LinuxQuestions.org - Verizon Broadband: Security threat or just abuse.

Page 1 of 4

Show 50 post(s) from this thread on one page

- Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)

- - Verizon Broadband: Security threat or just abuse. (https://www.linuxquestions.org/questions/linux-networking-3/verizon-broadband-security-threat-or-just-abuse-690596/)

RayJ	12-14-2008 07:45 PM

Verizon Broadband: Security threat or just abuse.

Straight to the point:

Either Verizon has been hacked or they have installed something that should be a security concern.

I have found that following Javascript "injected" into most webpages. I know it is added via a Verizon (wireless broadband) connection because a) it does not happen when I use Embarq DSL, and b) is happens to webpages that I have created (and I certainly did not add the Javascript!). So, here it is:

PHP Code:




*script type="text/javascript"*<!-- 
var FN_IR_el ; 
 
function FN_IR_fix_mht_link(e) 
{ 
  if(!e) 
    e = window.event; 
  var el; 
  el = e.target || e.srcElement; 
  if(el && el.checkMht) 
  { 
    el.checkMht = false; 
    var uri = el.src; 
    if(uri.search(/^mhtml:http:\/\//i) == 0) 
    { 
      var mp = uri.search("!"); 
      if(mp != -1) 
      { 
        el.src = uri.substring(mp+1); 
      } 
    } 
  } 
} 
 
function FN_IR_register_image(bod) 
{ 
  bod.checkMht = true; 
  if(bod.attachEvent) 
  { 
    bod.attachEvent("onmouseover", FN_IR_fix_mht_link); 
    bod.attachEvent("onerror", FN_IR_fix_mht_link); 
  } 
  else if(bod.addEventListener) 
  { 
    bod.addEventListener("mouseover", FN_IR_fix_mht_link, false); 
    bod.addEventListener("error", FN_IR_fix_mht_link, false); 
  } 
  else 
  { 
    var tmp1 = bod.onmouseover; 
    if(tmp1) 
    { 
      bod.onmouseover = function() 
      { 
        tmp1(); 
        FN_IR_fix_mht_link(); 
      }; 
    } 
    else 
    { 
      bod.onmouseover = FN_IR_fix_mht_link 
    } 
  } 
} 
 
function FN_IR_register() 
{ 
  var i; 
  for (i = 0 ; i < document.images.length ; i++) 
  { 
    FN_IR_register_image(document.images[i]) 
  }; 
} 
 
FN_IR_register (); 
 
-->*/script* 
 
NOTE: Asterisks added so that my Privoxy filter would not delete the script!

It seems to be caching things. I noticed this when I was trying to fix a bug in one of my own Javascripts. I was checking the HTML source and saw this foreign code.

Foreign in more ways than one. Sometimes the pages would not fully load and the script would not run. That would leave the links unchanged in the page. So instead of src="/images/image.png" you get src="http://62.0.5.133/www.linuxquestions.orgg/images/image.png" !? I think the Javascript reverts the links after the page loads (to cover up the fact that you just loaded data from Israel)

Notes:
The source URI is always the IP/site domain.orgG/xxx (so .com becomed .comm and .net becomes .nett etc)

IP addresses used: (they resolve to a sever in Israel)

62.0.5.133
62.0.5.134
62.0.5.135
62.0.5.136

Well, that's my story. My concern is that I was able to view some private information (via a backend login) using the modified link, example: http:// 62.0.5.133/www.somedomain.comm/login/myaccount.php!! (this displayed private info!)

I have since installed Privoxy to remove the offending Javascript before it gets actuated by my browser.

I REALLY hope that this is all just a misinterpretation by me. We shall see...

Simon Bridge

12-14-2008 08:13 PM

Well done... though you need to be specific about exactly where you saw this and how. What exactly is the relationship to Verizon?

If this is in your web pages and you did not put it there, then you may have an issue with your hosting provider. If that's you, you have a long talk in the mirror ahead of you ;)

If this is appearing on another's pages, and was not previously there, then the sysadmin will probably appreciate a call.

If you are a customer of a service using these pages, ask Support what that code does. Tell them your concerns.

RayJ	12-14-2008 09:49 PM

Quote:

Originally Posted by Simon Bridge (Post 3375625)

Well done... though you need to be specific about exactly where you saw this and how.

Thanks! On any website/webpage that has the closing body/html tags (</body></html>). If you check the HTML source for Google.com pages, you will notice it is missing the closing body/html tags, and is not effected.

Quote:

Originally Posted by Simon Bridge (Post 3375625)

What exactly is the relationship to Verizon?

I should have been more specific here:

Quote:

Originally Posted by RayJ (Post 3375607)

I know it is added via a Verizon (wireless broadband) connection because a) it does not happen when I use Embarq DSL

It only happens when connected to the internet via my Verizon Wireless Broadband Account. I have had a few friends verify that they do not see the Javascript on the same pages that I am seeing it.

Quote:

Originally Posted by Simon Bridge (Post 3375625)

If this is in your web pages and you did not put it there, then you may have an issue with your hosting provider. If that's you, you have a long talk in the mirror ahead of you ;)

If this is appearing on another's pages, and was not previously there, then the sysadmin will probably appreciate a call.

It happens on EVERY website and EVERY page (not just mine). The fact that this code is on my pages is proof that it is being added somewhere between my browser and the server. (again, it only happens when using the Verizon account). AND, it is happening right now on this very page! My Privoxy filter only removes the script, so I see:

PHP Code:




<script type="text/javascript"><!-- 
// Verizon JS BLOCKED by Privoxy 
 
--></script> 
</body>

That way I can check if it is still happening. :D

Quote:

Originally Posted by Simon Bridge (Post 3375625)

If you are a customer of a service using these pages, ask Support what that code does. Tell them your concerns.

My initial attempt to talk with someone in the IT department (for Verizon) went nowhere. I will try again (after the weekend).

purevw

12-15-2008 06:24 AM

When speaking to Verizon, you should specify that you need to speak with tier 2 support. When you call their help line, you are generally speaking with someone who only knows as much about IT as the monitor in front of him. They will send a message and a real tech should call you back.

thomas.hedden

12-15-2008 07:21 AM

I don't know whether this matters, but I am curious
whether it makes a difference what browser you are
using? Is it the same with all browsers?
Tom

pixellany

12-15-2008 07:54 AM

Quote:

I have found that following Javascript "injected" into most webpages.

None here---tried 4 sites at random

unSpawn

12-15-2008 08:42 AM

I don't know what the OP defines as "wireless" (or if he's actually using GNU/Linux) but a quick search of the 'net shows the IP addresses mentioned in conjunction with mobile access. Indeed something to do with caching of images. If you're forced to auth through an ISP's access point that rewrites content I doubt there's much you can do about it (except vote with your wallet).

LaughingBoy

12-15-2008 04:29 PM

There's always the possibility that his "modem" was tampered with, or there's a wireless hole somewhere. What wireless encryption scheme is being used?

Nitrox

12-15-2008 06:40 PM

Is there a way you could repeat your experiment from another box, using Verizon Wireless?

Chances are, its coming from your rig.

RayJ	12-15-2008 09:09 PM

Quote:

Originally Posted by Nitrox (Post 3376739)

Is there a way you could repeat your experiment from another box, using Verizon Wireless? Chances are, its coming from your rig.

Nope, first thing I thought was the problem. Scanned, checked, tested firewall, checked localhost development websites. All clear! My rig is locked down!

Quote:

Originally Posted by LaughingBoy (Post 3376630)

There's always the possibility that his "modem" was tampered with, or there's a wireless hole somewhere. What wireless encryption scheme is being used?

New USB Pantech UM175VW. Do not know about the "wireless encryption scheme."

Quote:

Originally Posted by unSpawn (Post 3376168)

Ubuntu Linux. Wireless broadband USB modem. Connects to Verizons "broadband" nodes (on cell towers). My modem acually has its own phone number!

Quote:

Originally Posted by thomas.hedden (Post 3376072)

I don't know whether this matters, but I am curious whether it makes a difference what browser you are using? Is it the same with all browsers? Tom

It matters, but no difference. I tested on FF3, Opera, Epiphany, and a hack install of IE6.

Quote:

Originally Posted by purevw (Post 3376011)

Thanks for that! Good to know.

ArcherJanvier

12-16-2008 07:16 PM

Verizon Botch Job

Ray,

I was experiencing the same thing and I found your post here by googling the java function name in the source.

After numerous complaints to Verizon - and working my way up the tech food chain there I finally got an answer about this.

They are evidently beta testing an image compression proxy - something like an AOL - where it give the illusion of increased speed by compressing the images and reserving the webpage with the compressed imagery and the javascript that you posted here. The general tech pool there is not even aware of this project, so they were completely oblivious when I first started complaining about it.

This is supposedly only being tested on a small fraction of their broadband customers. Unfortunately, they don't bother to inform you that your cell/modem number has been routed to this test.

You can request to be removed from this if you are persistant enough with Verizon about it.

Best regards,

Archer

RayJ	12-16-2008 07:51 PM

Quote:

Originally Posted by ArcherJanvier (Post 3377972)

Ray,

I was experiencing the same thing and I found your post here by googling the java function name in the source.

After numerous complaints to Verizon - and working my way up the tech food chain there I finally got an answer about this.

<SNIP>

You can request to be removed from this if you are persistant enough with Verizon about it.

Best regards,

Archer

Thanks for that! I was unable to find anything on Google as well (which is one of the reasons for posting!) You have not only validated my hunch as to what was going on, you saved me the trouble of calling the "circus" known as customer service.

The biggest issue I have with them doing this is that it is not there place to change anything. The ISP has no business altering URLs/URIs for any reason. This is called hacking. Image compression can, and should, be done on the server level. I manage several servers and have compression active via Apache. So how much more compression can they be adding?

Anyway, thanks again!

unixfool

12-17-2008 01:35 PM

Quote:

Originally Posted by RayJ (Post 3377991)

I'd agree with you if it weren't for the fact that you're using a wireless broadband technology. They're looking to optimize performance on a technology that's slow compared to more accepted and more prominent technologies. This is one of the reasons iPhones has the capability to connect to a wireless access point...if you've ever tried to surf the 'net on 3G or Edge, its dog slow (even on a smartphone). I doubt they're the only telecom doing this...and this isn't the first time I've heard of ISPs doing this. AND, you'd be surprised at what companies do behind the scenes with your connections and data.

RayJ	12-17-2008 01:52 PM

Quote:

Originally Posted by unixfool (Post 3378941)

AND, you'd be surprised at what companies do behind the scenes with your connections and data.

Not that surprised! I attempted to use PGP encryption on my email, but getting all none techy friends to work with it was impossible (and the thought I was just paranoid!).

I would like to see all web servers use HTTPS only. And all email servers require PGP (no plain text). That would be ideal.

--RayJ

PS: When I access an HTTPS page, the Verizon "injection" does not occur.

Over50

12-19-2008 04:37 AM

Verizon Broadband

I have had Verizon Broadband wireless for several years, and just this past October ONLY on one of my Dell Latitude computers, did I start experiencing problems with extraeneous code appearing in web downloads. My older laptop runs an older version of their software with Venturi included; while my newer laptop has their most recent software without Venturi. Not sure if this is pertinent.

The problem I am experiencing is what you describe, extra code appears on the web pages downloaded via Verizon Wireless Broadband service. I have used the same computer on public WiFi, and the code downloads correctly. I have wiped out my computer and reloaded the operating system, as in the process of figuring out this problem, Dell told me I had a virus (but NOT so, as the problem persists after starting from scratch).

I am comparing my own web pages I have uploaded to a server. The same pages downloaded via Verizon have the IP address you described earlier inserted, then a lot of garbage code. The garbage code appears all over, if I printed out the code of my website index.html page, the printout from file as I wrote it takes 10 printed pages, but the printout from the downloaded web page takes 14 printed pages...so go figure how much hacker code was inserted!

It has resulted in animated GIF images no longer being animated. A javascript title box pops up referring to delay in uncompressing the image. It has resulted in my e-commerce shopping cart software (web-based on another server) to download incorrectly, and insert more garbage into the data fields (particularly when I put a table into a form data field). It has resulted in the function of the shopping cart backroom to fail, as form buttons are changed to read as "clear" instead of "submit". I mean, it is just frustrating beyond belief.

I have spent hours on this with Verizon. They refuse to work on it. The last "service" agent said that since I had Internet connection, they were unable to assist me.

So now, I am wondering if I should switch to another Air-Card, like go to T-Mobile. Will I run into this same problem?

All times are GMT -5. The time now is 05:37 AM.

Page 1 of 4

Last »

Show 50 post(s) from this thread on one page