Could my ISP be upto something...
Recently, I have began to questions the privacy practices of the ISP I use for my home setup.
The past 2 weeks I have noticed some very strange behavior related to my internet account.
But first a little background...The company I work for requires me to do monthly remote security audits on clients systems, things like vulnerability scanning, IDS evasion, ...ect to make sure everything is working as its supposed to. Particullary in the case of IDS evasions it's very important for me to hide my IP, otherwise the admins on those networks will know when I am auditing them, and the whole process of a secret audit is botched. I use proxy's and address spoofing a lot for these things. I just started an account with this ISP about a month ago, and for the first 2 weeks had no problem forging packets. Then about two weeks ago they begain using egress filtering, which totally stopped my ability to spoof from their network (Although I still can using VPN to another one). At about the same time this happened I began to notice that my anonymous proxy connections where no longer anonymous either! After testing various anonymous proxy's from all over the world (I tried about 50...) I found that the end point still pointed back to my ISP. Although this IP was not my IP, it still pointed back to an address within my ISP's address space. So, I dug a little deeper. I trace routed the path thru my internet connection and found my packets were going thru an additional machine that wasn't there two weeks ago. I decided to ping that address and to my surprise found that my firewall was blocking inbound ICMP requests to my machine in response to my ping (It pointed right back at me!). I checked my IP again to make sure that the ISP hadnt reassigned it to this address. They hadn't, it's the same as it's always been. So I pinged my IP address that winipcfg reports...Nothing happened, no inbound ICMP at all. Anything sent to my ipconfig address never arrives, only packets sent to this virtual address make it to my machine. I know that my ISP has me using a different router/gatway configuration then everyone else on their network.
As far as the proxy thing, this is really strange...Theres really no way to account for an annomous proxy not being anonymous just for my IP is there? Am I correct? The only thing I can think of is that my ISP is stripping the proxy TCP/IP wrapper of my packets, then requesting the data themselves, then sending it to my machine. I'm not really sure just what to do or think just yet. Needless to say I instantly SSL'ed EVERYTHING, stopped using my ISP's DNS, and totally hardened my firewall against my own ISP! So now I bet there really wondering whats up, they have no idea what data or with whom my system is dealing with... For the time being I just want to investigate more into exactly what my ISP is doing with my packets and how they're routing them. I would like to see my packets as they arrive at an anonymous proxy (So if anyone has anon proxy with packet logger that I could send a couple requests too, let me now). Any suggestions on what might be happening? Personally, I think there sensors picked up on some of the non-standard/spoofed traffic I was sending, and they then classified me as a potential hacker, and stuck me on a different segment then everone else where they could monitor my connections and prevent me from interacting with the internal network. Wouldnt this be discrimination? As far as the proxy thing, if there doing what it looks like to me, they are totally invading my privacy. Just for my own satisfaction I wrote a spider that scoured the net looking for email addresses of my ISP's customers and now I have a list of about 4000, If things get really bad I plan on mass mailing everyone and telling them whats going on. I plan on bring this up in person with my ISP when I know exactly whats going on...Any comments?
A wee bit sanctimonious perhaps
"There's always another ISP out there to use though. I pay for my service and as a customer there's various things I expect from them as a business."
Ok, but they have the right to expect a few things from you as well, the core of which is in the AUP, which you seem to feel is only an option. It ain't. You entered into a business relationship with your ISP, a relationship that you both entered into freely and can both exit freely. A relationship with rules which you broke first. Some fairly kind folks here have suggested ways for you to deal with this problem - getting a hold of your ISP to explain the situation, using a work-provided ISP - but these are only workarounds for a problem you created yourself.
"I may be in the wrong...But thats irrelevant"
No, it's not. You have asked for help and if you are wrong it is certainly not our fault if we point that out. After all you asked for the help!
"Please only post if you have suggestions for what my ISP may be doing to make my sessions thru anonymous proxies not anonymous"
Before anyone can deal effectively with the technical issues you are raising you need to deal with the ethical issues about your actions that your question raises.
"The internet was founded on anonimity. "
No, it was not. It was founded to allow government and research universities to communicate on cold war research. It was also designed to withstand atomic warfare and so included protocols to allow a message to be divided into small pieces that could, each, take a unique path to the destination in case of damage to the infrastructure. This design spec eventually led to ways to anonymize communications, but anonimity was not an original design spec of the internet - quite the opposite. The internet was designed to be a secure communications layer that included only known and trusted communicators.
Todd
Re: Could my ISP be upto something...
Quote:
Originally posted here by Neptune0z
[...]
I just started an account with this ISP about a month ago, and for the first 2 weeks had no problem forging packets. Then about two weeks ago they begain using egress filtering, which totally stopped my ability to spoof from their network (Although I still can using VPN to another one).
[...]
If you can VPN out into your work account to conduct your security audits, what is the issue?
Quote:
[...]
I know that my ISP has me using a different router/gatway configuration then everyone else on their network.
Umm, so what?
Quote:
[...]
Personally, I think there sensors picked up on some of the non-standard/spoofed traffic I was sending, and they then classified me as a potential hacker, and stuck me on a different segment then everone else where they could monitor my connections and prevent me from interacting with the internal network. Wouldnt this be discrimination?
Yes, it would be discrimination. Discrimination itself is not a crime you know, it's sensible in a lot of cases. It's when it is misapplied that it becomes an issue. If you can work from your VPN connection, what's the problem?
Quote:
Originally posted here by Neptune0z
There's always another ISP out there to use though. I pay for my service and as a customer there's various things I expect from them as a business. An attempt to tag me so that my
surfing habits are not anonymous is totally unacceptable and I would gladly lose my account to let others know.
News flash, the Internet is a vast PUBLIC network. If I'm a cab driver it's silly to expect me to try and drive you somewhere and still not know where your source and destination points are.
Quote:
The internet was founded on anonimity.
No, it wasn't. It was founded by the U.S. Department of Defense in order to decentralize all their research efforts and make it "nuke proof". The Internet and anonymity have nothing to do with one another really, except that misguided individuals think they somehow are anonymous online.
In short, yes, your ISP probably logged you as a potential threat, and yes, they likely did something with your connection. Contact them about it, explain the situation with references about your company, OR simply drop it and use your VPN connection for all your work.
Quote:
Originally posted here by Cybr1d
Somehow I think that you just downloaded something like Retina or SSS and are screwing around with them....you're using a proxy because you think somehow its gonna trace back to you...You did too many audits in your network so your ISP is getting suspicious and now you're blaming them?
If he can VPN somewhere, the proxies are irrelevant. Who cares what your opinion of the guy is, why not just answer his question?
Quote:
Originally posted here by CybertecOne
When you got really defensive about us not answering your question;
There's a difference between not answering the question and the slew of idiotic assumptions that have been made. If there'd be a whole lot of not answering the post at all, there wouldn't be any "defensiveness" now would there?
Quote:
that set off my defenses and it just seemed to me you really are upto malicious purposes and that you were lying to us. i mean, we are taking exactly the same stace as your ISP, so maybe you really are the one at fault here... sorry but it just looks that way.
Umm, I'll keep that in mind next time I see you ask a question about anything. If it's remotely suspicious I'll break into a similar song and dance about your intentions, because I obviously KNOW, right? Suspicion is good, but don't kid yourself into thinking that's what's going on here. What is going on here is group thinking.
Quote:
Originally posted here by JoeMacDaddy
Most ISPs will not monitor and redirect your traffic unless they are ordered to by law enforcement for the collection of evidence.
Ssshhh, don't tell people here that, you'll get yelled at. ;)
Quote:
Originally posted here by ZomBieMann77
just because you ask a question doesnt entitle you to an automatic answer.
Indeed, however it also shouldn't mean he should be subjected to other people's idiotic namecalling and derision now does it? Another good example of the herd mentality going on here. If you don't like the way he words the questions, don't respond.