Is @BSNLCorporate injecting code into your browser? The answer is a definite yes! At IFF, we took a closer look at... what exactly the code does.
We've talked about it before, but we've found more information, and this needs your serious attention. 🧵 1/n
internetfreedom.in/taking-a-close…
We've talked about it before, but we've found more information, and this needs your serious attention. 🧵 1/n
internetfreedom.in/taking-a-close…
In May '19, we had sent a representation to @BSNLCorporate regarding these code injections, explaining their illegality under frameworks like the IT Act and Cellular Media Telephone Services Agreement signed by BSNL.
We didn't get an adequate response, so we filed some RTIs. 2/n
We didn't get an adequate response, so we filed some RTIs. 2/n
Although our complaints & incident reports received no responses, our RTIs did. @BSNLCorporate acknowledged the code injections, but refused more information on the basis of 'commercial confidence' violations.
The bottom line: code is still being injected into your browser. 3/n
The bottom line: code is still being injected into your browser. 3/n
So what *is* the code that's being injected by @BSNLCorporate? We were able to analyse some of it.
Turns out, they're sharing A LOT of your data (presumably with a 3rd party advertiser) — not just the URL you visit but also information that could potentially identify YOU! 4/n
Turns out, they're sharing A LOT of your data (presumably with a 3rd party advertiser) — not just the URL you visit but also information that could potentially identify YOU! 4/n
Like: your IP address for sure, and possibly — this is important! — an identifier, presumably *unique* to you.
Whoa. Generally, your data is aggregated (i.e. "anonymised") when it is shared, but this identifier means that BSNL is probably directly sharing your browsing data! 5/n
Whoa. Generally, your data is aggregated (i.e. "anonymised") when it is shared, but this identifier means that BSNL is probably directly sharing your browsing data! 5/n
But wait, that's not all. This feature includes ads previously categorised as MALWARE & these injections seem to be made on an hourly basis (approximately), even if you shift browsers. This likely means that some sort of cookie is being stored *locally* on your computer! 6/n
And interestingly, when one of the users clicked on an ad, they were led to a page that only *looked* like an error page, but was actually not! That is, somebody had simply designed it to look like an error page.
This raises a lot of questions. Why would somebody do that? 7/n
This raises a lot of questions. Why would somebody do that? 7/n
This issue is really old (2015) and here are our recommendations:
1. Make explicit consent mandatory!
2. Provide clarity: about decisions, agreements & revenue.
3. Clearly outline all the security practices being followed here so as to protect users from compromised code. 8/n
1. Make explicit consent mandatory!
2. Provide clarity: about decisions, agreements & revenue.
3. Clearly outline all the security practices being followed here so as to protect users from compromised code. 8/n
• • •
Missing some Tweet in this thread? You can try to
force a refresh
