Widespread Hijacking of Search Engine Traffic in US

Users must trust their ISP's DNS servers to correctly return IP addresses that indeed belong to the site the user intends to visit. In some instances, however, this trust may not be warranted.

Earlier this year, two research papers reported the observation of strange phenomena in the Domain Name System (DNS) at several US ISPs. On these ISPs' networks, some or all traffic to major search engines, including Bing, Yahoo! and (sometimes) Google, is being directed to mysterious third party proxies.

RESEARCHERS at the International Computer Science Institute in Berkeley, California, have uncovered a major search traffic hijacking operation instrumented by a dozen US Internet service providers and a company specialising in affiliate marketing revenue generation.

The scheme works by redirecting people's search requests through proxy servers designed and operated by a company called Paxfire. The requests are then passed to affiliate programs run by Commission Junction, the Google Affiliate Network, Linkshare, or Ask.com.

Retailers pay money through these programs to those who direct customers to their business. These affiliates earn a commission for every user who ends up making a purchase or signing up for an offer.

According to Christian Kreibich and Nicholas Weaver, the two researchers who have been monitoring this operation for months, only some particular queries like "apple," "dell," "safeway" or "bloomingdales" are being hijacked.

A user who types any of these words in their web browser's address bar expects to be taken to a search page on their favorite search engine. Instead, they are directly taken to the websites of the corresponding companies that pay Paxfire and the ISP for the traffic.

Some less specific queries are also being hijacked. For example, typing Kindle in the address bar takes users to Amazon's website instead of a search engine page that also has links to Ebay, Wikipedia and reviews web sites. This deprives search engines of traffic and takes freedom of choice away from users.

According to a technical analysis published by the Electronic Frontier Foundation (EFF), some of the major ISPs using Paxfire's redirect services include Cavalier, Cogent, Frontier, Fuse, DirecPC, RCN and Wide Open West.

New Scientist reports that New York based law firms Reese Richman and Milberg have already filed a class action lawsuit against RCN and Paxfire claiming violations of the Federal Wiretap Act's privacy safeguards. It also notes that as of August 2011 all major ISPs involved in the scheme have stopped hijacking traffic destined for Google, but still redirect Bing and Yahoo queries.

The two researchers point out that Paxfire's product contains an optional feature that passes people's entire search traffic through web proxies before directing the requests to the search engines. The purpose of this action is to collect information about what users are searching for and build search profiles.

Google recently announced that millions of computers are infected with a click fraud trojan that redirects search engine traffic through proxy servers run by its creators, in a similar way to Paxfire's patented technology. The company took the unprecedented step of warning affected users through alerts displayed at the top of its search page.

T his tool will tell you if your searches are being hijacked :

Read more...

Your ISP is About to Become the Internet Police

It's not what these companies say they are planning to do, tracking down copyright infringement, it's what they could potentially do; act as "Big Brother". The incestuous relationship that exists between government and big corporations is enough to give us a reason to be concerned.

Mr. Cicconi said that AT&T has been talking to technology companies, and members of the MPAA and RIAA, for the last six months about implementing digital fingerprinting techniques on the network level.

“We are very interested in a technology based solution and we think a network-based solution is the optimal way to approach this,” he said. “We recognize we are not there yet but there are a lot of promising technologies. But we are having an open discussion with a number of content companies, including NBC Universal, to try to explore various technologies that are out there.”

Internet civil rights organizations oppose network-level filtering, arguing that it amounts to Big Brother monitoring of free speech, and that such filtering could block the use of material that may fall under fair-use legal provisions — uses like parody, which enrich our culture.

Rick Cotton, the general counsel of NBC Universal, who has led the company’s fights against companies like YouTube for the last three years, clearly doesn’t have much tolerance for that line of thinking.

“The volume of peer-to-peer traffic online, dominated by copyrighted materials, is overwhelming. That clearly should not be an acceptable, continuing status,” he said. “The question is how we collectively collaborate to address this.”

Read more...