Уровень 0 · материалов: 5
В кластер входят документы, описывающие технический процесс и последствия внедрения стороннего контента или рекламы провайдерами в незашифрованный веб-трафик.
Общие признаки: внедрение рекламы провайдерами, уязвимость незашифрованного HTTP, атаки Man-in-the-Middle, необходимость перехода на HTTPS/SSL
Группа выше: Сбор данных провайдерами и вмешательство в трафик
Смысл: The text illustrates a real-world man-in-the-middle attack where an ISP injects ads into unencrypted HTTP traffic, highlighting the critical security necessity of using HTTPS for all external scripts to ensure data integrity.
An author discovers their ISP was injecting ads into their local project because they used insecure protocol-relative URLs instead of explicit HTTPS.
Смысл: The text demonstrates how unencrypted HTTP traffic allows ISPs/mobile operators to inject unauthorized scripts into websites, which can break site functionality and degrade performance. The main idea is that migrating to SSL (HTTPS) is essential not just for privacy, but for ensuring the integrity of the delivered web content.
The author discovers that Beeline mobile network injects parasitic JS code into HTTP pages, breaking functionality and proving why SSL is necessary for content integrity.
Смысл: The text highlights how ISPs can exploit unencrypted HTTP traffic to inject unauthorized advertisements into websites, characterizing this as a Man-in-the-Middle attack and criticizing the provider's lack of ethics and transparency.
An ISP (Dom.ru) is caught using MITM attacks to inject unauthorized ads into an unencrypted HTTP website, later justifying it as 'informing users' about promotions.
Смысл: The text exposes the method used by an ISP to inject ads into non-HTTPS websites via JS redirection and provides a technical workaround while advocating for the adoption of HTTPS as the only permanent solution.
The author explains how Rostelecom injects ads into HTTP sites via JS redirection and suggests adding random URL parameters as a temporary fix, though HTTPS is the only real solution.
Смысл: The main idea is that mobile operators can inject ads into unencrypted HTTP traffic, which can mislead search engine bots (like Google Bot) into flagging legitimate websites as malicious, resulting in advertising bans.
A website was blocked by Google Ads because Beeline injected third-party advertisements into the HTTP traffic seen by the Google Bot.