TalkTalk turns StalkStalk to build malware blocker
Unheralded system shadows browsers round the web
Magic Quadrant for Enterprise Backup/Recovery
It's less TalkTalk, more StalkStalk: the UK's second largest ISP has quietly begun following its customers around the web and scanning what they look at for a new anti-malware system it is developing.
Without telling customers, the firm has switched on the compulsory first part of the system, which is harvesting lists of the URLs every one of them visits. It often then follows them to the sites to scan for threats.
The data will be used by the second part of the system, which will block potentially dangerous sites at network level.
A poster on TalkTalk's official forums first noticed he was being followed in early July.
"I've got a pretty serious privacy issue," samnwb wrote. "I have two Opal Telecom IPs that are following my every move, they follow me to every page that I visit."
The poster runs websites and was able to see the two IP addresses tailing him in logs. Opal Telecom is TalkTalk's business ISP subsidiary.
Other forum posters replicated samnwb's observations, and following speculation that the stalking IP addresses could be part of law enforcement compliance, or a targeted advertising system, TalkTalk staff weighed in with answers.
"We are developing some really exciting new security and parental control services, which will be based deep within our network infrastructure, to provide our customers with greater protection for all the devices they connect to their broadband line with," the firm said.
"We've had considerable feedback from customers that PC-based software only deals with part of the wider security problem facing today's internet users, so we’ve developed these new services to help improve our customers online experience with us."
The new system is provided by Chinese vendor Huawei, and customers can't opt out of the data collection exercise. As they browse the web, URLs are recorded and checked against a blacklist of sites known to carry malware. They are also compared to a whitelist of sites that have been scanned for threats and approved in the last 24 hours.
If a URL appears on neither list, Huawei servers follow the user to the page and scan the code. According to measurements by webmasters, the TalkTalk stalker servers show up between about 30 seconds and two minutes after TalkTalk subscribers.
A spokeswoman for the firm told The Register it had not told customers it would be following them online because it is not gathering details of their personal activity, but instead making basic lists of all web pages passing over its network.
In its statement the firm sought to head off the privacy concerns stirred by harvesting of URLs.
"Our scanning engines receive no knowledge about which users visited what sites (e.g. telephone number, account number, IP address), nor do they store any data for us to cross-reference this back to our customers," it said.
"We are not interested in who has visited which site - we are simply scanning a list of sites which our customers, as a whole internet community, have visited."
However the system touches on the same legal issues that dogged Phorm's targeted advertising system. Under the relevant laws, URLs are deemed communications content, and intercepting them without customer permission is prohibited.
TalkTalk's spokeswoman said that URLs added to the whitelist are deleted after 24 hours, while blacklisted pages are checked every day and unblocked if they are clean for seven days in a row.
When the blocking features and parental controls of the system are activated, customers will be asked if they want to opt in at no extra cost, TalkTalk representatives said. The service will launch in the second half of this year once testing is complete, the spokeswoman added.
TalkTalk is probably just the first major ISP to implement network-level anti-malware blockers. There have been political calls for ISPs to take some responsibility for protecting their users from online threats, and the industry will be keen to avoid regulation. ®
COMMENTS
this looks a crude attempt to get round some of the phorm issues
they claim they only pass the URL to the new system so fully anonymous, no ip, PII passed
only problem is how much data is encoded in a URL?
logon to hotmail and many other websites and a lot of other information is passed as variables after the ? in the URL's
this is every bit as bad as phorm, and they are not being clear as to the exact reason, but providing a obscure reference to anti-malware / parental controls
antivirus / malware embedded in the ISP network? wait for the phrase "VALUE ADD SERVICE" to be thrown into things to try and get around PECR etc (phorm tried it)
the anti malware is not required as all current browser have the funtionality built in. and there are numerous databases which are maintained
there will be some other service round the corner, no doubt to "MONETORISE" their customer base at the expense of the customers privacy
what other information is being gathered whilst they are "checking the page for malware" profiling the page for advertising?
do not trust this system, it looks like a crude attempt to get around some of the problems of the phorm system by making a direct request for pages
peter
Why, oh why...
...can't these arseholes just be honest upfront
If in a bill, nice and clearly they just said.
"We will be testing a new antivirus product in the next few months it will work like this.... If you want to / not to / be part of this trial send a text to 12345."
How hard can it be?
But we're doing it for you, honest!
Whenever these kind of questionable looking marketing plans are uncovered the companies involved say that we should trust that they are actually doing the right thing and it is all for our own good.
Unfortunately they repeatedly show they cannot be trusted (some ISPs, the government, ICANN etc) so they should not be surprised we are so suspicious of their shady looking activities.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
