TalkTalk tracking you, phorm?

[Sirius]

Originally Posted by Chris

Don't worry about it ... the general approach from some of the more fervent contributors to this thread seems to be: 'you don't understand the problem. If you did understand it, you would agree with me'. There's not much true debate here, just the same old slightly hysterical ranting and batty schemes from the usual suspects.

Funny because it was these same posters that took the phorm debate in to the region of tin foil hats and its happening here and now in this thread.

To be honest i feel the thread name is incorrect as this has nothing to do with Phorm so why should it be in the thread title. It is there to give it a red top headline i think.

[speedfreak]

Originally Posted by Sirius

To be honest i feel the thread name is incorrect as this has nothing to do with Phorm so why should it be in the thread title. It is there to give it a red top headline i think.

It can be changed to whatever anyone likes, I never was too good at thread titles. It was being compared to what happened with phorm hence the title, no other reason

[Ignitionnet]

Well if we are going down that route Talk Talk aren't actually tracking anyone either as they don't record who visited the websites and have no way to associate website visits with customers, quite intentionally, so no idea what it could be changed to

[Sirius]

Originally Posted by Ignitionnet

Well if we are going down that route Talk Talk aren't actually tracking anyone either as they don't record who visited the websites and have no way to associate website visits with customers, quite intentionally, so no idea what it could be changed to

How about

"Talk Talk are doing something we don't like so lets find a way to charge them for it"

[Rchivist]

Originally Posted by Ignitionnet

I'll leave that to armchair lawyers thank you

I try not to rely on armchair lawyers, I prefer real ones.

Originally Posted by Ignitionnet

I can only comment on my own experiences and the (few) documented examples I've seen.

Likewise.

Originally Posted by Ignitionnet

I believe it's been openly acknowledged by TT that they have been working on this issue. I believe we have already noted this.

http://www.cableforum.co.uk/board/35078115-post21.html

Yes - I know that and even referred to it. If you read my post above, carefully,
http://www.cableforum.co.uk/board/35086021-post117.html
you will see that what I am referring to is their lack of acknowledgement of the tracking/mirrored url requests coming from Huawei IP ranges - I am fully aware of the references by TT's Chris to Huawei - although he didn't help TT's cause very much in his earlier posts on that subject, which he had to clarify later in response to questions - and credit to him, that partly, he did so.

Originally Posted by Ignitionnet

Depends where you look to be honest. It's not hard to find.

http://62.24.139.3/forums/showpost.p...&postcount=333

Oh I've seen that, but where does it discuss Huawei IP ranges?

Originally Posted by Ignitionnet

I've seen nothing mentioning Huawei IP addresses anywhere.

Obviously not.

Originally Posted by Ignitionnet

Bit confused why you're censoring the rest of that IP, not that it really matters. None of that subnet belongs to Huawei.

Of course it doesn't - I never said it did.

Originally Posted by Ignitionnet

Are you thinking of 62.24 / 16 - part of which is indeed owned by Opal and is the subnet which, by all known accounts, accesses have been seen?

Nope. Not in connection with the Huawei claims.

Originally Posted by Ignitionnet

If you could show me the Huawei IP addresses that you saw it would be good to see - this is quite relevant to this discussion .....

If you could show connections coming from Huawei's own address space this would be very interesting indeed.

I've never claimed to have seen this on my own logs. I've repeatedly made it clear that it seems different websites are experiencing the effects of TalkTalk monitoring system differently. Perhaps it is related to traffic volume, or perhaps the frequency of TalkTalk customers visiting their sites - only someone with access to a larger amount of data could examine that.

However there are claims out there regarding Huawei IP addresses being the source of requests turning up for urls used a short time previously by TalkTalk customers.

Due to changes in the numbering of posts on the TTMembers Forum and also post deletions (I am not a member of that forum) a link I previously had to a post where those urls were listed
http://www.talktalkmembers.com/forum...&postcount=520
now takes me to an unrelated post. I suspect the material has been deleted because I can't find it on TTMF after an extensive search. I recorded the link just over a month ago and the thread has seen quite a number of deletions during that period which have obviously affected both the numbering and the content.

You might like to consider this small IP range. 195.33.106.0 - 195.33.106.255 - but the information about it appearing on site logs, mirroring TalkTalk customer url requests is on other forums that you will need to either visit or register for yourself.

[Stuart]

Originally Posted by Tarantella

Why don't isps concentrate on restricting the ip addresses that initially place malware and such on the internet?

How do they find them? Talk Talk's stated method is what certain members are complaining about here..

And follow that up with prosecutions?

Again, easier said than done. A lot of malware comes from countries where there are far greater problems than a few PCs being infected with malware.

A lot, for instance, comes from various eastern countries (such as China). An ISP can ask the Malware uploader's ISP to block the connection. This could, theoretically, work. More likely, the ISP will ask, and either get told no, or ignored.

So, they launch legal action, for which they may actually need the help of the local authorities. These authorities have enough to worry about. Poverty, hunger etc, so the concerns of a western ISP really amount to nothing.

For an example of how long it can take, look at AllofMP3.com. It took the Russian goverment 2 years to close this site, despite multiple complaints from both Western governments and some of the largest entertainment companies in the world. Even now, the same site is trading under a different name.

---------- Post added at 23:47 ---------- Previous post was at 23:34 ----------

Originally Posted by R Jones

But to bring this back to our topic - one of the issues that comes up with this sort of monitoring is the reluctance of those who do it to behave like the well known search bots - giving themselves a recognised user agent and just joining in crawling the web and identifying themselves and using the directives in robots.txt.
Instead of following their customers around - and from the evidence so far available, impersonating them by using their request urls for specific pages.

I know when googlebot or Bing/msnbot or Slurp! visit my site, and they are very easy to monitor AND restrict so that my site benefits, but also retains control - as are the other major search engines. But TalkTalk seem to want to be covert. In fact to judge from their useragent strings, they seem to want to be thought of as a human visitor using IE8 and Windows XP Service Pack 2 with NET framework.

That's what doesn't make sense to me.

The thing is, this isn't a standard search spider. For one thing, the people Talk Talk will be looking to block are exactly the sort who would want to be on as many search engines as possible (to get their Malware widely distributed), so are not likely to make great use of robots.txt

For another, they will want to block ISP protection systems from seeing their sites, so will be looking out for any info they can to block them. Any system using an easily identifiable user agent is going to be blocked very quickly.

[Ignitionnet]

Originally Posted by R Jones

Likewise.

So little point in discussing legal matters in armchair lawyer fashion if we both agree that we prefer real lawyers to armchair ones.

Originally Posted by R Jones

Yes - I know that and even referred to it. If you read my post above, carefully,
http://www.cableforum.co.uk/board/35086021-post117.html
you will see that what I am referring to is their lack of acknowledgement of the tracking/mirrored url requests coming from Huawei IP ranges - I am fully aware of the references by TT's Chris to Huawei - although he didn't help TT's cause very much in his earlier posts on that subject, which he had to clarify later in response to questions - and credit to him, that partly, he did so.

Regrettably I can't find anything, at all, mentioning Huawei ranges, anywhere. Nothing Hatari has posted on forums (not registering for his own out of general principle), nothing from anywhere else. A Google search was futile, though given Hatari's odd attitude extends as far as trying to copyright web server logs it's not a huge leap to think that his robots.txt file reads like War and Peace, and even in his rather scary FoI request basically suggesting Huawei are an instrument of Chinese Intelligence along with follow-ups Pete John was unable to produce anything substantiating this.

Originally Posted by R Jones

Oh I've seen that, but where does it discuss Huawei IP ranges?

Given there is no mention to TT of said ranges why would it? You mentioned these ranges being discussed on forums but haven't given any link to such information.

Originally Posted by R Jones

Obviously not.

So maybe you'd be good enough to show us? This is how discussions work, you make a point and demonstrate it, rather than making a point and placing the onus on the other party to demonstrate your point for you. If you can't offer anything to substantiate your point it can legitimately be judged as such by the other party.

According to the TT forum thread all posts were deleted by their own posters. There is no discussion at all of connections originating from anywhere other than TT's datacentre.

Originally Posted by R Jones

Of course it doesn't - I never said it did.

Seems an odd thing to post in that case? It's well known and acknowledged that Talk Talk were running this for some time prior to information being published on it.

Originally Posted by R Jones

However there are claims out there regarding Huawei IP addresses being the source of requests turning up for urls used a short time previously by TalkTalk customers.

Where are these claims? Where is the proof?

Originally Posted by R Jones

You might like to consider this small IP range. 195.33.106.0 - 195.33.106.255 - but the information about it appearing on site logs, mirroring TalkTalk customer url requests is on other forums that you will need to either visit or register for yourself.

Sadly I don't have time to waste trying to find evidence for someone else's claims. These are your points you are making, it's up to you to offer the relevant data rather than expecting others to do it for you. If the data is there in black and white I'm sure this won't be a problem. Frankly your ongoing cagey manner of posting and lack of any substantiation of your points really isn't helping to get the point across or advance the discussion.

Insinuation may be popular on other forums so long as it's 'on message' however the audience here is, as I'm sure you're aware, more skeptical and generally prefers more evidence based discussion.

Please note that I'm not in any way disbelieving you - I am however asking for a higher standard of proof for such a claim than simply 'There are claims out there.....'. There were claims out there that I work for Detica, doesn't make it true

EDIT: Hey I found a claim - it was from Hatari. He posted on Friday 30th July about 70 accesses on 29th July from 195.33.106.4.

http://forums.theregister.co.uk/foru...lk_stalkstalk/

Here's a thought - by that time this had had considerable publicity, indeed per above the post was a comment to a Register story published 26th July. Maybe Huawei staff browse the Internet too, and take special interest in pages where their own work is being discussed? It would be sensationally stupid to start running this thing from Huawei address space after the story hit The Register, and it had been running quietly for some time from TalkTalk address space.

Occam's Razor would point me towards this being Huawei staff reading his forum.

The other theory is of course that, for no apparent reason, Huawei staff decided to reconfigure and/or relocate the kit so that instead of running on Gigabit Ethernet from a TalkTalk colo it would start running off their own office's leased line. This after the trial was featured in national press.

[Rchivist]

Originally Posted by Ignitionnet

So maybe you'd be good enough to show us?

You already know where to find the evidence and how to view it. What would you do if I said it was on the Times website? (behind their paywall?) Do you want me to breach another forum's T&Cs? You wanted the Huawei IP range being referred to - I've given it to you, and the points you make in rebuttal have to be taken up with the person concerned, not me. You want to be able to examine the evidence - and you know where it can be found. I have read the material available, and your explanation about Huawei reading articles in the Register and then visiting the forum unfortunately doesn't fit with the specific evidence I have seen and which you can see to if you choose to. It isn't a question of my own credibility, because it isn't my evidence.

Originally Posted by Ignitionnet

Maybe Huawei staff browse the Internet too, and take special interest in pages where their own work is being discussed? It would be sensationally stupid to start running this thing from Huawei address space after the story hit The Register, and it had been running quietly for some time from TalkTalk address space.

The Register comment post refers to "tracking" behaviour. That should give you a clear indication of the sort of log evidence being referred to and which is available for you to examine if you wish to. Unfortunately your hypothetical explanation is incompatible with the published evidence. Log entries for THAT sort of visit would be very different from the tracking behaviour being discussed on various forums and mentioned in the Register comment post. I suggest you go and read the published evidence for yourself. As to the comment about whether TT would be "sensationally stupid" - Some might think TalkTalk were less than sensible to run this covert trial in the first place, without first informing both the ICO and their own customers (the ICO has said as much, in more diplomatic language), so the second half of your explanation runs into a bit of trouble too. But the first half simply doesn't match up with the evidence. The significance of all this will no doubt be established in due course - and I am not able to make that determination for myself. But rubbishing the evidence while refusing to examine it, is not a particularly helpful way to proceed. The evidence about the Huawei ranges is available. What is so far lacking, is any TT response. They may have a good explanation - but I haven't seen it yet.

Originally Posted by R Jones

You already know where to find the evidence and how to view it. What would you do if I said it was on the Times website? (behind their paywall?) Do you want me to breach another forum's T&Cs? etc etc snippety snip snip

Robert, I think this is the problem some of us have with your replies - we ask you to supply information, and you state things like

You already know where to find the evidence and how to view it.

and then you raise a straw man argument by also stating

What would you do if I said it was on the Times website? (behind their paywall?) Do you want me to breach another forum's T&Cs?

If you stated the site, but highlighted that due to T&Cs it was not publicly available, that would be more credible. How do you know that we are not Times Online subscribers?

[Ignitionnet]

Originally Posted by R Jones

You already know where to find the evidence and how to view it. What would you do if I said it was on the Times website? (behind their paywall?) Do you want me to breach another forum's T&Cs? You wanted the Huawei IP range being referred to - I've given it to you, and the points you make in rebuttal have to be taken up with the person concerned, not me. You want to be able to examine the evidence - and you know where it can be found. I have read the material available, and your explanation about Huawei reading articles in the Register and then visiting the forum unfortunately doesn't fit with the specific evidence I have seen and which you can see to if you choose to. It isn't a question of my own credibility, because it isn't my evidence.

So across the entire Internet the only site that the Talk Talk hardware hit that day that noticed was Hatari?

Seem likely?

Yes you do have to give information or at least link to it. Just because we may know how to find things it doesn't give you an excuse to be lazy.

I would welcome seeing this evidence though, assuming of course that it isn't 'copyrighted' as his other logs posted publically have been.

Originally Posted by R Jones

The Register comment post refers to "tracking" behaviour. That should give you a clear indication of the sort of log evidence being referred to and which is available for you to examine if you wish to. Unfortunately your hypothetical explanation is incompatible with the published evidence. Log entries for THAT sort of visit would be very different from the tracking behaviour being discussed on various forums and mentioned in the Register comment post. I suggest you go and read the published evidence for yourself. As to the comment about whether TT would be "sensationally stupid" - Some might think TalkTalk were less than sensible to run this covert trial in the first place, without first informing both the ICO and their own customers (the ICO has said as much, in more diplomatic language), so the second half of your explanation runs into a bit of trouble too. But the first half simply doesn't match up with the evidence. The significance of all this will no doubt be established in due course - and I am not able to make that determination for myself. But rubbishing the evidence while refusing to examine it, is not a particularly helpful way to proceed. The evidence about the Huawei ranges is available. What is so far lacking, is any TT response. They may have a good explanation - but I haven't seen it yet.

The unadulterated logs being made available would be ideal.

As would logs, statements, anything from somewhere else which correlate with Hatari's story.

There is absolutely no way, if sites were being tracked by this IP address on that day, that Hatari's would have been the only site hit yet no-one and nowhere else has it listed.

Sites considerably less paranoid who don't think their logs are copyright have them available to the Google crawler.

Anyway let's see what we can find about this IP address.

You may find this interesting - user agents all seen from that IP address. One would be forgiven for thinking that people visiting the UK Huawei office are bringing their laptops, though if you've logs showing this behaviour from the TalkTalk hardware they would be welcome.

195.33.106.4 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
195.33.106.4 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16
195.33.106.4 Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10
195.33.106.4 Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14

This IP address edits Wikipedia.

A touch of paranoia but here's a Huawei employee searching for information on their company that's online, relating to implementation of the Australian 'Great Firewall'. Maybe this was a bot, or, who knows maybe Huawei employees do indeed browse the web through that IP address?

Anyway Huawei employees like Cityspy.

They have car problems.

That IP address appears to report spam.

Visit Uzbekistani forums.

Edit Dodgy Uncyclopedia links on Saddam Hussein.

However, as part of the Talk Talk issues we have exactly 3 links.

The first is Hatari's post to The Register, the second is Bluecar1 dated July 30th referring to a PM he received giving the Huawei IP range and this address, which given Bluecar1 is an admin on Hatari's forum will likely be from Hatari.

I have no idea what you saw, but I'm afraid you'll need to show us as, by all publically available accounts and information, this IP address is Huawei UK's web gateway or a similar part of their infrastructure.

I am at a loss as to why, if the information is so clear, Hatari hasn't published it more widely and why, if it was actually happening, there are no hits on Google apart from those linked with Hatari.

Something that would be quite interesting to know is why a post Hatari made on nodpi mentioning these IP addresses was deleted.

Google's Cache
Live site.

Probably coincidental to user account deletion but interesting. Nonetheless it would be good to know why the only matches relate to Hatari. Surely someone else on the Internet would have noticed this?

Why the cageyness over these logs if it's so cut and dried?

Cloak and dagger makes absolutely no sense.

EDIT: I can confirm that that IP address belongs to (one of?) Huawei's Internet facing firewalls.

EDIT 2: I can confirm with reasonable confidence that that hardware is also a web proxy.

Proxy Info
195.33.106.4 1.1 LHRISA01-IN, 1.1 lhriws02-ga.huawei.com:8080 (IWSS) 6 29

It's a Microsoft ISA server running Trend Micro's IWSS suite.

Amazing what a little research does for you. I'm not convinced a small business server running Trend Micro's web security suite would quite be up to the task of handling replaying the largest ISP in the UK's web traffic, but still.

[Rchivist]

Originally Posted by Ignitionnet

Yes you do have to give information or at least link to it.

You want a link so you can view a post on a members only forum where posts can only be viewed by those who have registered and logged in? So you can stare at the login page? You've already told me you aren't going to register.

Originally Posted by Ignitionnet

Sadly I don't have time to waste trying to find evidence for someone else's claims.

In that case you won't see it. But that won't be my fault.
In case you change your mind:
http://www.the-phoenix-broadband-adv....uk/index.php/

Link included with reference to C/F Terms of Service Clause 3.9, second sentence, as being "relevant to any discussion taking place"

It should take about five to ten seconds (after logging in) to find the relevant material (far less time than you've spent here complaining about me refusing to break the Phoenix Terms of Use). Please read and observe the terms of use of the site.

I'm going to leave this particular issue with you - the directions to the water trough are quite clear. I can't make you drink from it.

[Stuart]

Well, the ICO has expressed concerns at how Talk Talk has handled this.. Specifically the fact they haven't told the users being monitored..

http://www.theregister.co.uk/2010/09/06/ico_stalkstalk/

[Rchivist]

Originally Posted by Ignitionnet

given Hatari's odd attitude extends as far as trying to copyright web server logs it's not a huge leap to think that his robots.txt file reads like War and Peace

Have you read it?

[Ignitionnet]

Originally Posted by R Jones

You want a link so you can view a post on a members only forum where posts can only be viewed by those who have registered and logged in? So you can stare at the login page? You've already told me you aren't going to register.


In that case you won't see it. But that won't be my fault.
In case you change your mind:
http://www.the-phoenix-broadband-adv....uk/index.php/

Link included with reference to C/F Terms of Service Clause 3.9, second sentence, as being "relevant to any discussion taking place"

It should take about five to ten seconds (after logging in) to find the relevant material (far less time than you've spent here complaining about me refusing to break the Phoenix Terms of Use). Please read and observe the terms of use of the site.

I'm going to leave this particular issue with you - the directions to the water trough are quite clear. I can't make you drink from it.

I apologise that my information does not fit with 'the cause' however facts are facts. That node is a VPN concentrator and external DMZ host.

If it was seen accessing a page on that website this was a human being. It's not beyond the realms of possibility that a TalkTalk subscriber went to a thread and a curious Huawei employee would visit as well, but again this wouldn't fit with 'the cause' too well.

A swift call to an acquaintance in Huawei was greeted with some amusement from him when I mentioned the suggestion. That box is an external facing unit which both terminates VPNs, can proxy web traffic and be used by their engineers for remote access to clients requesting assistance - as is done within IT by many companies.

He was likewise amused by the implication from Mr John that Huawei are involved in espionage and that the Home Office's reaction was to be unimpressed.

If you guys weren't so obsessed with this whole think you'd look, soberly, at Mr John's submission and realise how ridiculous it is. Huawei hardware powers a large proportion of the telecommunications infrastructure in the UK, so perhaps a simple request for information not involving such insinuations would be more appropriate. Or the toys could go out of the pram.

The sooner you grasp that we can actually read sites like nodpi and note that your charade of impartiality is just that, a charade, the better frankly. One cannot behave like a campaigner on one site and try to make those who don't follow their point of view appear to be biased or ignoring the facts on the other.

This is where you either stick your fingers in your ears, get out the smoke and optics, or maybe, who knows, actually discuss the possibility that things aren't as you wish they would be and perhaps the point of view of a guy trying to charge Talk Talk over a thousand quid for Huawei employees viewing his website isn't the gospel truth.

You know, for someone who doesn't like to rely on armchair lawyers you certainly spout plenty of legalese in that nodpi thread.

The technical inaccuracy is also noteworthy. I know it doesn't help 'the cause' but I trust someone with experience in virtualisation such as bluecar1 is happy to acknowledge that sharing the same IP address doesn't mean a thing for cross-functionality. Given the complaining about assumptions being made here that's a pretty impressive one for the first page of a thread.

Either way that thread is a 'call to arms' campaign thread, and nothing that is said by contributors to it should be taken at face value any more than someone asking me about something I am passionate about should be taken at face value.

There is nothing in that thread, and next to nothing in this one from contributors to that one actually, even entertaining the possibility of being even-handed.

Quite the opposite warm welcomes and expectations of lots of support are the order of the day - so long as you're on the right side of the debate.

Incidentally I've seen some extracts of logs - the only real interesting point being the instant assumption that it was the bot, even though there is no evidence that the bot repeats requests if it receives a 403. So someone from that IP address tried to get to the topic discussing their company and refreshed the page twice when they got a 403. So what? Again this is only an issue if it helps 'the cause' otherwise it's only of note in that someone in Huawei was trying to take some interest in the debate.

I am confused as to why these logs were chosen - they show Huawei being blocked, probably by .htaccess, and the page refreshed a couple of times. Surely a far better 'smoking gun' would have been to show logs of TT customers being followed by that IP address, these seem to be conspicuously absent though.

Still good luck with getting your tenner per log entry.

In the interim I'm looking forward to reasoned discussions on this matter with people who aren't so involved in campaigning against it that they ignore everything contrary to their position while having the front to complain about others being ignorant to the 'facts'.

---------- Post added at 15:55 ---------- Previous post was at 15:53 ----------

Originally Posted by R Jones

Have you read it?

Yep.

I should of course have thought about his .htaccess file as well. The one he added Huawei IP addresses to before trying to make out their blocked accesses were the bot.

The relevance and point of this post responding to a frankly throw-away comment was...?

Groupthink.