Ryan Kearney

MITM attacks. Verizon currently injects tracking headers into HTTP pages. https://www.eff.org/deeplinks/2014/11/verizon-x-uidh A variety of ISP's (Comcast, MTNL, IDEA) also run MITM attacks and inject ads in pages, sometimes on behalf of law enforcement. I imagine they inject tracking as well. https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-a… https://medium.com/@sushubh/delhi-police-is-literally-doing-a-mitm-att… Google could either do these things or block others from doing them.

But this has a social app! This is a kickstarter project! This gives you the amazing opportunity to upload automatically every single moment of your life to a server on which you have absolutely no control! But they will be marked as private so totally safe! /irony http://blog.ryankearney.com/2012/10/never-give-your-information-to-10-…

I've also seen them hijack http streams. https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-a…

Comcast have repeatedly been caught injecting, from 2013 [0] through 2019 [1]. At what point do you acknowledge that the large-scale business that is the ISP, might just have more bargaining power than a single individual? [0] http://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-al… [1] https://gist.github.com/ryankearney/4146814?permalink_comment_id=28538…

Apparently it's a thing: https://www.infoworld.com/article/2925839/net-neutrality/code-injectio… https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-a… https://www.fastcompany.com/3023305/att-offers-discounted-gigabit-inte… https://arstechnica.com/information-technology/2016/09/att-to-end-targ…

Would that block injection like Comcast does for bandwidth notifications? http://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-al…

Much longer than that: http://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-al…

Is there an example of this in action Jarred? I'm on a Comcast connection right now (DSL was too slow). Looks like it has been happening for a while -- from 2013: https://gist.github.com/ryankearney/4146814 Blog post: http://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-al… So also used when you near the monthly traffic cap (if your area has active caps).

"Comcast did not respond to our inquiries but has mentioned a 180 day retention policy for IP-addresses in BitTorrent-related court documents. On some occasions cases have been dismissed because logs were no longer available, meaning that alleged infringers could not be identified. The 180 day policy is also mentioned in the Comcast Law Enforcement Handbook that leaked in 2007." https://torrentfreak.com/how-long-does-your-isp-store-ip-address-logs-… https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-a… They are clearly logging some things. I'm mostly amused people want to downvote my comment and pretend it isn't happening.

Comcast also injects JavaScript into HTML responses if they feel the need to send you a message. Here's the code they use: https://gist.github.com/ryankearney/4146814 And here's my (extremely short) writeup on it: http://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-al…

Not only that but it appears people are using Comcast as a DOS proxy http://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-al…

Has this been confirmed to still be happening? The guys blog post[1] states that this was on Nov 20th 2012. Anyone currently using a comcast account want to put down their pitchfork for a second and help verify this? [1] http://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-al…

To be honest, that's a tracking parameter, so I know where the clicks come from. You'd be surprised where HN percolates to! Maybe I should do a write-up on that. The Icebox fiasco is the fact that for a pretty long time, Ice Box Pro allowed watching every user's complete credentials (including Amazon keys) via a simple change in the URL parameter. You can read the details of the vulnerability here: http://blog.ryankearney.com/2012/10/never-give-your-information-to-10-… However, much more telling is the story in the comments of the original IceBoxPro thread here: https://news.ycombinator.com/item?id=4619411

Don't give your data to this site until they fix this: http://blog.ryankearney.com/2012/10/never-give-your-information-to-10-…

Hey. Congrats on shipping.. that's more than I have been capable of this year. Lots of constructive things I want to point out. Don't think I'm bashing on the idea... (But you did post it as a Show HN so like most hackers I tried and find out how things work). - I successfully created an account without paying. (Contact me through my email if you want details. You can find it in my profile). - You write all of your clients details to disk. I can view them all here. http://learnmoreabout.it/ I can also overwrite other peoples tests. (Not sure if you are aware of this). (Could also be used as a very easy denial of service vector killing available inodes) - Being able to access stuff like this is wrong. http://learnmoreabout.it/usr/share/base-passwd/group.master - You have an active RAM disk which is readable through HTTP. I've been able to download and mount and read from it. - You've got an SQL injectable page. (Took a while to find one, but it's there) - You are doing validation that should be done on the server, via the client. (ie. Checking that the name doesn't contain invalid character.). So this ends up with people writing to directories they shouldn't. See the file directory 'thisShouldNotBeHere' within your web accessible /usr directory? http://learnmoreabout.it/usr/share/mysql-common/ I've uncovered way more information than I ever should have been able to (it was almost as fun as the Strip CTF). If you want any advice, I'm always infront of an email…

https is important for preventing spying by anyone else in between you and the server. ISPs, coffee shop owners, schools, etc used to spy on http traffic to see what people were doing/searching for, and ISPs like xFinity injected code into non-https pages to show "important messages" to users, e.g. going over your bandwidth limit[0]. The only weak link now is Cloudflare, which is still "less secure than a direct connection" (with respect to government spying, bugs[0], hackers, etc) but the threat level is drastically reduced. 0: https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-a… 1: https://news.ycombinator.com/item?id=13766339