Researcher: NebuAd forges Google data packets
Pimps data to third-party ad networks
In a new report (PDF) released under the aegis of consumer watchdogs Free Press and Public Knowledge, Robb Topolski accuses NebuAd of more than just nabbing user data on the sly. The freelance networking guru says the ad service is also guilty of forging network packets from third-party sites, including Google and Yahoo!.
Earlier this year, NebuAd launched tests on a Midwestern ISP known only as WOW!, and late last month, a WOW! subscriber gave Topolski remote access to a machine on the ISP's network. The PC ran a freshly-installed OS and a freshly-installed browser, and when Topolski pointed the browser at Google, eight non-Google cookies turned up on the system, including one for the domain nebuad.adjuggler.com.
This we knew. But with help from a packet sniffer, Topolski noticed another wrinkle. Some of the network packets coming from Google, he says, weren't actually coming from Google.
Topolski's 'Google' cookies
Google confirms that the extra cookies and the extra packets are not coming from its site. "The sections in [Robb Topolski's] report that talks about Google are accurate," says company spokesman Michael Kirkland. "We're obviously aware of this issue and are looking into it."
NebuAd calls the report "inaccurate," but it has yet to dispute any of Topolski's specific claims. "We are disappointed with the misleading characterization of NebuAd in [the report]," the company said. "We take issue with the inaccurate statements made in reference to NebuAd’s consumer privacy standards and apparent disregard for the controls and policies we have in place to inform and protect internet subscribers.
"Transparency and consumer privacy protection are core to our business. Reasonable review of materials that have been made available online would have educated the organization that NebuAd requires its ISP partners to provide robust notice to their subscribers prior to deployment of the service."
NebuAd would not acknowledge it's responsible for all eight cookies placed on Topolski's machine. "NebuAd only places one cookie for each ad-serving placement," is all a company spokesman would tell us.
But clearly, the company is placing at least two cookies: one for adjuggler.nebuad.com and one for a.faireagle.com. And judging from past conversations we've had with NebuAd CEO Bob Dykes, that company spokesman is saying that the company places a different cookie for each ad network it supplies with user data.
You see, NebuAd records the search and browsing behavior of ISPs users, and then passes that data on to various ad networks, where it's used to target ads. The company has its own NebuAd-branded network, and there are others as well.
In the past, Dykes chastised us for suggesting that NebuAd shares user data with ad networks run by outside companies. But one of Topolski's non-Google cookies maps back to the ad network run by the third-party network run by 24/7 Real Media.
NebuAd refused to tell us if it is working with 24/7 Real Media. But it did cop to outside partnerships, contradicting previous statements from Dykes. "NebuAd partners with third-party ad networks," a spokesman told us. "It is corporate policy not to publicly discuss partnership relationships."
So, ISPs are pimping data to NebuAd. And NebuAd is pimping it on to other outfits.
NebuAd does provide ISP subscribers with an opt-out. But we're not alone in saying the service should be opt-in only. ®
Last week, we pointed out that NebuAd shares five high-ranking employees in common with notorious spyware outfit Claria Corp. (nee Gator Corp). And now we've learned that they share a sixth. NebuAd's Washington DC counsel, Reed Freeman, was Claria's chief privacy officer.
I recently moved to a new ISP largely over the Phorm debacle. Out of the blue and some six weeks after I moved, I received a demand from a debt recovery agent appointed by my former ISP. No prior request by telephone, email or plain old mail. I do not dispute that, if I was being charged in arrears, I may have an amount outstanding from the period of my last payment up to the final cancellation point. How do I check without an invoice? The matter is now with a solicitor but the amount claimed is so small compared with potential legal fees perhaps I should cut my losses and pay. Plus, I don't want to get into the position where the debt recovery agent can add huge weekly charges for 'late payment'. They are totally unregulated thanks to government non-intervention. In addition, it could impact on my credit history. I have omitted the name of the ISP for fairly obvious reasons.
Thanks, I had forgotten about Rebol. I do so miss my Amigas, almost as much as my Nascom 2. Must get back into programming...
There is still HTTPS and IPSec.
The HTTP over IP standard should be deprecated due to the quite visible fact that
there are some very large untrustworthy ISPs.
In favor of port 443 HTTP over SSL, or HTTP over IPsec (with the ip authentication header), which can actually still provide practical assurances that the data arrives unmodified, or doesn't arrive at all,
in spite of the new issue that has arised with use of HTTP on the internet.
Yes, it turns out that not all the evil crackers are wearing black hats or committing their mischief by exploiting bugs in software to gain access.
Why do all that, when the undercover black hats can conveniently pay an upstream provider for surreptitious access to all your data streams?
Unbridled sniffing with no repurcussions, so long as the source of the data
is adequately obfuscated before it's sold overseas to the highest bidder....