Talk Talk - Spiders Stalk Your Every Movement On The Web

I signed up to Talk Talk internet a few months back, used to be with Zen Internet but the lure of a cheap LLU service got me interested in Talk Talk, now when i signed up to them i switched off all parental controls and did not opt in to anti virus or anything else that Talk Talk offers, so today i am very surprised to see a spider stalking me over the internet, i noticed it while looking at my website and live help feature, i did a WhoIs lookup and see its labelled as a Talk Talk parental guidance spider, yet i am not opted in to this service.

This raises major concerns about privacy and what they are doing by following me all over the internet, they claim its used to detect malware on websites, it could equally be used for marketing purposes and targeted advertising and even censorship of the web.

I am not very happy about this but i am in a contract with them now, why no opt out to being followed around the web, i have nothing to hide, i occasionally visit sites which are not kid friendly but are perfectly legal but still its nothing to hide, hence mentioning it, the point is that i am uneasy about Talk Talk using a system that was developed in China ( where web censorship is on the agenda ) and a system which i cannot opt out of, i have real concerns about this.

I am still reading up on the subject matter and may post again but i'm not happy about my internet provider using a spider to view any site i visit, i have concerns they can abuse this, there has to be another motive for them doing this and its not about malware as i am not opted in to that system and have my own security on my PC.

https://www.the-phoenix-broadband-advice-community.c...

for further reading.

I do think malware is the reason, but the implementation and attitude has been pretty bad throughout.

Maybe, but i would still like an opt out as i believe it could be implemented for advertising or censorship purposes and it just feels a little creepy to me.

Edited by deleted (Wed 01-Feb-12 14:22:42)

http://www.thinkbroadband.com/news/i/4326.html has been in place for some time now.

In reply to a post by MrSaffron:

http://www.thinkbroadband.com/news/i/4326.html has been in place for some time now.

I know, but i haven't been with Talk Talk long and wasn't aware of it until today.

so much for being opt in then. another reason to stay clear of Talk Talk

In reply to a post by zyborg47:

so much for being opt in then. another reason to stay clear of Talk Talk

As was said in another forum on this subject -

if you don't believe that you are being "stalked" all over the internet and beyond already, you are naive in the extreme.

Part of quote Mr Saffron posted -

The system came to light after users on TalkTalk's forums saw that they appeared to be stalked by two TalkTalk/Opal IP's. As people browse the web, TalkTalk's system collects the URL's and these are recorded and checked against a list of blacklisted sites known to carry malware and also a list of whitelisted sites that have been scanned and approved in the last 24hours. If the site doesn't appear on either list, the user is followed to the site and the page is scanned for malware.

Users may be concerned that this sounds similar to Phorm which some ISPs such as BT tested previously, however this system does not monitor or record who looks at what sites.

The last line sums it up, Is anyone really that bothered about this?

Edited by Jack_Hackett (Thu 02-Feb-12 18:16:06)

at the time of inception, the "bot" wasnt identifying itself as a spyderbot, and it was spoofing identities (bad programming rather than malicious intent we hope) which was a security concern or in some cases was breaking website functionality for certain TT customers (some websites are designed to foil identity spoofing).

Looks like they have fixed the bot reporting part, I can only assume they fixed the other part too as I've not seen any Hatari posts recently

plus we only had TTs word for it that they weren't recording which user was accessing the URL, and they only had huawei's (sp?) word for it that they werent recording the info either.

Edited by deleted (Fri 03-Feb-12 14:32:39)

Does the bot have a name and IP address?

Pretty big bot if it can handle the millions of TalkTalk customers on just one IP address. More like a number of routers, that report via an internal admin link to a database that aggregates the data.

In that case easy to verify the not storing PID, since none of it makes it to the database.

Most providers have the ability to look at traffic flowing across switches, difference with this is that its not just used for debugging, and does some DPI rather than just source/dest IP address to get the URL from HTTP packets.

How do we know its a Huawei box? Could be any number of manufacturers.

http://www.searchtools.com/robots/robots-txt.html

some background on bots

I think it was said that the "system" (software and/or hardware) was purchased from Huawei, and traffic was maybe routed via China before any identifying data was stripped out.

To clarify, this was the chatter at the time, I don't have any solid evidence etc, I'm just remembering back

Edited by deleted (Fri 10-Feb-12 01:29:23)

In reply to a post by Myth:

I think it was said that the "system" (software and/or hardware) was purchased from Huawei, and traffic was maybe routed via China before any identifying data was stripped out.

To clarify, this was the chatter at the time, I don't have any solid evidence etc, I'm just remembering back

All bots reveal their visits to my website (not hosted by TT) as every access is logged, so when I find out which one is the TT bot, I'll block it from accessing my site. I was just wondering whether anyone else had already done it.

TT's spider identifies itself with IP 62.24.222.132 but no name. It reads robots.txt but ignores the contents (specifying which parts of the website can be scanned). It even tries to get into the password protected configuration and control files of my non TT hosted website. This is the behaviour of a hacker and Google is tame by comparison. If it got in, I'd say it would be breaking the Computer Misuse Act 1990 "unauthorised access to computer material", punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000). By following and repeating user commands, it could get into password protected sites and presumably has done so in the past. All webmasters should block it.

In reply to a post by ETEE:

If it got in, I'd say it would be breaking the Computer Misuse Act 1990 "unauthorised access to computer material",

Is that "I'd say" as in "i haven't got a clue"

http://tinyurl.com/7cfxnel


.

Edited by Jack_Hackett (Sat 11-Feb-12 13:20:07)

I see it is still spoofing as MSIE too . Of course, it is no good blocking 62.24.222.132 because the bot operates from multiple IP addresses, and the IP address is the only real way to identify it as it is spoofing.

In reply to a post by Jack_Hackett:

In reply to a post by ETEE:

If it got in, I'd say it would be breaking the Computer Misuse Act 1990 "unauthorised access to computer material",

Is that "I'd say" as in "i haven't got a clue"

http://tinyurl.com/7cfxnel


.

News International had similar problems with their understanding of the Computer Misuse Act. Someone appropriately called Hackett should think before opening his big gob and trolling about something he knows nothing about. So what do you know about web site hosting on Linux servers and preventing secure contents being scanned by unnamed spiders and bots Jack? I doubt that you'd even know why it is a serious problem.

remember Jack is the resident expert on the Computer Misuse Act, every post of his after all...is a computer misuse act


...i'm here all week.

.

News International had similar problems with their understanding of the Computer Misuse Act. Someone appropriately called Hackett should think before opening his big gob and trolling about something he knows nothing about. So what do you know about web site hosting on Linux servers and preventing secure contents being scanned by unnamed spiders and bots Jack? I doubt that you'd even know why it is a serious problem.

So that'll be "you haven't got a clue" then.

Have you noticed the total lack of interest in the thread, it would seem no one gives a rats ass about this but feel free to continue with your one man crusade if that is what floats your boat.




.

Edited by Jack_Hackett (Mon 13-Feb-12 11:15:58)

In reply to a post by Jack_Hackett:

.

News International had similar problems with their understanding of the Computer Misuse Act. Someone appropriately called Hackett should think before opening his big gob and trolling about something he knows nothing about. So what do you know about web site hosting on Linux servers and preventing secure contents being scanned by unnamed spiders and bots Jack? I doubt that you'd even know why it is a serious problem.

So that'll be "you haven't got a clue" then.

Have you noticed the total lack of interest in the thread, it would seem no one gives a rats ass about this but feel free to continue with your one man crusade if that is what floats your boat.

What one man crusade? You are deluded mate. I have merely contributed in a thoughtful way to an existing thread. By continuing to respond like a troll about something that you obviously know nothing about, you are making yourself look like a one man idiot crusade of a prat. Try reading up on how spam originates and how spiders and so-called bad bots harvest email addresses from websites. TalkTalk's anonymous spider is operating in the same way. They could easily name it like most legitimate spiders and publish a policy on its technical behaviour. Why haven't they? For instance why does it read "robots.txt" and then ignore the contents?

Think for one minute (if you are capable of doing so) about how you would describe the activities of someone who attempted to gain access to a password protected area of someone else's website. I call that hacking (whether successful or not) and that is exactly what TalkTalk's spider is trying to do.

If you are happy to rely on TT's stated good intentions then that is a matter for you, but don't impose your stupid and ill educated views on me.

i know you have trouble counting Jack, but even you noticed one person had an interest (in fact it is three people) but you still forgot that one person by the middle of your sentence.

I might have to refer your case to the prevention of computer misuse society and get you tested.

I see by your standards no-one with a unique problem is worthy of any help or consideration. Seriously?! What kind of muppet are you exactly?

Try reading up on how spam originates and how spiders and so-called bad bots harvest email addresses from websites.

Instead of me reading that how about you get out more sad lad.

.......

Edited by Jack_Hackett (Tue 14-Feb-12 18:22:09)

In reply to a post by Myth:

I see by your standards no-one with a unique problem is worthy of any help or consideration. Seriously?! What kind of muppet are you exactly?

The kind unlike you who prefers not to jump on every passing band wagon, what kind of muppet are you ?

You two really should get a room.


.

Edited by Jack_Hackett (Tue 14-Feb-12 18:22:47)

In reply to a post by Jack_Hackett:

Try reading up on how spam originates and how spiders and so-called bad bots harvest email addresses from websites.

Instead of me reading that how about you get out more sad lad.

.......

Pot, kettle, black... At least ETEE knows what he is talking about, and that generally helps in a discussion. ETTE is not some newbie, just because he doesn't post much here, especially compared to you. His posts have been a great help to me in general (not just TT related) and I'm sure many others too.

In reply to a post by Futaura:

In reply to a post by Jack_Hackett:

Try reading up on how spam originates and how spiders and so-called bad bots harvest email addresses from websites.

Instead of me reading that how about you get out more sad lad.

.......

Pot, kettle, black... At least ETEE knows what he is talking about, and that generally helps in a discussion. ETTE is not some newbie, just because he doesn't post much here, especially compared to you. His posts have been a great help to me in general (not just TT related) and I'm sure many others too.

I have never said he is a newbie, keep taking the medication.

READ - http://forums.thinkbroadband.com/talktalk/t/4088163-...

Edited by Jack_Hackett (Tue 14-Feb-12 19:43:50)

Much more of this personal stuff you and others will have an enforced break.

OH, come on now. You know full well, that no matter if he's right or wrong, Hackett will always try & have the last word.

I agree with you, that Talktalk are totally wrong if they ignore robots.txt as it's there for a reason, although that goes over Hacketts head.

In reply to a post by MadMan:

OH, come on now. You know full well, that no matter if he's right or wrong, Hackett will always try & have the last word.

Its Father Jack to you my son.

In reply to a post by Sadoldman:

Much more of this personal stuff you and others will have an enforced break.

Will it be somewhere nice, i haven't left Craggy island in years, i could do with a break.

I think I'm a wee bit to old to be your son.

Thank you for posting this information and your findings as its better being discussed in a open forum where all can read about it , active and non active .

I still have real concerns about what data is being collected and the methods used for collecting said data and obviously how that data will be used , so will probably read rather than contribute as i don't fully understand what we are dealing with and how it differs from all the other methods that are employed to track our usage and habits .

I join woweebert in saying thanks for this thoughtful posting. Like him I don't fully understand it but I don't like the idea of spying even though I have nothing to hide!

I had very bad experience of TalkTalk so this wheeze does not affect me, but I'm with BT which used (or tried to use) the notorious Phorm. What one ISP tries today, another will follow.

Use Tor if you want privacy.

You should never send sensitive information over plain HTTP.

I don't think Tor helps with this issue, neither does HTTPS. To get to Tor your traffic first has to exit through your ISP. It is within the ISPs network where the destination IP addresses are being read. Also, HTTPS doesn't encrypt the headers, so again, the IP addresses can be read

You're wrong about HTTPS - the entire request is encrypted, including the HTTP headers. This includes the remote location part of the URL, which only the target server can decrypt, so TT's spiders have no way to intercepting that. Obviously, the target IP address is visible with HTTPS as the TCP/IP socket connection is established in the normal way. But, the IP address alone is not particularly useful as many websites can share the same IP address, with the site in question being identified by the "Host" HTTP header in the client's request, which again is encrypted in a HTTPS connection.

yes, agreed I didn't think past the server address.

So using Tor forces HTTPS to the first Tor node? I've used Vidalia to start a Tor connection, but it is very slow for normal browsing, is there a better way of forcing HTTPS without avoiding hi-speed backbones?

How do people using tor know that once their data leaves the Tor network it is not being spotted and tracked then?

Also with Tor I thought you had little control of where it left Tor, so you are effectively browsing from places all over the world? Some of which may have even less stringent privacy policies than the UK, or even be using resources that are actively monitored as oppossed to the more passive system that TalkTalk have.

My understanding is, the end server only knows the request originated from the Tor exit node. That node only knows the request came from the previous node etc. How these nodes are chosen I am not sure, but for tracking you will need all the nodes to be compromised/colluding.

from the Vidalia help:

"The geographic location of a Tor relay is determined by looking up the IP address of the relay in a GeoIP database, created by MaxMind and located at geoip.vidalia-project.net.
In the middle of the dialog, below the network map, you will see a list of your current circuits, as well as any application traffic currently on those circuits. When the network map first loads, you will probably see a connection to geoip.vidalia-project.net, which occurs when Vidalia is looking up geographic information for the list of Tor relays. It is important to note that this request is done through Tor, so your location is not revealed to the GeoIP relay. The results of the lookups will be cached locally in order to reduce load on Vidalia's GeoIP relays. "

mine shows almost 3000 relays, of which I am connected to 4.

Am willing to bet that an ISP can easily identify who is using Tor, but not the traffic, and willing to bet it may be red flags issue, i.e. police/security services will assume you have something to hide.

If people don't like TalkTalk and its Malware spider system, best to change provider, but ensure that the next one never ever runs any of its kit in a debug mode.

Before they come knocking on my door I expect them to visit everyone with a sportscar and anyone who ever took a course on criminology, including all police detectives first.

Luckily, we don't live in a police state. And for the same reasons that I wouldn't expect to get arrested for future speeding incidents just because I own a car that is build primarily for speed over practicality, I wouldn't expect any authorities to take the view that all Tor traffic is illegal. As someone studying computer networking systems I find it very interesting from a connection point of view, though I've only viewed a few webpages once connected, one being a very interesting article about encryption which had no reason to avoid the attention of any authorities, and the others were pretty pointless blogs.

As to the ISP identifying a Tor user, I would think they would need to maintain a list of Tor entry nodes.

It is more about spotting the handshake as you connect to a tor entry point, if that has a pattern to it, then that could be tracked even if entry points are random, the joys of DPI and pattern matching.

I was highlighting that use of Tor even without knowing what you are doing, could be seen as a sign of hiding something, that might be of interest.

On encryption, certain key levels and algorithms are considered secret, or have limited availability outside the USA and friends.

Another country that is not a police state, refused entry to the country based on a tweet someone made, so they are watching carefully, much more so than a UK ISP will be.

are you saying a country refused re-entry to one of it's citizens based on a tweet? If not then it's not the same.

I will look into the handshake for a Tor entry node as opposed to a standard vpn/https server. I admit limited knowledge here, but I see no reason for them to be different.

I can see the potential for packet frequency/size to be pattern-able for the next hop negotiation however (or for linking to the correct service on the entry node), that is an interesting line of reasoning. I would expect it is easy to add randomised obscuring traffic into the clients though.

My main point though, is even if my curtains are closed and i'm making interesting sawing hammering sounds, these are not reasonable grounds to force entry into my house to find out what I am doing. For sure, a policeman can knock on my door to ask, but I don't have to open it or tell him what I am doing. We have rights to privacy in law, and you will need some good evidence of crime or intended crime before a judge will give you a warrant that supercedes these rights.
Exercising your right to privacy does not mean you are doing illegal activity any more than exercising your right to free speech means what you say is a lie, or inflammatory.

Refused entry to a citizen from a foreign country...i.e. what you say online is pretty heavily followed.

In reply to a post by MrSaffron:

Am willing to bet that an ISP can easily identify who is using Tor, but not the traffic, and willing to bet it may be red flags issue, i.e. police/security services will assume you have something to hide.

If people don't like TalkTalk and its Malware spider system, best to change provider, but ensure that the next one never ever runs any of its kit in a debug mode.

Not so easy when you have moved onto an LLU system and Talk talk are the only provider in your area and you are locked into a 12 month contract with them, it would cost a bit to change provider now.

I have always been happy with their phone service, i'm just not convinced this spider won't be used for some other purpose in the future.

If it follows me into password protected areas then that is a concern too.

I have been with talk talk for nearly a year now. i didn't know about this spider thing. Service has been bad over the past few months and on top of that they are spying on me too. Defintelt not staying with talk talk anymore. Gonna look up for some alternative ISP Providers!!