What in the blue hell is Comcast up to?

JawZ · Post by **JawZ** » Sun Jul 14, 2002 1:44 pm

I had cable modem activity this morning and really didn't think nothing of it until I did some tests and they were abysmal...so I decided to have a look around.....well looky here!

Looks like they are up to no good again....WTF! Don't these people ever learn?

I WILL NOT BE FORCED TO USE A PROXY!!!!!

So I just unchecked this setting and now all is back to normal...

Beware people!

Indy · Post by **Indy** » Sun Jul 14, 2002 1:46 pm

So, what did you download that caused that to change? & why is it pointing to the loopback address?

Joint Chiefs of Staff · Sun Jul 14, 2002 2:08 pm

Originally posted by Indy
So, what did you download that caused that to change? & why is it pointing to the loopback address?

Sincerely,

Your Comcast Representative.

Indy · Post by **Indy** » Sun Jul 14, 2002 2:10 pm

Originally posted by Joint Chiefs Of Staff

Sincerely,

Your Comcast Representative.

Seriously tho...I'm not aware of anything that Comcast is doing to redirect people into the proxy servers, and if they are, I want to know about it...

Immortal · Post by **Immortal** » Sun Jul 14, 2002 2:11 pm

indy.. where's my pm?

JawZ · Post by **JawZ** » Sun Jul 14, 2002 2:11 pm

Originally posted by Indy
So, what did you download that caused that to change? & why is it pointing to the loopback address?

I didn't download anything. I was sitting here watching TV and I could here and see my modem lose syn then get it back and this happened 3 times. My firewall popped up and said that it wanted to send a UDP datagram to a certain address (Comcast)...so I verified this using Ethereal (sniffer) and decided to allow the traffic...this was the result.

Any ideas on what is going on?

Indy · Post by **Indy** » Sun Jul 14, 2002 2:15 pm

Originally posted by Immortal
indy.. where's my pm?

Hadn't found that info yet

Give me a little bit of time...

Originally posted by UOD
I didn't download anything. I was sitting here watching TV and I could here and see my modem lose syn then get it back and this happened 3 times. My firewall popped up and said that it wanted to send a UDP datagram to a certain address (Comcast)...so I verified this using Ethereal (sniffer) and decided to allow the traffic...this was the result.

Any ideas on what is going on?

No idea...I'll try and get ahold of one of our network engineers tomorrow when I go into work to see if there's any info I can glean there...

I wouldn't think they'd intentionally do something like this after the black eye they got a few months ago after the proxy tracking stuff that went on...

tHE_0ne · Post by **tHE_0ne** » Sun Jul 14, 2002 2:25 pm

lucky I have Cox's Cable now

JawZ · Post by **JawZ** » Sun Jul 14, 2002 2:27 pm

Well they just did it again hence my delayed reply....was just sitting here writing it out and then I lost sync, got it back and then boom....back to using the proxy.

I have fireyes setup but forgot to write the damn log file so now that is fixed. When and if it happens again....I'll capture the info and send it to you.

Paft · Post by **Paft** » Sun Jul 14, 2002 2:32 pm

Why not just block all transmissions from Comcast?

That'd solve it.

JawZ · Post by **JawZ** » Sun Jul 14, 2002 2:37 pm

Originally posted by Paft
Why not just block all transmissions from Comcast?

That'd solve it.

Because I don't know if I have to allow them to talk to me in case they need to change my ip or resend a config file and whatnot....if I could and know that I could maintain uninterrupted service....I definitely would.

any advice on that???

GatoNanashi · Post by **GatoNanashi** » Sun Jul 14, 2002 4:54 pm

I dont have that problem, comcast blows donkey balls so I got there only cable competitor Knology, MUCH BETTER

64bit · Post by **64bit** » Sun Jul 14, 2002 6:26 pm

I don't understand how Comcast could set up a proxy server on your box then put a script in the root then check the box in IE Properties to make you use it? Am I totally missing something?

JawZ · Post by **JawZ** » Sun Jul 14, 2002 6:30 pm

Originally posted by 64bit
I don't understand how Comcast could set up a proxy server on your box then put a script in the root then check the box in IE Properties to make you use it? Am I totally missing something?

yeah you are missing something....like how in the blue hell did they do it????

I didn't put it there...that would go against logic and reason.

I didn't allow any other person to put it there and I know that my system is relatively secure.

I think that this sort of stuff should be illegal imho....changing user settings without expressed permission. They can do whatever they want at their end...but leave my friggin computer ALONE!!!!!!

64bit · Post by **64bit** » Sun Jul 14, 2002 6:35 pm

Originally posted by UOD
I think that this sort of stuff should be illegal imho....changing user settings without expressed permission.

It's gotta be!!!!

Indy · Post by **Indy** » Sun Jul 14, 2002 7:17 pm

Originally posted by UOD

yeah you are missing something....like how in the blue hell did they do it????

I didn't put it there...that would go against logic and reason.

I didn't allow any other person to put it there and I know that my system is relatively secure.

I think that this sort of stuff should be illegal imho....changing user settings without expressed permission. They can do whatever they want at their end...but leave my friggin computer ALONE!!!!!!

That's just it, I don't think that they put it there...that's a trick someone like doubleclick or gator would pull....

JawZ · Post by **JawZ** » Sun Jul 14, 2002 7:20 pm

Originally posted by Indy

That's just it, I don't think that they put it there...that's a trick someone like doubleclick or gator would pull....

I run webwasher...pow. pop up killer...you name it...plus I've opted out of everything.

I use Spybot search and Destroy and that doesn't pick up anything cause I never let anything on my system.

I have all IE settings set to high and all scripting blocked....hell I can't use half of SG cause everything is blocked lol.....

Al I know is that my sniffer said that the ip address that was talking to me was from Comcast.

Indy · Post by **Indy** » Sun Jul 14, 2002 7:22 pm

Originally posted by UOD

I run webwasher...pow. pop up killer...you name it...plus I've opted out of everything.

I use Spybot search and Destroy and that doesn't pick up anything cause I never let anything on my system.

I have all IE settings set to high and all scripting blocked....hell I can't use half of SG cause everything is blocked lol.....

Al I know is that my sniffer said that the ip address that was talking to me was from Comcast.

Is it something that's popping up again and again?

JawZ · Post by **JawZ** » Sun Jul 14, 2002 7:28 pm

Originally posted by Indy

Is it something that's popping up again and again?

nope...like I said previously...my cable modem went out for like 30 seconds...so I get up and look at what is going on and my firewall is asking me if I want to allow so and so addy from Comcast connect...so I said yes. Then in about 20-30 seconds, I hear that lovely 3Com Sharkfin cable modem ring to let me know that I have a connection again. This only happened 3 times this morning and then it stopped.

It was definitely Comcast.

It was similar to doing a release all / renew all....but it wasn't me that was initiating it.

My IP stayed the same but it does look like the DHCP server might have changed on their end.

YARDofSTUF · Post by **YARDofSTUF** » Sun Jul 14, 2002 7:29 pm

Originally posted by UOD

I run webwasher...pow. pop up killer...you name it...plus I've opted out of everything.

I use Spybot search and Destroy and that doesn't pick up anything cause I never let anything on my system.

I have all IE settings set to high and all scripting blocked....hell I can't use half of SG cause everything is blocked lol.....

Al I know is that my sniffer said that the ip address that was talking to me was from Comcast.

paraniod freak lol

XSeaNX · Post by **XSeaNX** » Sun Jul 14, 2002 8:45 pm

EDITED: I checked and I have it checked as automatically detect.....should I uncheck that too? then have NOTHING to be checked?

JawZ · Post by **JawZ** » Sun Jul 14, 2002 8:49 pm

Originally posted by XSeaNX
EDITED: I checked and I have it checked as automatically detect.....should I uncheck that too? then have NOTHING to be checked?

yes...you don't need to have anything checked.

b_underdog · Post by **b_underdog** » Wed Jul 17, 2002 2:03 am

Just did a quick search in the Google newsgroup search and it looks like it is WebWasher that is configuring the 127.0.0.1:8080/proxyconf in your browser.

ColdFusion · Post by **ColdFusion** » Wed Jul 17, 2002 2:13 am

Uhh ... how exactly would they be able to do that ? Thats not possible for them to add settings like that .. unless you have installed their software ... if they provide it.

b_underdog · Post by **b_underdog** » Wed Jul 17, 2002 2:34 am

Originally posted by ColdFusion
Uhh ... how exactly would they be able to do that ? Thats not possible for them to add settings like that .. unless you have installed their software ... if they provide it.

Not sure if you were talking to me or not, but if you check on a previous message in this thread by UOD, you'll see that he does have WebWasher installed.

Indy · Post by **Indy** » Wed Jul 17, 2002 9:09 am

Based on b_underdog's post, I've been doing a little research and it looks like there are several 'ad buster' type programs that redirect to the localhost ip for banned ip's...

http://lide.punknet.cz/miri/adbuster.html

http://www.junkbusters.com/ht/en/ijb.html

From Webwasher's FAQ:

Q: I can no longer get on to the Internet without WebWasher.

A: It seems you have configured your browser and WebWasher manually. To make the browser run again without WebWasher, you will have to undo this manual configuration. Check whether the local proxy address of WebWasher is still entered in your browser. The address is 127.0.0.1 or localhost port 8080. Delete this, and replace it with the proxy address of your Internet Service Provider or indicate that you want a direct Internet connection.

JawZ · Post by **JawZ** » Wed Jul 17, 2002 12:06 pm

hmmmm...Webwasher wasn't running when the modem lost it's connection. For some reason Webwasher doesn't place any different settings in my connection as far as proxies go...plus, I never use a proxy because I'm always testing my connection and you can't do bandwidth speed tests with a proxy...not accurate.

It doesn't matter now...it was Comcast that initiated the traffic...I know that now but if Webwasher is in fact doing something like this...then I won't use it anymore...I just wonder why this is just surfacing.

Thanks for all the help!