Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[popper]

hmm regarding the 3rd hop tracert, if your were on the BT network , you might think they were using and testing their new opted-out unlawful cookie storage/ip blocking scam to intercept and then re-route you...

BUT YOUR ON THE VM NETWORK, Hmmmmm.

kt88, i got the impression he was only blocking those two and not a full range, perhaps he will clarify that.

[Heed]

Originally Posted by roadrunner69

try blocking a different site on its own eg. google or bbc instead of phorm and see if you get the same result

With only bbc.co.uk blocked connectivity is fine.

---------- Post added at 10:36 ---------- Previous post was at 10:35 ----------

Originally Posted by popper

hmm regarding the 3rd hop tracert, if your were on the BT network , you might think they were using and testing their new opted-out unlawful cookie storage/ip blocking scam to intercept and then re-route you...

BUT YOUR ON THE VM NETWORK, Hmmmmm.

kt88, i got the impression he was only blocking those two and not a full range, perhaps he will clarify that.

I had the full range blocked. The lower end of that range I had seen posted in this thread (I think) as a phorm address as well as the upper. I decided to block the whole range in case they had a block.

But, I just have phorm.com blocked now and am seeing the problem as well.

[kt88man]

Originally Posted by Heed

I just have phorm.com blocked at the minute and am seeing the same behaviour.

I have phorm.com as: 88.208.250.85

http://www.hcidata.info/host2ip.cgi

http://www.all-nettools.com/toolbox
phorm.com (88.208.250.66)

http://tools.virginmedia.com/cgi-bin...p.pl?phorm.com
Non-authoritative answer:
Name: phorm.com
Addresses: 88.208.250.66, 88.208.250.85, 207.44.186.90

Doesn't matter which of those I block... able to browse without any problem... and tracerts to beeb are all similar to this one...

Tracing route to bbc.co.uk [212.58.224.131]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms gatekeeper [192.168.0.1]
2 6 ms 5 ms 5 ms 10.7.44.1
3 7 ms 8 ms 7 ms nrwh-t2cam1-a-ge98.inet.ntl.com [81.100.32.37]
4 12 ms 8 ms 7 ms pete-t2core-a-ge-wan64.inet.ntl.com [80.3.129.9]
5 11 ms 9 ms 13 ms nth-bb-a-so-710-0.inet.ntl.com [62.253.188.225]
6 34 ms 14 ms 13 ms gfd-bb-b-so-010-0.inet.ntl.com [62.253.185.98]
7 15 ms 16 ms 16 ms redb-ic-1-as0-0.inet.ntl.com [62.253.185.78]
8 16 ms 19 ms 16 ms 212.58.238.189
9 16 ms 16 ms 16 ms 212.58.238.133
10 14 ms 13 ms 14 ms rdirwww-vip.thdo.bbc.co.uk [212.58.224.131]

[Florence]

Originally Posted by Dephormation

Please can someone PM me the link to the 'dodgy' Phorm site, so I can review?
Thanks

Could someone please send me the link also I have someone who has been finding faults with Phorm who would like to add this information to his list of exploits. This could help us win them..

I am away for the weekend no internet connection sinc emy daughter has my laptop for a few weeks.. will catch up when i get back on Sunday might take all night at the rate this thread grows.

Keep up the good work all..

[Heed]

Originally Posted by kt88man

http://www.all-nettools.com/toolbox
phorm.com (88.208.250.66)

http://tools.virginmedia.com/cgi-bin...p.pl?phorm.com
Non-authoritative answer:
Name: phorm.com
Addresses: 88.208.250.66, 88.208.250.85, 207.44.186.90

Doesn't matter which of those I block... able to browse without any problem... and tracerts to beeb are all similar to this one...

Tracing route to bbc.co.uk [212.58.224.131]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms gatekeeper [192.168.0.1]
2 6 ms 5 ms 5 ms 10.7.44.1
3 7 ms 8 ms 7 ms nrwh-t2cam1-a-ge98.inet.ntl.com [81.100.32.37]
4 12 ms 8 ms 7 ms pete-t2core-a-ge-wan64.inet.ntl.com [80.3.129.9]
5 11 ms 9 ms 13 ms nth-bb-a-so-710-0.inet.ntl.com [62.253.188.225]
6 34 ms 14 ms 13 ms gfd-bb-b-so-010-0.inet.ntl.com [62.253.185.98]
7 15 ms 16 ms 16 ms redb-ic-1-as0-0.inet.ntl.com [62.253.185.78]
8 16 ms 19 ms 16 ms 212.58.238.189
9 16 ms 16 ms 16 ms 212.58.238.133
10 14 ms 13 ms 14 ms rdirwww-vip.thdo.bbc.co.uk [212.58.224.131]

I'm just blocking the domain name now (phorm.com), so I would assume the firewall blocks all of those.

Your trace doesn't pass through the suspect culprit of midd-t3core-1b-ge-010-0.inet.ntl.com, so I wonder what's up with it.

[CaptJamieHunter]

I've got phorm.com blocked via my firewall (Firestarter) and other sites are working fine.

[Dephormation]

Noted the reports above.

Can someone try the following URLs, see if anything is spotted?

http://www.dephormation.org.uk/serve...mal/index.html

(Click go button to start test)

http://www.dephormation.org.uk/serve...test/index.php

(Expect to see yellow image on Virgin/BT/TalkTalk, red image is very bad)

[Portly_Giraffe]

Over the past few days, Florence and I have been in a detailed and I think very productive email exchange with Simon Watkin and Andrew Knight at the Home Office, specifically covering their view of RIPA in relation to the Phorm trials and the proposed Phorm implementation. They were keen to ensure that the points could be established without a free for all, otherwise a conclusion may never be reached.

I recognise there is a danger arising from just a couple of posters being involved in this process. However I think it is justified by the substantial progress we have made, and that quite soon the points formulated will be open for public debate.

The aim is to bring them to a position where they can issue some further public opinions on Phorm and the RIPA, whether via a press release or on here (that's effectively up to them). I hope that we'll have achieved this by early next week.

We're covering about ten points, but as I think we are agreed on the first three I thought I'd share these with you. Please bear in mind that this information is my interpretation of the email exchange, and although I have every reason to believe it is accurate, the Home Office has not approved the wording and so the final version may differ.

1. RIPA provides a statutory framework for regulating the conduct of public authorities which may interfere with individuals’ right to respect for their private and family life under Article 8 of the European Convention of Human Rights.

2. RIPA provides for lawful authority for intercepting communications but also provides for an offence of unlawful interception which any person, absolutely anyone, is able to commit.

3. The Home Office (outside of its immigration functions) is not an investigatory body. It is the role of the police to investigate allegations of unlawful interception.

[fidbod]

Portly-Giraffe and Florence - Great work keep us updated.

[Heed]

Originally Posted by Dephormation

Noted the reports above.

Can someone try the following URLs, see if anything is spotted?

http://www.dephormation.org.uk/serve...mal/index.html

(Click go button to start test)

http://www.dephormation.org.uk/serve...test/index.php

(Expect to see yellow image on Virgin/BT/TalkTalk, red image is very bad)

What am I supposed to see? I got a JS popup saying the page was intercepted, then another text message saying I probably wasn't intercepted.

Using the "with redirection" I get:

THIS TEXT APPEARS BECAUSE INTERCEPTION AND REDIRECTION HAS OCCURRED

In production, after detecting the interception you would suppress this content, and potentially block the user or even the ISP from further interactions with your site.

I get a yellow image for the other test.

[kt88man]

Originally Posted by Dephormation

Noted the reports above.

Can someone try the following URLs, see if anything is spotted?

http://www.dephormation.org.uk/serve...mal/index.html

You are probably not being intercepted.

This text would not be visible in a production implementation.

cpc2-norw6-0-0-cust***.pete.cable.ntl.com

Friday 18th of April 2008 10:57:22 AM

http://www.dephormation.org.uk/serve...test/index.php

(Expect to see yellow image on Virgin/BT/TalkTalk, red image is very bad)

Yellow image...

[Ravenheart]

Originally Posted by Dephormation

Noted the reports above.

Can someone try the following URLs, see if anything is spotted?

http://www.dephormation.org.uk/serve...mal/index.html

(Click go button to start test)

http://www.dephormation.org.uk/serve...test/index.php

(Expect to see yellow image on Virgin/BT/TalkTalk, red image is very bad)

No interception on first test

and a yellow image for the second test


Can I also express my thanks To Portly and Florence for their work, I have to agree that having too many people involved could have confused and delayed the process.

[TehTech]

Originally Posted by Dephormation

Noted the reports above.

Can someone try the following URLs, see if anything is spotted?

http://www.dephormation.org.uk/serve...mal/index.html

(Click go button to start test)

http://www.dephormation.org.uk/serve...test/index.php

(Expect to see yellow image on Virgin/BT/TalkTalk, red image is very bad)

I just clicked the first URL, tested without redirection, all was fine, tested WITH redirection& I got this:

THIS TEXT APPEARS BECAUSE INTERCEPTION AND REDIRECTION HAS OCCURRED

In production, after detecting the interception you would suppress this content, and potentially block the user or even the ISP from further interactions with your site

What does this mean?

[Ravenheart]

On the dephormation page, don't use the without redirection and with redirection links, a bit further down the page is a button marked Go, this is the one to perform a test on your current connection, the two other links are to show you what is displayed in each instance.

Hope this helps

[Bonglet]

Wooah take screenshots of all this Heed i would say you have a case that you are being intercepted if this is the case, start gathering all your information as fast as you can seem virgin have installed the kit at various headends if what you say is correct and refers to the statment that kent himself posted on you tube about it being installed early march of in a few weeks (or are you a bt customer?).