Website-Targeted False Content Injection by Network Operators

Wow at first I thought I must have misread the title. Sounds overly alarmist doesn't it? Nobody would do something like this right? Well the piece is pretty explicit about what and where this is happening.

One way I could imagine to pull this off with little effort is if I'm in an unmanaged Ethernet segment with the targeted server. If you can cajole the switch to send you traffic destined to other stations, you can easily race their response. You wouldn't even have to crack any equipment that way.

This race is also how QUANTUM is supposed to work:

https://en.wikipedia.org/wiki/Tailored_Access_Operations#QUA...

I wonder if we'll see kernel drivers/software purpose made for detecting those situations soon (duplicate responses to the same request) and logging the traceroute in some database to identify the bad actors.

Yet another malicious activity that TLS prevents! It's quite wonderful.

I am nearly certain that the majority of these injections will trace back to hacked routers, doing it without the network operators' knowledge.

That's the legal status of this?

I don't understand why people have a problem with this. It's sleazy, sure. But clients should never trust the network.

The fact that this is happening is due to protocol and software faults that need to be fixed.

Once your network client can no longer be fooled with rubbish inserted by someone who happens to own some wires, then fake responses become a simple matter of bandwidth and QOS agreement, like dropped packets.

The fault here lies with the developers of insecure network client software.