that BSNL is modifying HTTP traffic to cause the redirect?

Code:

Jun 21 21:48:34 CW8 dnsmasq[6713]: query[A] www.thefreedictionary.com from 127.0.0.1
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 61.0.0.5
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 61.1.96.69
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 61.1.96.71
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 61.1.96.72
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.240.23
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.240.135
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.240.180
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.240.181
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.240.208
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.245.1
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.255.139
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.255.145
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 218.248.255.146
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 4.2.2.1
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 4.2.2.2
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 4.2.2.3
Jun 21 21:48:34 CW8 dnsmasq[6713]: forwarded www.thefreedictionary.com to 4.2.2.4
Jun 21 21:48:34 CW8 dnsmasq[6713]: reply www.thefreedictionary.com is 80.82.137.230
Jun 21 21:48:35 CW8 dnsmasq[6713]: query[A] www.motive.bsnl.co.in from 127.0.0.1
Jun 21 21:48:35 CW8 dnsmasq[6713]: forwarded www.motive.bsnl.co.in to 218.248.240.23

How can I best dig deeper? How about

Code:

tcpdump -nnl -i eth0 -s 1536 dst port 80

Best

Charles

fruttenboel · 06-21-2010, 01:17 PM

traceroute? whois? nmap? ping?

john test · 06-21-2010, 06:35 PM

What happens if you hardcode Opendns as your DNS server?

catkin · 06-21-2010, 08:43 PM

Thanks fruttenboel and john test

As per the OP, the phenomenon is independent of DNS server. The log in the OP showed that the local machine itself was resolving the advertising site www.motive.bsnl.co.in -- this is not a case of DNS-level redirection.

I believe the redirection is happening higher in the protocol stack than traceroute and ping.

Regards whois, we know the organisation is BSNL: www.motive.bsnl.co.in

Regards nmap, the details of the www.motive.bsnl.co.in server are irrelevant to why BSNL users are being directed to it.

I dug a little deeper using tcpdump -i eth0 -l -n -s 0 thus showing all packets. It shows the same story in more detail:

A DNS query for www.thefreedictionary.com which is correctly resolved to 80.82.137.230 by one of BSNL's DNS servers, 218.248.240.180.
An HTTP (port 80) conversation between the local machine and www.thefreedictionary.com. This continues for 10 packets when the HTTP conversation switches from www.thefreedictionary.com to ...
An HTTP (port 80) conversation between the local machine and 218.248.240.20, in the BSNL address space (it resolves to mktg.bsnl.in).

This supports the theory that BSNL are redirecting by changing HTTP packets.

I plan to repeat the tcpdump with more verbosity to see what is in the packets from www.thefreedictionary.com a) when the redirect happens and b) when it does not.

EDIT: here's the tcpdump output with the first redirect in red:

Code:

06:37:04.284477 IP 192.168.168.7.32081 > 218.248.240.180.53: 62718+ A? www.thefreedictionary.com. (43)
06:37:04.491354 IP 218.248.240.180.53 > 192.168.168.7.32081: 62718 1/7/7 A 80.82.137.230 (304)
06:37:04.494503 IP 192.168.168.7.57112 > 80.82.137.230.80: Flags [S], seq 604559162, win 5840, options [mss 1460,sackOK,TS val 1667591 ecr 0,nop,wscale 6], length 0
06:37:04.503441 IP 80.82.137.230.80 > 192.168.168.7.57112: Flags [S.], seq 2195543699, ack 604559163, win 16384, options [mss 1400,nop,wscale 0,nop,nop,TS val 198782827 ecr 1667591], length 0
06:37:04.503475 IP 192.168.168.7.57112 > 80.82.137.230.80: Flags [.], ack 1, win 92, options [nop,nop,TS val 1667600 ecr 198782827], length 0
06:37:04.503744 IP 192.168.168.7.57112 > 80.82.137.230.80: Flags [P.], ack 1, win 92, options [nop,nop,TS val 1667600 ecr 198782827], length 371
06:37:04.520678 IP 80.82.137.230.80 > 192.168.168.7.57112: Flags [P.], ack 372, win 16013, options [nop,nop,TS val 198782827 ecr 1667600], length 338
06:37:04.520696 IP 192.168.168.7.57112 > 80.82.137.230.80: Flags [.], ack 339, win 108, options [nop,nop,TS val 1667617 ecr 198782827], length 0
06:37:04.520924 IP 192.168.168.7.57112 > 80.82.137.230.80: Flags [F.], seq 372, ack 339, win 108, options [nop,nop,TS val 1667617 ecr 198782827], length 0
06:37:04.529526 IP 80.82.137.230.80 > 192.168.168.7.57112: Flags [.], ack 373, win 16012, options [nop,nop,TS val 198782827 ecr 1667617], length 0
06:37:05.161017 IP 80.82.137.230.80 > 192.168.168.7.57112: Flags [F.], seq 339, ack 373, win 16012, options [nop,nop,TS val 198782829 ecr 1667617], length 0
06:37:05.161036 IP 192.168.168.7.57112 > 80.82.137.230.80: Flags [.], ack 340, win 108, options [nop,nop,TS val 1668257 ecr 198782829], length 0
06:37:05.573249 IP 192.168.168.7.60271 > 218.248.240.20.80: Flags [S], seq 625951478, win 5840, options [mss 1460,sackOK,TS val 1668669 ecr 0,nop,wscale 6], length 0
06:37:05.575374 IP 192.168.168.7.60272 > 218.248.240.20.80: Flags [S], seq 632200761, win 5840, options [mss 1460,sackOK,TS val 1668672 ecr 0,nop,wscale 6], length 0
06:37:05.576965 IP 192.168.168.7.60273 > 218.248.240.20.80: Flags [S], seq 627323256, win 5840, options [mss 1460,sackOK,TS val 1668673 ecr 0,nop,wscale 6], length 0
06:37:05.578663 IP 192.168.168.7.60274 > 218.248.240.20.80: Flags [S], seq 633091972, win 5840, options [mss 1460,sackOK,TS val 1668675 ecr 0,nop,wscale 6], length 0
06:37:05.580396 IP 192.168.168.7.60275 > 218.248.240.20.80: Flags [S], seq 633777188, win 5840, options [mss 1460,sackOK,TS val 1668677 ecr 0,nop,wscale 6], length 0
[snip continuing port 80 conversation]

catkin · 06-22-2010, 12:55 PM

The technique used is definitely HTTP 1.1 (text/html) packet modification. Wireshark shows that the first HTTP 1.1 (text/html) packet that arrives after the router is restarted is ostensibly from freedictionary.com's IP address but contains HTML to redirect the browser to the advertising page. Here it is (possibly slightly garbled by manual editing out of Wireshark's hex dump translation):

SaHTTP/1.1 200 OK..Content-Length: 216..Connection: close..Cache-Control: no-cache..Expires: -1. .Content-Type: text/html....<html>..<head>..<meta http-equiv="Refresh" content="1; URL=http://www.motive.bsnl.co.in/">..<meta http-equiv="pragma" content="no-cache">..</head>.. <body>..Please wait while you are redirected ... ..</body>..</html>..

catkin · 07-02-2010, 08:34 AM

AFAIK none of the solutions posted on India Broadband Forum so far give the user an uninterrupted browsing experience. At best they block www.motive.bsnl.co.in and the original link has to be opened again.

This is unavoidable for solutions at the IP and name resolution level (browser site blocking, DNS, firewall, hosts file etc.) on either computer or router because BSNL are modifying the first HTTP HTML packet sent.

The only way I can imagine to completely solve this is by examining every HTTP packet and dropping the spoofed one. The browser would time out waiting for it and ask for it again. The second packet would not be altered by BSNL.

In case anyone is interested in the how BSNL are doing this, it may be that they are using the authentication mechanism. When the ADSL link is initiated, traffic is directed to an authentication server for username/password checking. Normally, when that is OK, traffic flows directly into the network. It could be that the authentication servers hold on to the traffic and monitor it for HTTP HTML packets. After finding the first one and changing it, the authentication server could then allow traffic to flow directly into the network in the normal way.

unSpawn · 07-02-2010, 09:17 AM

What happens if you use a caching DNS server like Pdnsd and configure it to only resolve using accessible, "clean" name servers from say above.net, etc (not your .in. TLD and not Google or OpenDNS)?
What happens with a HTTP query (curl, wget) to say http:// www.google.in/ ?q=something+completely+different and https:// www.google.in/ ?q=something+completely+different ? If they differ in result could you attach a packet capture for both?
What happens if you use a HTTP proxy outside of your ISPs domain?

john test · 07-02-2010, 04:32 PM

What sanctions are being initiated for bsnl?

catkin · 07-02-2010, 09:33 PM

Quote:

Originally Posted by unSpawn

What happens if you use a caching DNS server like Pdnsd and configure it to only resolve using accessible, "clean" name servers from say above.net, etc (not your .in. TLD and not Google or OpenDNS)?

The phenomenon is independent of which DNS servers are used. The packet analysis shows that name resolution is working correctly.

Quote:

Originally Posted by unSpawn

What happens with a HTTP query (curl, wget) to say http:// www.google.in/ ?q=something+completely+different and https:// www.google.in/ ?q=something+completely+different ? If they differ in result could you attach a packet capture for both?

Interesting but the outcome is the same for https. The wget output shows that the enquiry of the https: link turns into an HTTP conversation:

Code:

c@CW8:~$ wget --no-check-certificate https://www.google.in/?q=something+completely+different 2>&1 | tee /tmp/wget_s.out
--2010-07-03 07:37:06--  https://www.google.in/?q=something+completely+different
Resolving www.google.in... 209.85.153.104
Connecting to www.google.in|209.85.153.104|:443... connected.
WARNING: cannot verify www.google.in's certificate, issued by `/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.google.com' doesn't match requested host name `www.google.in'.
HTTP request sent, awaiting response... 302 Found
Location: http://www.google.com [following]
--2010-07-03 07:37:07--  http://www.google.com/
Resolving www.google.com... 209.85.153.104
Connecting to www.google.com|209.85.153.104|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 216 [text/html]
Saving to: `index.html'

     0K                                                       100% 21.1M=0s

2010-07-03 07:37:07 (21.1 MB/s) - `index.html' saved [216/216]

c@CW8:~$ cat index.html
<html>
<head>
<meta http-equiv="Refresh" content="1; URL=http://www.motive.bsnl.co.in/">
<meta http-equiv="pragma" content="no-cache">
</head>
<body>
Please wait while you are redirected ...
</body>
</html>

Quote:

Originally Posted by unSpawn

What happens if you use a HTTP proxy outside of your ISPs domain?

It is the same. In more detail ...

I do not use proxies so had better describe what I did to perform this test.

Selected proxythree.info from the list at http://www.proxy4free.com/.
In Firefox: Edit -> Preferences -> Advanced -> Settings
Manual Proxy Configuration: selected
HTTP Proxy: proxythree.info
Port: 80 (guess)
Tested still able to open never-visited sites. OK.
Re-initialised the Internet connection.
Standard test (opened thefreedictionary.com in Firefox). Was redirected.

The last result is consistent with the speculation that BSNL are doing this using the authentication facility so it does not matter where HTTP traffic is directed to, it passes through the authentication server regardless -- and the reply is spoofed.

catkin · 07-02-2010, 09:44 PM

Quote:

Originally Posted by john test

What sanctions are being initiated for bsnl?

Some users have complained to BSNL. Here are a couple of responses reported in the India Broadband Forum thread.

"Dear Sir
This is not any "Wrong direction". But we have implemented the motive application which is very popular in US. This software will be very useful in configuring the modem and for subsequent fault rectification, tracing, email configuration etc... However, it is under testing and we shall provide clear instruction in our portal very soon please. For the time being, it can be ignored and the customers can just type another website please ".

"Secondly, when the net is connected, the motive application (site) open first.
But once you ignore and type any other website, it will never comes again
unless you disconnect the broadband and connect again.
The re-direction is given after passing the authentication stage
and hence the application open only in the beginning.
It will not open again as given in your mail.
The software is being validated online and
though a small portion of customers will have some difficulty,
it is not a major problem and we have not received much
complaints regarding this so far please.
We request you to kindly bear with us for the time being please"