To register for an Internet.com membership to receive newsletters and white papers, use the Register button ABOVE.
To participate in the message forums BELOW, click here


EIT Planet's Security News
 Security Vulnerabilities Prove Increasingly Costly
 IPS Market Approaches $1 Billion
 U.S. Named Top Spammer

Security Products
 Family Keylogger (Family Keylogger)
 modusGate (Vircom Inc.)
 Kernel Hotmail MSN Password Recovery (Nucleus Data Recovery)
 Outlook 2003 PST Password Recovery (PST Password Recovery)
 PST Password Remove (PST Password Remove)
 Zemana Anti Keylogger (Vickit, Inc.)


Go Back   Antionline Forums - Maximum Security for a Connected World > Security Discussions > Miscellaneous Security Discussions

Miscellaneous Security Discussions Discuss security issues related to everything else.

Reply
 
Thread Tools Display Modes
Old January 28th, 2007, 12:11 AM   #1
tonybradley
AO Security for Non-Geeks
 
tonybradley's Avatar
 
Join Date: Aug 2002
Posts: 830
tonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond repute
Charter Communications Hijacks Windows Live Search

Does anyone else use Charter Communications as their ISP? I have been using Vista, and the default web search engine Windows Live Search. Yesterday I noticed that my searches were being hijacked by Charter. I played around and found out that this is a new "service" Charter is offering, but it only seems to affect Windows Live Search. If you use Google, or Yahoo, or whatever else as your default search engine it works fine, but Windows Live Search searches are hijacked and redirected unless you Opt Out (granted, I was never provided with a chance to Opt In).

I did a write-up on it on my About.com site, complete with screen shots, for anyone who is interested. http://netsecurity.about.com/od/webb...rterhijack.htm

I am curious though- does anyone know the legality of this? Would a default, no-notice, opt-in program (otherwise known as browser hijacking) be illegal, or just unethical? And, are there any legal implications of the fact that they have apparently singled out Microsoft to hijack, but left the other search engines alone?
__________________
Tony Bradley, CISSP, Microsoft MVP
Follow me on Twitter
Blogs:
The Edge
Evangelyze Communications Security
Unified Communications: Click to Talk
tonybradley is offline   Reply With Quote
Old January 28th, 2007, 12:32 AM   #2
nihil
Super Moderator: GMT Zone
 
nihil's Avatar
 
Join Date: Jul 2003
Location: United Kingdom: Bridlington
Posts: 15,901
nihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond repute
Hi Tony,

Glad to hear that you are alive, and presumably well..........Happy New Year

We get that sort of stuff all the time over here...........if you get your copy of IE via your ISP or e-mail provider, then you get their "version" of it, along with the home page, and a shower of default settings.

My question back to you would be "what is Microsoft's take on all this?" given that they must be licensing these ISPs to distribute a customised version of their software?

It would not be illegal in this country, as your primary contract is with your ISP, rather than MS.

Cheers,

Johnno
__________________
If you cannot do someone any good: don't do them any harm....
As long as you did this to one of these, the least of my little ones............you did it unto Me.
nihil is offline   Reply With Quote
Old January 28th, 2007, 12:40 AM   #3
tonybradley
AO Security for Non-Geeks
 
tonybradley's Avatar
 
Join Date: Aug 2002
Posts: 830
tonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond repute
My IE is *not* from Charter. My IE is the default version that comes with Windows Vista Ultimate. I have never installed *any* software of any kind from my ISP. They are literally intercepting the traffic to Windows Live One search engine and redirecting it.

As I state in my article- I do't have the time or resources to pursue this or to care beyond bitching about it. I will either use Google or accept the cookie I have to have in order to 'opt' out.

However, I do think it is illegal and that it is browser hijacking and not a "feature". I also think that it is ethicaly questionable that they *only* intercept traffic to Microsoft's search engine. I will leave all of that for one of the state attorneys general or Microsoft's legal team to work out though.
__________________
Tony Bradley, CISSP, Microsoft MVP
Follow me on Twitter
Blogs:
The Edge
Evangelyze Communications Security
Unified Communications: Click to Talk

Last edited by tonybradley; January 28th, 2007 at 12:51 AM..
tonybradley is offline   Reply With Quote
Old January 28th, 2007, 12:46 AM   #4
nihil
Super Moderator: GMT Zone
 
nihil's Avatar
 
Join Date: Jul 2003
Location: United Kingdom: Bridlington
Posts: 15,901
nihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond reputenihil has a reputation beyond repute
OK Tony,

Over here that happens as well, although the customised browser is more common.

It would still not be "illegal" though. To stir things up a bit, why don't you ask Microsoft
__________________
If you cannot do someone any good: don't do them any harm....
As long as you did this to one of these, the least of my little ones............you did it unto Me.
nihil is offline   Reply With Quote
Old January 28th, 2007, 01:38 AM   #5
Negative
Banned
 
Join Date: Aug 2001
Location: Yes
Posts: 4,431
Negative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond reputeNegative has a reputation beyond repute
I'm not a lawyer, but there are some interesting paragraphs in Charter's policies

Quote:
http://www.charter.com/Visitors/Policies.aspx?Policy=7

At the time of installation of the Service, Charter may provide Customer with common Charter or third-party software (e.g., a browser and plug-ins) to enable and enhance the Service. Charter does not support third-party software. If Customer has any questions concerning third-party software, Customer should contact the software manufacturer directly.
...

Quote:

In addition, in its sole discretion, Charter may make available to Customer security software, such as anti-virus software, firewall software, “pop-up” advertising blocking software, parental control software, anti-spyware or anti-adware software for Customer’s use on Customer’s computer system(s) in conjunction with the Service.
Note here how in its sole discretion is used in the same sentence as may make available - they may have, at their sole discretion, made that "feature" "available" to you
Negative is offline   Reply With Quote
Old January 28th, 2007, 12:19 PM   #6
tonybradley
AO Security for Non-Geeks
 
tonybradley's Avatar
 
Join Date: Aug 2002
Posts: 830
tonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond repute
Yeah. I knew up front that there was probably some legalese in the AUP or TOS that gave them the right somehow. But, it is still one of those things that may sound like a good idea in the board room, but has more backlash in real life than they anticipated.

Plus, I can't get past the singling out of Microsoft. I think they might legally have a right to redirect my traffic as the customer based on their stated TOS / AUP, but, it would seem to violate some sort of free trade laws or something if they only do it for Microsoft and don't apply their draconian browser hijacking equally to all search engines.

Just my $.02 (USD)
__________________
Tony Bradley, CISSP, Microsoft MVP
Follow me on Twitter
Blogs:
The Edge
Evangelyze Communications Security
Unified Communications: Click to Talk
tonybradley is offline   Reply With Quote
Old January 29th, 2007, 02:44 AM   #7
Ouroboros
Senior Member
 
Ouroboros's Avatar
 
Join Date: Nov 2001
Location: Superior, WI USA
Posts: 628
Ouroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond reputeOuroboros has a reputation beyond repute
I use Charter (5Mbps cable internet) as my ISP and didn't notice anything odd when I tried putting a search term in the addy bar in IE(7). Google is set as the default search engine in my IE, anyway. Normally I use Firefox with the Googlebar extension, so your scenario wouldn't affect me in the day to day, but I still find it disturbing if Charter is indeed rerouting traffic to places where I don't want it going. I don't see anything explicity illegal about it, but certainly unethical.

O
__________________
"entia non sunt multiplicanda praeter necessitatem"

"entities should not be multiplied beyond necessity."

-Occam's Razor

Ouroboros is offline   Reply With Quote
Old February 12th, 2007, 01:22 PM   #8
tonybradley
AO Security for Non-Geeks
 
tonybradley's Avatar
 
Join Date: Aug 2002
Posts: 830
tonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond reputetonybradley has a reputation beyond repute
I did a capture of the network traffic showing the difference between searches done on Google, Yahoo or AOL, and how the search attempts with Windows Live Search are redirected to Charter's branded Yahoo search site. That has been submitted to a Microsoft contact of mine who has forwarded it on to Microsoft's legal team for further investigation. We'll see what, if anything, happens from this point.
__________________
Tony Bradley, CISSP, Microsoft MVP
Follow me on Twitter
Blogs:
The Edge
Evangelyze Communications Security
Unified Communications: Click to Talk
tonybradley is offline   Reply With Quote
Old February 12th, 2007, 01:51 PM   #9
phishphreek
AO übergeek
 
phishphreek's Avatar
 
Join Date: Jan 2002
Posts: 4,321
phishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond reputephishphreek has a reputation beyond repute
Did you check to see if they installed any browser plugin? (run hijackthis)
Or, activex: (Tools, internet options, programs, manage addons)
Does it happen only with the built in search bar?
Does it also happen when you go to http://www.live.com/ and search from there?

Do you get this with both IE and Firefox?

This reminds me of that VeriSign domain wildcard redirect they did a while back. Though, that affected just about everybody...
__________________
Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

Last edited by phishphreek; February 12th, 2007 at 01:56 PM..
phishphreek is offline   Reply With Quote
Old February 13th, 2007, 01:04 AM   #10
HTRegz
Super Moderator
Know-it-All Master Beaver
 
Join Date: Jan 2003
Posts: 3,911
HTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond reputeHTRegz has a reputation beyond repute
There have actually been a few Charter customers who've found my blog post on this subject and have commented with their own information (http://www.computerdefense.org/?p=217)

I've added a comment directing them to this thread.
__________________
IT Blog: .:Computer Defense:.
PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".
HTRegz is offline   Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Forum Jump


All times are GMT +1. The time now is 11:56 AM.












Acceptable Use Policy

Internet.com
The Network for Technology Professionals

Search:

About Internet.com

Legal Notices, Licensing, Permissions, Privacy Policy.
Advertise | Newsletters | E-mail Offers

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.