Indian Govt. owned BSNL Broadband is injecting ads in all websites
Bharat Sanchar Nigam Limited (abbreviated BSNL) is an Indian state-owned telecommunication company owned by Government of India. They are the one’s who provide broadband to a large part of the India. But recently they have started injecting ads in any website that you visit using their connection. Some users have also reported that they get redirected to bsnl’s website when trying to open another website.
I have been a home broadband user since almost a decade but recently I started noticing some unusual random redirects happening inside my browser. One day while browsing the internet, I got redirected to BSNL’s mail service. Initially I thought I might have clicked a wrong url but then the next day it happened again. Since this was happening very rarely, I thought it would be a bug and would be corrected over time by them.
But after a few days from that incident, then came this ad banner. BSNL has now started injecting ads in the every other page that I visit using their 4MBPS connection for which I already pay them Rs. 2400 (~36 USD)/month for 80GB data. I was already aware that some ISP’s are doing it all over the world but I literally never thought BSNL (a government owned broadband provider) would ever do this to its subscribers.
These ads are very cleverly positioned in the bottom-right corner of the web pages and they disappear within 5 seconds after the page completes loading.
Why is it bad? What will happen?
- You will now see their ads everywhere on all non-secure (http) pages across internet.
- Someone sitting in BSNL’s office might be able to track what you do on internet and access any other non-secure resource that you visited.
- Imagine you enter google.com in your browser but end up on bsnl’s new promotional website instead. (Yes, users have actually being noticing such redirects happening!)
How is it done?
The ISP’s usually inject a script tag into the html page of the content that is being served to you by the server on the other end. They dynamically change the html content on-the-fly as its being served to you.
Here is the script that is being injected: http://117.202.20.130/dyn/bg/Shobhit-3/index.js?policy=14&policyname=BSNL-Shobhit&stage=3&time=1463159758&webServer=http://117.202.20.130&url=[original-url-im-trying-to-visit]
Notice the name ‘Shobhit’ in the script url and the policyname parameter. And they have a policy named after an employee for this!?
What can you do about this?
Well first of all, register a complain to your ISP regarding this, but I doubt that is going to help you. If you know someone in the government or the higher authorities, please write a letter to them or send them this link explaining the problem.
If your ISP is also doing the same deed, you may or may not notice ads but if you are browsing internet over http protocol, there are high chances that they are tracking your internet activity or doing malicious stuff which invades your privacy.
How to protect yourself?
Update: I have moved the solution on how to protect yourself from such injections into another blog post here: https://medium.com/@ankitduseja/how-to-protect-your-privacy-on-internet-1f0ffd2f9f6d
Update 2016–05–14 5:20 AM IST: This is getting worse, I am now seeing third party advertisements in those adslots. Looking up this ip on whoishostingthis points out to BSNL and it is now confirmed that the ads are indeed being plotted by BSNL.
I found another post about BSNL injecting ads on Quora. The big question here is this legal in first place?
Update 2016–05–14 12:42 PM IST: It seems the ads are now being enabled/disabled at random times and I found another forum on digit where people are discussing the same issue. The ads being served to them are also from the IP 117.202.20.130.
Update 2016–07–03: After trying to contact BSNL, even telecom ministry of India, there is no luck I have had to stop this. I ultimately thought of blocking their IP from my router and I did, and for a few days I thought, at-least my problem is solved. But then now BSNL is now even preventing to load the original/page script entirely until their script has been loaded. This is worst and pathetic thing they could ever do. I wish I could change my internet provider but sadly they are the only option in my area.
I seriously have no words to describe how painful is this for me. I am a freelance software engineer and internet is the backbone of my life. Indian Govt. keeps promoting their “Digital India” campaign but if this is what was meant by them about going digital, we were much better earlier without you.
I’l keep on updating this story until I find some answers to this problem.
