ISPs accused of tampering with web pages

By Dave Nixon

Approximately one percent of the Internet web pages are being altered in transit, sometimes in a detrimental way, according to researchers at the University of Washington.

In a paper, set to be delivered Wednesday, the researchers document some worrying practices. In July and August they tested data sent to about 50,000 computers and revealed that a small number of Internet service providers (ISPs) were injecting ads into web pages on their networks.

In addition they found that some web browsing and ad-blocking software was in fact making web surfing more hazardous by introducing security vulnerabilities into pages.

To acquire their data, the team wrote software that would test whether or not someone visiting a test page on the University of Washington’s website was viewing HTML that had been altered in transit.

In 16 instances ads were injected into the web page by the visitor’s ISP.

The service providers named by the researchers are generally small ISPs such as RedMoon, Mesa Networks and MetroFi, but the paper also named one of the largest ISPs in the US, XO Communications, as an ad injector.

An XO spokesman said that the company did not employ this practice and that any ad-injection linked to its network was probably being done by a “downstream” service provider that was purchasing network capacity from XO.

In June 2007 the TechCrunch blog reported RedMoon, a small Texas wireless provider, was using a system built by a Redwood City, California company called NebuAd to insert advertising into the HTML code of web pages.

Critics blasted the ISP for meddling with its customers’ traffic and worried that this kind of ad injection undermined the integrity of websites, which had no control over the ads being displayed.

The data also shows that pages were occasionally changed by popup blockers within products such as CheckPoint’s ZoneAlarm or CA’s Personal Firewall, but also that some products in fact inserted security vulnerabilities into the pages they processed.

Even Microsoft’s Internet Explorer browser was part of the predicament, the researchers claim. IE injected HTML into pages that it saved to the computer’s hard drive, making those pages susceptible to attacks when the page was then reloaded from disk.

The paper’s authors characterised their work as a first step and said that more study would be necessary to get a clearer image of what exactly is going on within the many networks that make up the Internet.