16

I've noticed recently, as of today, that all the websites I visit (except for a specific few sites such as Google) are all put into a frame. I'm not sure what the reason for this is, there are no ads displayed and everything appears normal. The only reason I found out is because the headers weren't loading correctly and none of the page titles showed up properly - I quickly checked the source code and saw that instead of the source of the page I was expecting to see, there was a single line with a frame.

I first thought maybe somekind of trojan, but after going through various checks I've determined it's my ISP and/or somekind of Internet Registry (I traced the IP shown in the source code)

What can be done to prevent this frame, short of using a VPN? I feel like I am being spied on.

PS: I'm located in South Korea.

The source code looks like this: [copied from OP's comment to avoid the auto-formatting – grawity]

<html><frameset rows='0,*' border='0'><frame src='http://210.91.57.226/notice.aspx?p=P&s=1495361&h=sitename.com&us=5,841,6&cs=10489585&rt=Y'><frame src='http://sitename.com/?'></frameset></html>
Improve this question
6
  • possibly try using a 3rd party DNS service?
    – Richie Frame
    Nov 2, 2013 at 10:23
  • 2
    which browser ? by the way, can you post the "view page source"
    – user218473
    Nov 2, 2013 at 10:59
  • All browsers. The source looks like this: <html><frameset rows='0,*' border='0'><frame src='210.91.57.226/… src='sitename.com/?'></frameset></html>
    – PJB
    Nov 2, 2013 at 12:06
  • 3
    I've seen similar practice done by certain US ISP (when listening to security now podcast). The reasoning behind the code injection (for their case) is for the ISP to be able to alert you that you have gone over (or close to) your bandwidth limit. So they do some code injection to allow them to intercept the page and give you a warning regardless of what page you are on. This code injection should not work when you are connecting to HTTPS sites. You might want to check your ISP terms and conditions to see if they made those changes. They should have it written down somewhere.
    – Darius
    Nov 2, 2013 at 12:20
  • 2
    I hope this isn't too obvious, but you didn't mention trying it: contact them and ask them to turn the #!@(#(* off.
    – derobert
    Nov 6, 2013 at 18:52

2 Answers 2

Reset to default
8

The first frame is pulling from http://ip.address/notice.aspx?p=P&s=1495361&h=sitename.com&us=5,841,6&cs=10489585&rt=Y which makes me think that the ISP, or whomever, is monitoring your traffic to provide some sort of "warning, you are about to commit crimes against the state" "...are about to go over bandwidth allocation" "...we are watching you" (or whatever). It is also possible some malware on your computer is rewriting your traffic locally.

Paranoia aside, here are a few things you can try:

  • Check your computer for malware. Download a live linux distro and boot off of an entirely untainted operating system and browser. If you no longer see the frames, the problem is in some malicious software on your operating system or browser extension.
  • As Richie suggested on the comment on your post, try hardcoding an alternate series of DNS servers in your network config. A quick google turned up this list of public DNS servers organized by country or you can just try 4.4.2.2 (AT&T, I think) or 8.8.8.8 (Google). If you succeed here, you can probably set your alternate DNS servers on your Router or Modem to give every computer on your LAN a nice dose of clean traffic. If using an alternate DNS doesn't actually help the problem, then something more even malicious is probably going on.
  • A VPN account isn't entirely necessary, as long as you have SSH access to a server with reasonable bandwidth allocation, a properly configured SSH tunnel should do the trick. While using an alternate DNS as above, start up a tunnel with something like this: ssh [email protected] -D8080. If you're on Windows, Putty is easily configured to do the same thing. I use a browser extension called Falcon Proxy to easily toggle the browser from sending requests through a local SOCKS proxy or direct traffic. With the previous SSH command, instruct Falcon Proxy to direct traffic to a SOCKS proxy at localhost:8080. To test this you could spin up an instance on Amazon cloud or Linode. If you find that this is the route you need to go to avoid getting your traffic edited real time, a VPN is probably the better solution as it is less likely to require reconfiguring every application manually.
Improve this answer
4
  • The problem is on all the computers I have, so I doubt malware is involved. I've tinkered with the DNS but no luck so far. The IP shown in the frame apparently belongs to 'Korea Network Information Center' - See: ip-adress.com/whois/210.91.57.226
    – PJB
    Nov 2, 2013 at 13:57
  • I think you should try setting up an SSH tunnel as I explained above. You'll need a server located outside the country firewall. I just noticed that Wikipedia has mention of South Korea in its article on internet freedom: en.wikipedia.org/wiki/Internet_censorship#Security_concerns
    – voxobscuro
    Nov 2, 2013 at 14:23
  • @PJB I feel like I should point out that, given that you're likely attempting to subvert a country-wide firewall, there could be some punitive consequences for this type of thing. You wouldn't be the first to try and bypass it though: vpnhero.com/articles/… While that article gives a few examples of how you might achieve what you're after, I think you could probably do it cheaper if you maintain your own solution.
    – voxobscuro
    Nov 2, 2013 at 14:26
  • Thanks, I have a VPN that I use for work which I will probably just keep using instead. I also noticed the frame thingy only applies on the homepages of websites, it doesn't seem to appear if I go directly to a subpage or something.
    – PJB
    Nov 2, 2013 at 16:04
1

Given that the whois for this IP 210.91.57.226 indicates that it belongs to Korea Telecom and the pagename is notice.aspx, I am inclined to believe this is some ISP injection to give you some type of alert regarding usage, service disruption, or billing information.

This is a aggravating practice, and yet some ISPs engage in it because in many countries it is not strictly illegal. They may have recently amended their terms of service, and I would advise you look there.

To avoid having your ISP perform any type of injection HTTPS for as many sites as possible (some sites still do not have SSL as the default...) or use a VPN.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .