Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some providers will give unlimited traffic for things like Facebook, Twitter, LinkedIn and even YouTube in some rare cases on smartphones. I'm wondering if there's any documented way they identify this traffic. Not for malicious purposes but from an ethical standpoint I'm curious as to how they keep the data at bay. On first glance, I would assume an IP filter and payload size checks but I wonder if anyone has any better theories or resources?

share|improve this question
1  
What vendor is advertising this? –  Billy ONeal Feb 26 '13 at 8:36
    
Isn't "unlimited social networking" just a marketing slogan? The provider targets it at people who use smartphones for social networking and not to, for example write Wikipedia articles. –  Rafael Cichocki Feb 26 '13 at 11:38
    
@BillyONeal A lot of providers down here were providing it for a while. See: mobilesyrup.com/forum/showthread.php?t=8449 Many people are grandfathered into it by now. Most of these providers no longer offer these plans but they are still available to many. –  Vaughan Hilts Feb 26 '13 at 14:41
add comment

2 Answers

up vote 4 down vote accepted

Strictly speaking, the phones are not completely restricted because of IP over Facebook. Whatever the medium, there's always someone to think about transporting raw IP packets in it, and then go ahead and actually implement it.

For the actual restriction, this can be done with IP filtering, or by enforcing an unescapable Web proxy which filters on the URL (preferably a transparent proxy rather than something in the phone software, so that jailbroken phones may not evade the restriction).

share|improve this answer
    
I'm unable to use IP over Facebook (error unauthenticated). Perhaps something is broken for new users of that app –  makerofthings7 Feb 26 '13 at 14:17
    
I am not a Facebook user myself, so I cannot tell. But the concept is amusing. Other past tools have been IP-over-DNS, IP-over-Email, IP-over-ICMP,... –  Thomas Pornin Feb 26 '13 at 14:18
add comment

I would think that a combination of checking DNS queries and IP filters would be the easiest way. The IP addresses for the allowed list of sites should be known. I can't think of any reason they would need anything more advanced.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.