Ping Spamless - news.admin.net-abuse.email

4 messages - Collapse all

Chris U

View profile

More options Mar 7 2008, 11:35 am

Newsgroups: news.admin.net-abuse.email

From: Chris U <pressedp...@nojunk.blyueyonder.co.uk>

Date: Fri, 07 Mar 2008 16:35:50 GMT

Local: Fri, Mar 7 2008 11:35 am

Subject: Ping Spamless

  Reply to author
  |
  Forward
  | Print
  | Individual message
  | Show original
  | Report this message
  | Find messages by this author
  

Below is a copy of the java script taken from the UK BT Webwise site

http://webwise.bt.com/webwise/index.html

To ths left is the link for turing this on and off the code should be
there, this copy was taken several days ago.

What is your view on this ???

var btwwCookieName = 'webwise_test';
var btwwCookieValue = 1;
var userTypeCookieName = 'userType';
var userTypeCookieDuration = 730; // Days

function webwiseInit() {
checkUserType();

}

function checkUserType() {
var userCookie = readCookie(userTypeCookieName);
if (userCookie == null || userCookie == '') {
setUserType();
}

}

function setUserType() {
var userType;
var ref = document.referrer;
if (ref != null && ref != '') {
var hostname = ref.split('/')[2];

if (hostname.match(/^(.+\.)?bt.com$/)) {
userType = 'BT User';
createCookie(userTypeCookieName, userType,
userTypeCookieDuration);
}
else if (hostname.match(/^(.+\.)?talktalk.co.uk$/) ||
hostname.match(/^(.+\.)?carphonewarehouse.com$/)) {
userType = 'TalkTalk User';
createCookie(userTypeCookieName, userType,
userTypeCookieDuration);
}
else if (hostname.match(/^(.+\.)?virginmedia.com$/)) {
userType = 'Virgin User';
createCookie(userTypeCookieName, userType,
userTypeCookieDuration);
}

/* TEST BLOCK
else if (hostname.match(/^(.+\.)?thelathe.com/)) {
userType = 'TEST User';
createCookie(userTypeCookieName, userType,
userTypeCookieDuration);
}
*/
}

}

function getUserType() {
var userType = readCookie(userTypeCookieName);
if (userType != null) {
return userType;
}
else {
return 'Unknown User';
}

}

function showBTWebwiseStatus() {
/*
if (readCookie(btwwCookieName) != null) {
res = 'BT Webwise is ON';
}
else {
res = 'BT Webwise is OFF';
}
document.write(res);
showBTWebwiseStatusLink();
*/

}

function showBTWebwiseStatusLink() {
/*
if (readCookie(btwwCookieName) != null) {
res = '<a style="font-weight: normal"
href="webwise-off.html">Click here to switch BT Webwise OFF</a>';
}
else {
res = '<a style="font-weight: normal"
href="webwise-on.html">Click here to switch BT Webwise ON</a>';
}
document.write(res);
*/

}

function setBTWebwiseStatus(stat) {

setww = document.getElementById('setwebwise');

if (stat) {
setww.src =
"http://webwise.net/webwise_status/setwebwise.php?opt=in";
setTimeout('setww.src =
"http://a.webwise.net/services/OO?op=in"', 1000);

}
else {
setww.src =
"http://webwise.net/webwise_status/setwebwise.php?opt=out";
setTimeout('setww.src =
"http://a.webwise.net/services/OO?op=out"', 1000);
}

setTimeout('document.location.href="/index.html"', 2000);
return false;
/*
if (stat) {
createCookie(btwwCookieName, btwwCookieValue, 10);
}
else {
eraseCookie(btwwCookieName);
}

window.history.go(-1);
return false;
*/

}

function showVideo(id, file, width, height) {
document.write('<div id="' + id + '"></div>');

var so = new
SWFObject('../../../../../webwise/swf/mediaplayer.swf','mpl',width,
height+20,'8');
so.addParam('allowscriptaccess','always');
so.addParam('allowfullscreen','true');
so.addVariable('height',height+20);
so.addVariable('width',width);
so.addVariable('file',file);
so.addVariable('backcolor','0xFFFFFF');
so.addVariable('bgcolor','#FFFFFF');
so.addVariable('overstretch','fit');
so.addVariable('image',
'../../../../../webwise/images/oix-ctp-video.gif');
so.write(id);

}

function createCookie(name,value,days) {
if (days) {
var date = new Date();
date.setTime(date.getTime()+(days*24*60*60*1000));
var expires = "; expires="+date.toGMTString();
}
else var expires = "";
document.cookie = name+"="+value+expires+"; path=/;
domain=webwise.com";

}

function readCookie(name) {
var nameEQ = name + "=";
var ca = document.cookie.split(';');
for(var i=0;i < ca.length;i++) {
var c = ca[i];
while (c.charAt(0)==' ') c = c.substring(1,c.length);
if (c.indexOf(nameEQ) == 0) return
c.substring(nameEQ.length,c.length);
}
return null;

}

function eraseCookie(name) {
createCookie(name,"",-1);

}

The info below shows the other part of this system oix.com is located
in China, another concern we have.
==========================================================================

The opt-out server is in China.

I'm sure they'll treat any anonymous data with the respect it
deserves.

%dig oix.com

; <<>> DiG 9.3.4-P1 <<>> oix.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59612
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;oix.com. IN A

;; ANSWER SECTION:
oix.com. 172633 IN A 203.93.173.3

;; AUTHORITY SECTION:
oix.com. 172633 IN NS ns1.phorm.com.
oix.com. 172633 IN NS ns2.phorm.com.

;; ADDITIONAL SECTION:
ns1.phorm.com. 172633 IN A 64.246.54.62
ns2.phorm.com. 172633 IN A 66.98.174.16

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Feb 26 00:52:13 2008
;; MSG SIZE rcvd: 115

and a quick visit to http://visualroute.visualware.com/ and we find
that
203.93.173.3 is hosted in China.

Reply to author Forward

Spamless

View profile

More options Mar 7 2008, 2:29 pm

Newsgroups: news.admin.net-abuse.email

From: Spamless <Spaml...@Nil.nil>

Date: 07 Mar 2008 19:29:28 GMT

Local: Fri, Mar 7 2008 2:29 pm

Subject: Re: Ping Spamless

  Reply to author
  |
  Forward
  | Print
  | Individual message
  | Show original
  | Report this message
  | Find messages by this author
  

In response to your:

> Below is a copy of the java script taken from the UK BT Webwise site

> http://webwise.bt.com/webwise/index.html

> To ths left is the link for turing this on and off the code should be
> there, this copy was taken several days ago.

> What is your view on this ???

Much of the code is is commented out, for example,

> function showBTWebwiseStatus() {
> /*
> if (readCookie(btwwCookieName) != null) {
> res = 'BT Webwise is ON';
> }
> else {
> res = 'BT Webwise is OFF';
> }
> document.write(res);
> showBTWebwiseStatusLink();
> */
> }

as is the code in the page http://webwise.bt.com/webwise/index.html

(/*...*/ is a comment section and "// stuff" is a single line comment)

However, the page has an iframe,

iframe src="http://webwise.net/webwise_status/frame.php"

which is the section on the left with the link to turn on webwise
which sends one to http://[referrer]/webwise/webwise-on.html
(getting http://webwise.net/webwise_status/frame.php with no
referrer shows a link
http:///webwise/webwise-on.html
getting it with a referrer of www.junk.com shows a link
http://www.junk.com/webwise/webwise-on.html
getting it with the original URL as referrer shows
http://webwise.bt.com/webwise/webwise-on.html

getting it with the referrer of http://webwise.net/webwise_status/frame.php
(the frame which has the url) shows
http://webwise.net/webwise/webwise-on.html

That last is what I got, but that is due to my browser/proxy setting (I don't like
being tracked by cookies so I have a proxy which forges the source as the referrer)
but you should get a new page, http://webwise.bt.com/webwise/webwise-on.html

Much of the javascript code is commented out and would, if the ORIGINAL
javascript you showed were invoked to turn it on, it would have simply sent
one to http://webwise.bt.com/webwise/webwise-on.html

res = '<a style="font-weight: normal" href="webwise-on.html">Click here to switch BT Webwise ON</a>
document.write(res)

(the commented out function showBTWebwiseStatusLink(){} function)

In any case, one should wind up at http://webwise.bt.com/webwise/webwise-on.html

At http://webwise.bt.com/webwise/webwise-on.html one has a link
to (in the main text) to turn webwise on which loads (in an iframe)
http://webwise.net/webwise_status/setwebwise.php?opt=in
then, a second later
http://a.webwise.net/services/OO?op=in
then redirects the page (not the iframe) back to
http://webwise.bt.com/webwise/index.html
which loads has the iframe
http://webwise.net/webwise_status/frame.php
to show the current (new) status of the setting.

The webwise.net, a.webwise.net opt=in and op=in return empty
(0 length) pages to me and may for bt.com users as well.
They just notify webwise of the option to turn the setting on
and then load the index.html page which loads the webwise status
frame.php which, for me, still says webwise is OFF. Heck, they
can't hijack my (not-BT.com) connection.

It may be that only bt.com customers will get it to work (it may
require a connection going through their system
You don't need to download anything to use BT Webwise
it works in BT's network, so you only need to keep BT Webwise on.
BT Webwise works in BT's network, ...

The http://webwise.bt.com/webwise/help.html page states that
BT Webwise uses cookies stored on your computer to capture your preference.
These cookies are linked to individual computers, user accounts and
browsers. This allows users to choose whether to turn BT Webwise on or off
on their individual computer, user account or browser. This means that
turning BT Webwise on or off on one computer, user account or browser will
not automatically turn it on or off on any others.
so that other users on the same broadband connection are not locked into one
setting but I wonder if that is true for NAT'ted connections (one IP address -
once one is off the local network, all the systems behind the NAT interface
appear to be one).

There have been some news stories of some ISPs apparently hijacking TCP
connections to port 80 (routing them to their own system which proxies the data
from the desired site but modifying it in transit back to the customer so they
can replace google ads, microsoft ads, etc. with their own). They might just
hijack connections to google (to change the ad which would then appear to be
from google but not be) or the connection for the original page and replace the
URL for the ad with another. It does give them the chance to add information to
the pages (warnings about sites) (unless they don't hijack but simply monitor
and one has to keep another window open to bt.com which pops up windows with
the warnings and other ads but that would not give them the ability to replace
ads).

Bt.com only replaces generic material on participating sites:

BT Webwise also replaces generic adverts you see on participating websites
with adverts more relevant to your interests, based on the web sites you
visit and the things for which you search.

Other software, if run on the same computer, can monitor connections locally
but BT says theirs runs totally on their network without software on the
client machine. They might for example, just add a tiny bit of Javascript
at the top of a page from a malicious site to pop up a warning window.

It may be a service to protect their users (and may be quite effective) but they
are not doing it for that reason. They will make money on the targetted ads.

They claim they won't keep personally identifiable data (and had best not as
US laws are quite lax, but other laws are more stringent in protecting users).

Many users are not very computer literate. Even the knowledgeable ones can
get caught. BT.com's "protection" will not be perfect. Their "How it Works"
page gives no technical information on how the service actually works.

What do I think of it? It will protect some users (much as using google to
reach a site by searching for its URL and relying on their warnings instead
of those from BT.com) but ... who designed it? It seems bt.com is taking
credit and responsibility for its design and operation and yet at
webwise.net, webwise.com ...

Webwise is provided by major Internet Service Providers in response to
consumers growing concerns and frustrations with the Internet.

and webwise.net, webwise.com seem to US based (with its lax privacy laws).

> The opt-out server is in China.

> I'm sure they'll treat any anonymous data with the respect it
> deserves.

> %dig oix.com

oix.{com,net}, phorm.com, webwise.{com,net} are all the same, apparently:

Registrant:
Phorm, Inc
264 W 40th Street 16th Floor
New York, New York 10018
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: WEBWISE.COM
Created on: 05-Sep-95
Expires on: 31-Dec-09
Last Updated on: 12-Feb-08

Administrative Contact:
Cote, Chris chris.c...@phorm.com
Phorm, Inc
264 W 40th Street 16th Floor
New York, New York 10018
United States
2123592030 Fax -- 2129380131

Domain servers in listed order:
NS1.PHORM.COM
NS2.PHORM.COM

Registrant:
Phorm, Inc
264 W 40th Street 16th Floor
New York, New York 10018
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: WEBWISE.NET
Created on: 30-Dec-02
Expires on: 30-Dec-09
Last Updated on: 20-Feb-08

Administrative Contact:
Cote, Chris chris.c...@phorm.com
Phorm, Inc
264 W 40th Street 16th Floor
New York, New York 10018
United States
2123592030 Fax --

Domain servers in listed order:
NS1.WEBWISE.NET
NS2.WEBWISE.NET

Registrant:
Phorm, Inc.
264 W. 40th St., 16th Floor
New York, New York 10018
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: PHORM.COM
Created on: 29-Apr-00
Expires on: 29-Apr-09
Last Updated on:

Administrative Contact:
Cote, Chris chris.c...@phorm.com
Phorm, Inc.
264 W. 40th St., 16th Floor
New York, New York 10018
United States
2123592030 Fax --

Domain servers in listed order:
NS1.PHORM.COM
NS2.PHORM.COM

Registrant:
Phorm, Inc.
264 W 40th Street 16th Floor
New York, New York 10018
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: OIX.COM
Created on: 28-Jul-95
Expires on: 27-Jul-11
Last Updated on: 29-Feb-08

Administrative Contact:
Cote, Chris chris.c...@phorm.com
Phorm, Inc.
264 W 40th Street 16th Floor
New York, New York 10018
United States
2123592030 Fax --

Domain servers in listed order:
NS1.OIX.NET
NS2.OIX.NET

Registrant:
Phorm, Inc.
264 W. 40th Street, 16th Floor
New York, New York 10018
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: OIX.NET
Created on: 22-Feb-01
Expires on: 22-Feb-10
Last Updated on: 07-Dec-07

Administrative Contact:
Cote, Chris chris.c...@phorm.com
Phorm, Inc.
264 W. 40th Street, 16th Floor
New York, New York 10018
United States
2123592030 Fax --

Domain servers in listed order:
NS1.OIX.NET
NS2.OIX.NET

- Show quoted text -

...

read more »

Reply to author Forward

Spamless

View profile

More options Mar 7 2008, 2:30 pm

Newsgroups: news.admin.net-abuse.email

From: Spamless <Spaml...@Nil.nil>

Date: 07 Mar 2008 19:30:45 GMT

Local: Fri, Mar 7 2008 2:30 pm

Subject: Re: Ping Spamless

  Reply to author
  |
  Forward
  | Print
  | Individual message
  | Show original
  | Report this message
  | Find messages by this author
  

On 2008-03-07, Chris U <pressedp...@nojunk.blyueyonder.co.uk> wrote:

> Below is a copy of the java script taken from the UK BT Webwise site

There is another thread in nanae about the operation:

Will this be the future for all ISP's

which discusses this.

Reply to author Forward

Chris U

View profile

More options Mar 7 2008, 6:28 pm

Newsgroups: news.admin.net-abuse.email

From: Chris U <pressedp...@nojunk.blyueyonder.co.uk>

Date: Fri, 07 Mar 2008 23:28:03 GMT

Local: Fri, Mar 7 2008 6:28 pm

Subject: Re: Ping Spamless

  Reply to author
  |
  Forward
  | Print
  | Individual message
  | Show original
  | Report this message
  | Find messages by this author
  

On 07 Mar 2008 19:30:45 GMT, Spamless <Spaml...@Nil.nil> wrote:

>On 2008-03-07, Chris U <pressedp...@nojunk.blyueyonder.co.uk> wrote:
>> Below is a copy of the java script taken from the UK BT Webwise site

>There is another thread in nanae about the operation:

> Will this be the future for all ISP's

>which discusses this.

Yes that was me also but I was hoping to catch your attention about
the java script, this all links to this oufit known as Phorm.

Under a previous name they were known for PeopleOnPage,

<quote>
Phorm is run by Kent Ertegrul, a serial entrepreneur whose past
ventures include selling joyrides on Russian fighter jets. Previously,
his most notable foray online was as the founder of PeopleOnPage, an
ad network that operated earlier in the decade and which was
blacklisted as spyware by the likes of Symantec and F-Secure.
<unquote>

Many thanks for you views and descriptions.

Reply to author Forward

End of messages

« Back to Discussions

« Newer topic

Older topic »