Tag Archives: content injection

In-Flight Page Modification and Content Injection by ISPs, Hotels, and Wifi Access Points

Are you ever worried about connecting your phone or laptop to your hotel’s Wifi? Something about the scratchy towels and confusing array of door locks does little to inspire my trust in their network security. Regardless, I’d prefer to have Wifi speed while perusing /r/gifs/.

So, I connect to the hotel’s Wifi access point, go through their login portal with the provided password, and I’m good to go. I head to http://www.reddit.com/ and all is well. Except for that advertisement that’s in the footer of every page I visit. I know Reddit doesn’t have an ugly animated banner ad at the bottom of their pages. I know my laptop is free from adware. The HTTPS version of Reddit has no such banner ad, so what’s going on? /r/gifs/ and baby bat burritos will have to wait because something’s not right.

Here’s where the problem is – browsing unsecured, HTTP pages in your browser – ala http://www.reddit.com/. Most people assume that HTTPS [SSL] is only for your important, secretive browsing: think banking or paying your bills. Obviously, it’s important there because it stops third parties from seeing information like your credit card number. What else does HTTPS do? It guarantees that https://www.bankofamerica.com/ is actually Bank of America. In addition, it keeps any prying eyes from seeing the content of your traffic as it makes its way to and from the bank’s servers. More importantly, it keeps anyone from modifying it in-flight as it makes its way across the Internet.

You can see where the problem is if I were on https://www.bankofamerica.com/ and browsing for car loans that it would be a very bad scenario for me if my ISP, who wants to find new ways to make money with advertising, could inject competitor’s ads for other banks onto Bank of America’s pages as they come back through their servers to my browser. Worse, what if they modified the loan rates I saw on those pages so that I end up shopping for a loan elsewhere? This is what HTTPS prevents. It ensures that content remains encrypted and unaltered from Bank of America all the way to your browser.

So, where does my budget hotel ad injection scenario fit into this? For years it’s been known that ISPs can and do inject content into pages. Comcast is notorious for using this to display high monthly bandwidth usage warnings. While previously only a technology that ISPs might use it’s now commonplace enough that any provider of an Internet connection, whether it be your hotel or local coffee shop, can see the money to be made from injecting advertisements into the websites of people using their access points. Alternatively, maybe they’re getting a good deal on a Wifi/Internet package from a vendor and it’s the vendor who is ultimately making the money from the advertising/tracking opportunities.

This doesn’t stop at ISPs, or coffee shops, or hotels.
Comcast has extended their Ad injection to their Xfinity hotspots.
AT&T injects JavaScript into pages requested over its data connections.

Clearly this is a problem that is getting worse instead of better.

The takeaway from this is that it in-flight page modification and/or content injection is a common tactic and it’s unlikely to get better. What can be done? You can complain on the Internet and hope to shame companies to stop these practices. That could work. However, the best solution is ultimately to use HTTPS versions of sites whenever possible to prevent webpage content from being injected or modified. Websites without HTTPS availability at the moment will start seeing some pressure from both browser vendors and search engines to switch. Slowly but surely the web will become HTTPS by default; all the way down to animated gifs of baby bat burritos.