BadPhorm - When good ISPs go bad!

Simplepieman wrote ...

Something unsurprising about T-mobile UMTS (3G) Web-n-Walk datacard is that they have an "invisible" invisible proxy, i.e. L7 switch installed, but no evidence of Phorming (no webwise cookies).

I say unsurprising because T-mobile have an adult content filter and also seem to compress images when browsing to an extent that the banner on the BBC news webpage looks like a junior school arts project.

I know they're using an L7 switch using 2 tests:
1.) Browse a site on one of my own servers, running TCPdump on the server and netstat on the client. Netstat reports a different local port number than the server does for remote port number in the tcpdump. Therefore there is a man in the middle.

2.) Manual TCP request. Telnet to port 80 of my server. Telnet connects and netstat reports connection but tcpdump on the server shows no SYN/ACK handshake. Submit a HTTP /1.0 GET request manually and when the resuest is sent, only then does my server report a connection, again from the right IP but the wrong port number.

I say "invisible" invisible proxy because when I go to whatsmyip.org and get "more" information it reports "Proxy: No Proxy or Invisible Proxy Used"
http://www.whatsmyip.org/more

However when I go to the University of Washington intergrity checker it detects page modifictions, the most worrying of which is the actual REMOVAL of META keyword tag! Heaven knows why but his is most worrying.

Two other concerns:

1.) What else is this proxy doing? I will write to T-Mobile with a data subject request.

2.) The true stealthiness of the invisible proxy is worrying me, as existing tools on

felixcatuk wrote ...

Just because there's no cookie, doesn't mean there's no profile. It will be interesting to hear what T-Mobile say to your subject access request. A profile could be linked to you using a Phorm like UID number, such as your MSISDN (phone number) or IMSI (SIM card number). Another tangential connection, T-Mobile provide the underlying network for Virgin Mobile in the UK (who are now part of Virgin Media).

madslug wrote ...

Unless the business supplying the free wi-fi is stinging you for something while you surf and needs to give you a username and password, assume that you are being profiled. No WEP = profiled. Bandwidth is not free, if you are not paying for it directly the money is still coming from somewhere. Most free wi-fi is 'sold' to business to make them profit.

Simplepieman wrote ...

Bad - if you are in control of your VPN server I have found it practical to have the server accept connection on port 443 as well as the usual port. That way its harder to block because it looks like SSL traffic. In fact some incarnations of OpenVPN include HTTPS wrappers so that proxies will pass the packets.