Feeds

Researcher: NebuAd forges Google data packets

Pimps data to third-party ad networks

Beginner's guide to SSL certificates

The man who caught Comcast blocking BitTorrents has now turned his attention to NebuAd, the Phorm-like behavioral ad targeting service that's tracking net surfers from inside multiple American ISPs.

In a new report (PDF) released under the aegis of consumer watchdogs Free Press and Public Knowledge, Robb Topolski accuses NebuAd of more than just nabbing user data on the sly. The freelance networking guru says the ad service is also guilty of forging network packets from third-party sites, including Google and Yahoo!.

Earlier this year, NebuAd launched tests on a Midwestern ISP known only as WOW!, and late last month, a WOW! subscriber gave Topolski remote access to a machine on the ISP's network. The PC ran a freshly-installed OS and a freshly-installed browser, and when Topolski pointed the browser at Google, eight non-Google cookies turned up on the system, including one for the domain nebuad.adjuggler.com.

This we knew. But with help from a packet sniffer, Topolski noticed another wrinkle. Some of the network packets coming from Google, he says, weren't actually coming from Google.

Topolski's Cookies

Topolski's 'Google' cookies

"There was an extra 133 bytes of JavaScript code being added to web pages being sent," Topolski tells us. "It was being sent in a separate packet, and even though it wasn't coming from Google, it was identified as being from www.google.com."

That bit of JavaScript code, Topolski continued, instructed the browser to load additional script from the domain a.faireagle.com. FairEagle is a subsidiary of NebuAd, and one of the cookies that turned up on Topolski's browser was tagged with that same domain.

In his report, Topolski compares this trick to several common hacking techniques, including a browser hijack, a cross-site scripting attack, and a man-in-the-middle attack. "NebuAd exploits normal browser and security behaviors by forging IP packets, allowing their own JavaScript code to be written into source code trusted by the web browser," he writes. "NebuAd and ISPs together cooperate in this attack against the intentions of the consumers, the designers of their software and the owners of the servers that they visit."

Google confirms that the extra cookies and the extra packets are not coming from its site. "The sections in [Robb Topolski's] report that talks about Google are accurate," says company spokesman Michael Kirkland. "We're obviously aware of this issue and are looking into it."

NebuAd calls the report "inaccurate," but it has yet to dispute any of Topolski's specific claims. "We are disappointed with the misleading characterization of NebuAd in [the report]," the company said. "We take issue with the inaccurate statements made in reference to NebuAd’s consumer privacy standards and apparent disregard for the controls and policies we have in place to inform and protect internet subscribers.

"Transparency and consumer privacy protection are core to our business. Reasonable review of materials that have been made available online would have educated the organization that NebuAd requires its ISP partners to provide robust notice to their subscribers prior to deployment of the service."

NebuAd would not acknowledge it's responsible for all eight cookies placed on Topolski's machine. "NebuAd only places one cookie for each ad-serving placement," is all a company spokesman would tell us.

But clearly, the company is placing at least two cookies: one for adjuggler.nebuad.com and one for a.faireagle.com. And judging from past conversations we've had with NebuAd CEO Bob Dykes, that company spokesman is saying that the company places a different cookie for each ad network it supplies with user data.

You see, NebuAd records the search and browsing behavior of ISPs users, and then passes that data on to various ad networks, where it's used to target ads. The company has its own NebuAd-branded network, and there are others as well.

In the past, Dykes chastised us for suggesting that NebuAd shares user data with ad networks run by outside companies. But one of Topolski's non-Google cookies maps back to the ad network run by the third-party network run by 24/7 Real Media.

NebuAd refused to tell us if it is working with 24/7 Real Media. But it did cop to outside partnerships, contradicting previous statements from Dykes. "NebuAd partners with third-party ad networks," a spokesman told us. "It is corporate policy not to publicly discuss partnership relationships."

So, ISPs are pimping data to NebuAd. And NebuAd is pimping it on to other outfits.

NebuAd does provide ISP subscribers with an opt-out. But we're not alone in saying the service should be opt-in only. ®

Bootnote

Last week, we pointed out that NebuAd shares five high-ranking employees in common with notorious spyware outfit Claria Corp. (nee Gator Corp). And now we've learned that they share a sixth. NebuAd's Washington DC counsel, Reed Freeman, was Claria's chief privacy officer.

Security for virtualized datacentres

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
'Serious flaws in the Vertigan report' says broadband boffin
Report 'fails reality test' , is 'simply wrong' and offers ''convenient' justification for FTTN says Rod Tucker
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
Apple Watch will CONQUER smartwatch world – analysts
After Applelocalypse, other wristputers will get stuck in
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.