10

Here's the code at the bottom of every page:

<script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = Math.floor(Math.random()*99999999999);document.write("<scr"+"ipt type=text/javascript src="+idc_glo_url+ "cfs.u-ad.info/cfspushadsv2/request");document.write("?id=1");document.write("&amp;enc=telkom2");document.write("&amp;params=" + "4TtHaUQnUEiP6K%2fc5C582NgXaqsgjSGNd2cIJOj4fGdzujsIEimxj4UPJYe9kNVgJGL7lyzhXKfrFGnoI%2b0vRYDgH9e8pX4n5Ajpp2c31FAwDlsLBVPPzlithe%2b39AiTY5lcCtK5vmMReu6wh%2bDE9aF7GU5vhghexF8DVA5RGi1nSH%2b4LUQNJ2rgvBZQRGaRUEas7vndUsAU7ZB2kVVd21uWsDGzo5RfMV2LGQF5uvtQQLl0Ism%2f7TwrUdQb5rPOdOsuSNgCzf7cTnxOizeAF5TqCrR5TPbRFuCEbu1j0vYkDTFuj9EdyZbRxAaO9KaZ1VpIEUKC3XEDAXKf0X3XDCyG3gvQoMWun2ueK8dLkFXlxSf9N4HI19gTZgGjR6Yc6QWGdE220AehWZepv%2bai9rUvHBo8xGo5pesp2qLykCKOPvJaq0IlaAunmzO0iLn9hkvy%2bl3BA8crhs3KdFymg9sCqjZ016F5XxGxpvEP64Se5R%2fSVPWjmyrXRo0Hj%2fR5W2wmR5oVAqGo6XAIYvQPj%2fay6rRypz%2fdDgohPBqd3g9wGYkzKmh9CjDSiozL4BrH2xmRhjAwbe9WTBc%2f45LdcqT4sjgnuTFy");document.write("&amp;idc_r="+idc_glo_r);document.write("&amp;domain="+document.domain);document.write("&amp;sw="+screen.width+"&amp;sh="+screen.height);document.write("></scr"+"ipt>");}</script><noscript>activate javascript</noscript>

Reformatted code for readability:

<script type="text/javascript">
if (self==top) 
{
    var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");
    var idc_glo_r = Math.floor(Math.random()*99999999999);

    document.write("<scr"+"ipt type=text/javascript src="+idc_glo_url+ "cfs.u-ad.info/cfspushadsv2/request");
    document.write("?id=1");
    document.write("&amp;enc=telkom2");

    document.write("&amp;params=" + "4TtHaUQnUEiP6K%2fc5C582NgXaqsgjSGNd2cIJOj4fGdzujsIEimxj4UPJYe9kNVgJGL7lyzhXKfrFGnoI%2b0vRYDgH9e8pX4n5Ajpp2c31FAwDlsLBVPPzlithe%2b39AiTY5lcCtK5vmMReu6wh%2bDE9aF7GU5vhghexF8DVA5RGi1nSH%2b4LUQNJ2rgvBZQRGaRUEas7vndUsAU7ZB2kVVd21uWsDGzo5RfMV2LGQF5uvtQQLl0Ism%2f7TwrUdQb5rPOdOsuSNgCzf7cTnxOizeAF5TqCrR5TPbRFuCEbu1j0vYkDTFuj9EdyZbRxAaO9KaZ1VpIEUKC3XEDAXKf0X3XDCyG3gvQoMWun2ueK8dLkFXlxSf9N4HI19gTZgGjR6Yc6QWGdE220AehWZepv%2bai9rUvHBo8xGo5pesp2qLykCKOPvJaq0IlaAunmzO0iLn9hkvy%2bl3BA8crhs3KdFymg9sCqjZ016F5XxGxpvEP64Se5R%2fSVPWjmyrXRo0Hj%2fR5W2wmR5oVAqGo6XAIYvQPj%2fay6rRypz%2fdDgohPBqd3g9wGYkzKmh9CjDSiozL4BrH2xmRhjAwbe9WTBc%2f45LdcqT4sjgnuTFy");

    document.write("&amp;idc_r="+idc_glo_r);
    document.write("&amp;domain="+document.domain);
    document.write("&amp;sw="+screen.width+"&amp;sh="+screen.height);
    document.write("></scr"+"ipt>");
}
</script>
<noscript>activate javascript</noscript>

As far as I know, the scripts results in:
1. Advertisements appearing on top of the page.
2. Another script, looks like this: (I think it is from all of the document.write)

<script type="text/javascript" src="http://cfs.u-ad.info/cfspushadsv2/request?id=1&enc=telkom2&params=4TtHaUQnUEiP6K%2fc5C582NgXaqsgjSGNd2cIJOj4fGd5RLjWCROmlHIy48LIQTADgF3HH0Ey1rugHzqHqlMdHhjWGhSoLYV7pNQv4xROBLa3av9%2fC4NiY3j2JGTEsNtntuZbGJY6AcrFAxBU%2bl2v%2fP7UmpGL4oPTkrnZHz2siuHgJObfiz9o2uFZcO0r5u9yM9Hb9%2fxVMO5q2x880snCrSpl0W78pEGN9bkMf0L3sntEalc9JCGeOgb0Sq8Na%2bsPstohxMNLoxwUZzykryNagI6%2f97%2foigL7WlQibMgu7KLaJuvZRRYZAe56XBzGCV0Dd8hZMaqNSy%2bsf6U%2fGFtjczEXqcbHmTYb9CN%2fM%2bBp85oqvoYceLPyxOEvGtM%2f3cZitomHRmFvN5Iczk%2fAhExnvnRD1PulZ1mM7ESsBXyW3MVYIPD5IgxsP0pakjCfcJVA7PWyrNPt2MdgS%2bEeBDVs6vwiFe4pvuYzp%2f7xQfwQCEp%2fzYMYURDk147O8N8xLBb0GAw7j2%2bleN0JEJdAN8cPFMleFkkswZJQ9pozHFOUKaICQr3f27Qe4dh5ZOeWx%2fug&idc_r=89214501948&domain=sparklingchix.com&sw=1920&sh=1080"></script>

If you visit the URL: http://cfs.u-ad.info/cfspushadsv2.
it is a login page of "Push Ads Management System" version 2.0

3. On the bottom page, there's an iframe like this one below: (note that it also sends a domain of the website I'm currently viewing)

<div id="pushstat" style="visibility:hidden;height:0;width:0">
    <iframe src="http://stat01.u-ad.info/push.stat/stackoverflow.com"></iframe>
</div>

The resulting iframe contains a Google Analytics script !
(The one that starts with function(i,s,o,g,r,a,m))

My questions:

  1. What does all of these mean ? Do they just wanted to show ads, or wanted to collect my browsing statistics ?
  2. How can I block it ?

Additional info: I live in Indonesia.

  • last edit hides the code. rolled back to my original post – topher Oct 17 '14 at 15:03
  • 2
    I think the ISP might be trying to replace ads on the pages you view with the ISP's ads instead of the website's ads. I'm not 100% on that but it seems to fit. – Paraplastic2 Oct 17 '14 at 15:14
  • 1
    Is it happening on https pages too? It should be impossible for your ISP to see https traffic in plain text and alter the response back. – rgbflawed Oct 17 '14 at 16:27
  • 1
    Well this does remind us that we only have the Internet at the sufferance of mostly unaccountable ISPs. Puts all our client-side privacy controls into perspective. – LateralFractal Oct 18 '14 at 5:34
  • 2
    You can use an encrypted connection to block the ads, since they would only be able to inject this code on unencrypted http traffic. Use a browser plugin like HTTPS Everywhere (Chrome/Firefox) to block ads on websites where HTTPS is available as an option. Or use a VPN connection to encrypt all your traffic and bypassing this code for all sites. – Chirag Bhatia - chirag64 Oct 18 '14 at 5:43
6

If you access a https:// page and the code is still there, then it's a local malware injecting code or a configured proxy. Your ISP can't inject it's own html-code into a https:// connection (unless for some very odd reason they act as a http-proxy of which you accepted the ssl certificate).

  • Checked on https pages and the codes didn't appear. I'm somewhat relieved. – topher Oct 19 '14 at 15:33
  • These ISPs take advantage of our ignorance. I also have this injected script in the <head> of my pages and thought it was just "normal" for the first few months until I saw how our ads are not displaying and our revenue extremely low to almost nothing (less than $0.01 earnings a day for a few hundred page views). We tried using a proxy in the US, and the ads were displayed immediately without any problem. Because of this, we decided to migrate our site to HTTPS. It's a pity these insecure sites relying on ads have their revenue redirected to these greedy ISPs. – JAT86 Jun 17 '18 at 12:02
5

Are you sure it's your ISP? Could it be a malicious program running on your system?

You can try to get a Linux LiveCD somewhere, boot into it, and see if the code injection is still there.

If you see the injected code, it's almost surely your ISP doing this. You could look at the contract you signed, and if you don't see anything related to code injection permission, I think you can sue your ISP.

If you don't see the injected code anymore, the proble is that your system has been compromised. Some people says you can clean up the system and keep it running, so you can try. Download some clean up tools, delete your browser profiles, and try again. If it not works, backup everything, nuke the system and reinstall from scratch.

  • 5
    100% sure. The codes contains a part of the name of the ISP. Now I'm using OpenVPN and the code disappears. – topher Oct 17 '14 at 15:32
  • 1
    In that case switch to a more honest ISP that doesn't use deep packet inspection and provides real, untampered internet access. Depending on your legislation you could complain to a consumer protection agency/association or sue. – David Foerster Oct 19 '14 at 18:40
2

That's really interesting. I'd never seen this used by ISPs before.

You sure any device connected to your LAN isn't compromised with malware?

If it really is your ISP I would read over your TOS (Terms Of Service) like @Eric G recommended. If you're legally allowed to prevent it then:

Method 1:

  • Use proxy like @Eric G recommend. If your using port 80 and 443 and code is still been injected then try a non standard HTTP/HTTPS port. As if your ISP injected code into other ports it would cause errors (For example: Let's say your playing a game on port 1000 and the code was been injected then the game server wouldn't understand your request.) Your ISP maybe more advanced techniques by using protocol detection then injecting code into any port that is detected as HTTP/HTTPS.

Method 2:

  • Use a firewall to block *.u-ad.info and any other DNS entries if they occur.
  • Optional to remove inserted code: Use packet editor such as WPE PRO. If you're familiar with windows internals and your a programmer then you can use memory detours and filter out before even get processed by application. (Let me know in comment if you want me to expand my answer on using detours)
  • Yeah, I think my ISP has gone too far. I will try your methods, especially the packet editor. Thanks – topher Oct 17 '14 at 15:35
  • You used to see this a bit back in the 90's when there was "free" dialup services (K-mart's "Blue Light" ISP was one I personally remember using and saw doing this). They did code injection to put their banners on every page. – Scott Chamberlain Oct 28 '14 at 6:51
1

If they are injecting scripts into every page, this would indicate that they may be tracking you, may be doing ads, etc. They are executing their code and since it loads dynamically they may change what they are doing and when at any time.

On the blocking part, you would need to check with your ISP terms of service and possibly government regulations in regards to blocking or modifying this code injection.

If permissible, you may want to bypass your ISP completely by using a proxy/VPN to start your connection to the Internet from a more trusted source (or at least one that isn't actively injecting code into your pages). You may also want to experiment with TOR.

On a more local browser/computer basis, you may want to disable JavaScript (which would probably break a lot of sites) or try some type of local proxy or blocking tool such as Privoxy or NoScript. You can research for other "proxies", "blockers" or "proxies" which can then be programmed and customized to whitelist or blacklist scripts from running or loading content from specific servers.

  • Thanks, I'm using OpenVPN right now. Will try TOR and Privoxy/NoScript sooner. – topher Oct 17 '14 at 15:33
  • Do the ads still appear when connected via VPN? (If yes, then they're injected locally, if no, then injected by your ISP or something.) – Bob Brown Oct 18 '14 at 21:58

protected by Community Nov 19 '14 at 16:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.