Can ISPs be trusted?

Fri Oct 9 18:48:44 UTC 2009

> On 10/08/2009 01:27 PM, gilpel at altern.org wrote:
>> Most people trust their ISP, and rightly so, I suppose. But what if an
>> ISP
>> was a vilain? :) What kind of access would it have to its users'
>> computers? Isn't it the same as a client connected to a server? The
>> server
>> being root, it has full access to the client.
>>
>> Of course, the ISP doesn't have the password of the client's computer,
>> but
>> it transmits data back and forth to its users' computers all day long.
>>
>> If suppose this is a rather basic networking question, but given my
>> knowledge on the matter, I have a hard time figuring this out.
>>
>>
>
> It is the same age old problem.
>
> Does the phone company listen in?  Yes.
> Are they supposed to?  No.  Not without cause, but do employees do it?
> Yes they can, and do, even without permission or cause.

> Same holds true for ISPs.

Of course, I understand that any unencrypted data that goes to / comes
through my ISP can be read, but that's not my point. Most of what I write
I post publicly and my email are in no way personal. I speak openly and
couldn't care less.

My problem is the following. I was playing with Thunderbird trying to
filter messages so I could see only answers to my own posts. I saw that I
had *one* with a reply header that I was sure I had never configured. I
checked the headers and saw that accented letters for the title were
written with the Windows 1252 charset. I only use 8859-1 in Thunderbird...
I checked the message in my Sent box and it was exactly the same as the
post on my nntp provider's server.

This is the last in a series of security breaches that I had, as far as I
remember, only since I'm with this provider. (I exposed a few here.) My
firewall settings are, I believe, Fedora's default: everything is
disabled, except ICMP requests. Nobody has physical access to my computer:
I even installed a security lock on the front door and a latch on the back
door.

When I exposed my problems here, people thought I was just careless or
absent-minded. Some spatly suggested I was crazy. So, the problem doesn't
seem very common and I'm wondering what's going on. I wouldn't mind that
much if my outgoing traffic was read, but I would like to be sure it is
sent where I want, and in the way I wrote it. That's my concern.

Since I know the time the message was sent, maybe it could help searching
the logs? Here is the message log a few minutes before:

Sep 30 13:19:18 localhost kernel: powernow-k8:    0 : pstate 0 (2800 MHz)
Sep 30 13:19:18 localhost kernel: powernow-k8:    1 : pstate 1 (2100 MHz)
Sep 30 13:19:18 localhost kernel: powernow-k8:    2 : pstate 2 (1600 MHz)
Sep 30 13:19:18 localhost kernel: powernow-k8:    3 : pstate 3 (800 MHz)
Sep 30 13:19:18 localhost kernel: NET: Registered protocol family 10
Sep 30 13:19:18 localhost kernel: lo: Disabled Privacy Extensions
Sep 30 13:19:18 localhost kernel: ip6_tables: (C) 2000-2006 Netfilter Core
Team
Sep 30 13:19:18 localhost kernel: nvidia-config-d[1218]: segfault at
7feda4000000 ip 0000003c6f2799a4 sp 00007fff68929dd8 error 4 in
libc-2.10.1.so[3c6f200000+164000]
Sep 30 13:19:19 localhost avahi-daemon[1316]: Found user 'avahi' (UID 498)
and group 'avahi' (GID 497).
Sep 30 13:19:19 localhost avahi-daemon[1316]: Successfully dropped root
privileges.
Sep 30 13:19:19 localhost avahi-daemon[1316]: avahi-daemon 0.6.25 starting
up.
Sep 30 13:19:19 localhost avahi-daemon[1316]: Successfully called chroot().
Sep 30 13:19:19 localhost avahi-daemon[1316]: Successfully dropped
remaining capabilities.
Sep 30 13:19:19 localhost avahi-daemon[1316]: Loading service file
/services/ssh.service.
Sep 30 13:19:19 localhost avahi-daemon[1316]: System host name is set to
'localhost'. This is not a suitable mDNS host name, looking for
alternatives.
Sep 30 13:19:19 localhost avahi-daemon[1316]: Network interface
enumeration completed.
Sep 30 13:19:19 localhost avahi-daemon[1316]: Registering HINFO record
with values 'X86_64'/'LINUX'.
Sep 30 13:19:19 localhost avahi-daemon[1316]: Server startup complete.
Host name is linux.local. Local service cookie is 2567118204.
Sep 30 13:19:19 localhost avahi-daemon[1316]: Service "linux"
(/services/ssh.service) successfully established.
Sep 30 13:19:20 localhost NetworkManager: <info>  starting...
Sep 30 13:19:20 localhost NetworkManager: <WARN> 
nm_generic_enable_loopback(): error -17 returned from
rtnl_addr_add():#012Sucess#012
Sep 30 13:19:20 localhost NetworkManager: <info>  (eth0): new Ethernet
device (driver: 'r8169')
Sep 30 13:19:20 localhost NetworkManager: <info>  (eth0): exported as
/org/freedesktop/Hal/devices/net_00_24_1d_2e_11_88
Sep 30 13:19:20 localhost NetworkManager: <info>  (ttyS0): ignoring due to
lack of mobile broadband capabilties
Sep 30 13:19:20 localhost NetworkManager: <info>  Trying to start the
supplicant...
Sep 30 13:19:20 localhost NetworkManager: <info>  Trying to start the
system settings daemon...
Sep 30 13:19:20 localhost nm-system-settings: Loaded plugin ifcfg-rh: (c)
2007 - 2008 Red Hat, Inc.  To report bugs please use the NetworkManager
mailing list.
Sep 30 13:19:20 localhost nm-system-settings:    ifcfg-rh: parsing
/etc/sysconfig/network-scripts/ifcfg-eth0 ...
Sep 30 13:19:20 localhost rpc.statd[1501]: Version 1.1.6 Starting
Sep 30 13:19:20 localhost nm-system-settings:    ifcfg-rh:     read
connection 'System eth0'
Sep 30 13:19:20 localhost nm-system-settings:    ifcfg-rh: parsing
/etc/sysconfig/network-scripts/ifcfg-lo ...
Sep 30 13:19:20 localhost kernel: RPC: Registered udp transport module.
Sep 30 13:19:20 localhost kernel: RPC: Registered tcp transport module.
Sep 30 13:19:20 localhost bluetoothd[1546]: Bluetooth daemon 4.42
Sep 30 13:19:20 localhost bluetoothd[1546]: Starting SDP server
Sep 30 13:19:20 localhost kernel: Bluetooth: Core ver 2.15
Sep 30 13:19:20 localhost kernel: NET: Registered protocol family 31
Sep 30 13:19:20 localhost kernel: Bluetooth: HCI device and connection
manager initialized
Sep 30 13:19:20 localhost kernel: Bluetooth: HCI socket layer initialized
Sep 30 13:19:20 localhost kernel: Bluetooth: L2CAP ver 2.13
Sep 30 13:19:20 localhost kernel: Bluetooth: L2CAP socket layer initialized
Sep 30 13:19:20 localhost bluetoothd[1546]: Parsing
/etc/bluetooth/audio.conf failed: No such file or directory
Sep 30 13:19:20 localhost bluetoothd[1546]: Parsing
/etc/bluetooth/network.conf failed: No such file or directory
Sep 30 13:19:20 localhost kernel: Bluetooth: SCO (Voice Link) ver 0.6
Sep 30 13:19:20 localhost kernel: Bluetooth: SCO socket layer initialized
Sep 30 13:19:20 localhost kernel: Bluetooth: BNEP (Ethernet Emulation) ver
1.3
Sep 30 13:19:20 localhost kernel: Bluetooth: BNEP filters: protocol multicast
Sep 30 13:19:20 localhost bluetoothd[1546]: bridge pan0 created
Sep 30 13:19:20 localhost bluetoothd[1546]: Parsing
/etc/bluetooth/input.conf failed: No such file or directory
Sep 30 13:19:20 localhost kernel: Bridge firewalling registered
Sep 30 13:19:21 localhost gdm-binary[1634]: WARNING: GdmDisplay: display
lasted 0.103358 seconds
Sep 30 13:19:21 localhost gdm-binary[1634]: WARNING: GdmDisplay: display
lasted 0.062606 seconds
Sep 30 13:19:21 localhost gdm-binary[1634]: WARNING: GdmDisplay: display
lasted 0.060598 seconds
Sep 30 13:19:21 localhost gdm-binary[1634]: WARNING: GdmDisplay: display
lasted 0.045967 seconds
Sep 30 13:19:21 localhost gdm-binary[1634]: WARNING: GdmDisplay: display
lasted 0.067485 seconds
Sep 30 13:19:21 localhost gdm-binary[1634]: WARNING: GdmDisplay: display
lasted 0.057215 seconds
Sep 30 13:19:21 localhost gdm-binary[1634]: WARNING:
GdmLocalDisplayFactory: maximum number of X display failures reached:
check X server log for errors
Sep 30 13:19:21 localhost init: prefdm main process (1634) terminated with
status 1
Sep 30 13:19:21 localhost init: prefdm main process ended, respawning
Sep 30 13:19:22 localhost gdm-binary[1704]: WARNING: GdmDisplay: display
lasted 0.066905 seconds
Sep 30 13:19:22 localhost gdm-binary[1704]: WARNING: GdmDisplay: display
lasted 0.076246 seconds
Sep 30 13:19:22 localhost gdm-binary[1704]: WARNING: GdmDisplay: display
lasted 0.061990 seconds
Sep 30 13:19:22 localhost gdm-binary[1704]: WARNING: GdmDisplay: display
lasted 0.043200 seconds
Sep 30 13:19:22 localhost gdm-binary[1704]: WARNING: GdmDisplay: display
lasted 0.048106 seconds
Sep 30 13:19:22 localhost gdm-binary[1704]: WARNING: GdmDisplay: display
lasted 0.057805 seconds
(Many timess)
Sep 30 13:19:24 localhost init: prefdm main process (2034) terminated with
status 1
Sep 30 13:19:24 localhost init: prefdm main process ended, respawning
Sep 30 13:19:24 localhost NetworkManager: <info>  (eth0): device state
change: 1 -> 2 (reason 2)
Sep 30 13:19:24 localhost NetworkManager: <info>  (eth0): bringing up device.
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): preparing device.
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): deactivating
device (reason: 2).
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): carrier now ON
(device state 2)
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): device state
change: 2 -> 3 (reason 40)
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0)
starting connection 'System eth0'
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): device state
change: 3 -> 4 (reason 0)
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
1 of 5 (Device Prepare) scheduled...
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
1 of 5 (Device Prepare) started...
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) scheduled...
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
1 of 5 (Device Prepare) complete.
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) starting...
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): device state
change: 4 -> 5 (reason 0)
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) successful.
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
3 of 5 (IP Configure Start) scheduled.
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) complete.
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) starting...
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): device state
change: 4 -> 5 (reason 0)
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) successful.
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
3 of 5 (IP Configure Start) scheduled.
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) complete.
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
3 of 5 (IP Configure Start) started...
Sep 30 13:19:25 localhost NetworkManager: <info>  (eth0): device state
change: 5 -> 7 (reason 0)
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0)
Beginning DHCP transaction.
Sep 30 13:19:25 localhost kernel: r8169: eth0: link up
Sep 30 13:19:25 localhost kernel: r8169: eth0: link up
Sep 30 13:19:25 localhost NetworkManager: <info>  dhclient started with
pid 2097
Sep 30 13:19:25 localhost NetworkManager: <info>  Activation (eth0) Stage
3 of 5 (IP Configure Start) complete.
Sep 30 13:19:25 localhost dhclient: Internet Systems Consortium DHCP
Client 4.1.0p1
Sep 30 13:19:25 localhost dhclient: Copyright 2004-2009 Internet Systems
Consortium.
Sep 30 13:19:25 localhost dhclient: All rights reserved.
Sep 30 13:19:25 localhost dhclient: For info, please visit
http://www.isc.org/sw/dhcp/
Sep 30 13:19:25 localhost dhclient:
Sep 30 13:19:25 localhost NetworkManager: <info>  DHCP: device eth0 state
changed (null) -> preinit
Sep 30 13:19:25 localhost dhclient: Listening on LPF/eth0/00:24:1d:2e:11:88
Sep 30 13:19:25 localhost dhclient: Sending on   LPF/eth0/00:24:1d:2e:11:88
Sep 30 13:19:25 localhost dhclient: Sending on   Socket/fallback
Sep 30 13:19:25 localhost gdm-binary[2089]: WARNING: GdmDisplay: display
lasted 0.059636 seconds
Sep 30 13:19:25 localhost gdm-binary[2089]: WARNING: GdmDisplay: display
lasted 0.051187 seconds
(Etc.)

After the message was sent:

Sep 30 13:19:42 localhost rpcbind: rpcbind terminating on signal. Restart
with "rpcbind -w"
Sep 30 13:19:42 localhost kernel: Kernel logging (proc) stopped.
Sep 30 13:23:55 localhost kernel: imklog 3.22.1, log source = /proc/kmsg
started.
Sep 30 13:23:55 localhost rsyslogd: [origin software="rsyslogd"
swVersion="3.22.1" x-pid="1233" x-info="http://www.rsyslog.com"] (re)start
Sep 30 13:23:55 localhost kernel: Initializing cgroup subsys cpuset
Sep 30 13:23:55 localhost kernel: Initializing cgroup subsys cpu
Sep 30 13:23:55 localhost kernel: Linux version 2.6.30.5-43.fc11.x86_64
(mockbuild at xenbuilder4.fedora.phx.redhat.com) (gcc version 4.4.1 20090725
(Red Hat 4.4.1-2) (GCC) ) #1 SMP Thu Aug 27 21:39:52 EDT 2009
Sep 30 13:23:55 localhost kernel: Command line: ro
root=UUID=a318020c-52ff-4bdf-ac27-a013d6087bea rhgb quiet vga=773
Sep 30 13:23:55 localhost kernel: KERNEL supported cpus:
Sep 30 13:23:55 localhost kernel:  Intel GenuineIntel
Sep 30 13:23:55 localhost kernel:  AMD AuthenticAMD
Sep 30 13:23:55 localhost kernel:  Centaur CentaurHauls
Sep 30 13:23:55 localhost kernel: BIOS-provided physical RAM map:

I also often have error(?) messages about pulseaudio/alsa, e.g.:

Sep 27 11:35:05 localhost kernel: imklog 3.22.1, log source = /proc/kmsg
started.
Sep 27 11:35:05 localhost rsyslogd: [origin software="rsyslogd"
swVersion="3.22.1" x-pid="1240" x-info="http://www.rsyslog.com"] (re)start
Sep 27 11:47:00 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 1.00 ms
Sep 27 11:47:27 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 2.00 ms
Sep 27 11:48:36 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 4.00 ms
Sep 27 11:49:04 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 8.00 ms
Sep 27 11:49:17 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 16.00 ms
Sep 27 11:49:42 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 26.00 ms
Sep 27 11:50:34 localhost pulseaudio[1963]: alsa-sink.c: Increasing wakeup
watermark to 15.99 ms
Sep 27 12:02:07 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 36.00 ms
Sep 27 12:35:49 localhost pulseaudio[1963]: alsa-sink.c: Increasing wakeup
watermark to 25.99 ms
Sep 27 12:44:38 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 46.00 ms
Sep 27 13:19:08 localhost pulseaudio[1963]: alsa-sink.c: Increasing wakeup
watermark to 35.99 ms
Sep 27 13:21:32 localhost pulseaudio[1963]: alsa-sink.c: Increasing
minimal latency to 56.00 ms
Sep 27 13:25:44 localhost NetworkManager: <info>  Sleeping...
Sep 27 13:25:44 localhost NetworkManager: <info>  (eth0): now unmanaged
Sep 27 13:25:44 localhost NetworkManager: <info>  (eth0): device state
change: 8 -> 1 (reason 37)
Sep 27 13:25:44 localhost NetworkManager: <info>  (eth0): deactivating
device (reason: 37).
Sep 27 13:25:44 localhost NetworkManager: <info>  eth0: canceled DHCP
transaction, dhcp client pid 1660
Sep 27 13:25:44 localhost NetworkManager: <WARN>  check_one_route():
(eth0) error -34 returned from rtnl_route_del(): Sucess#012
Sep 27 13:25:44 localhost NetworkManager: <info>  (eth0): cleaning up...
Sep 27 13:25:44 localhost NetworkManager: <info>  (eth0): taking down device.
Sep 27 13:25:44 localhost NetworkManager: <info>  (eth0): carrier now OFF
(device state 1)
Sep 27 14:09:15 localhost NetworkManager: <info>  Waking up...
Sep 27 14:09:15 localhost NetworkManager: <info>  (eth0): now managed
Sep 27 14:09:15 localhost NetworkManager: <info>  (eth0): device state
change: 1 -> 2 (reason 2)
Sep 27 14:09:15 localhost NetworkManager: <info>  (eth0): bringing up device.
Sep 27 14:09:15 localhost kernel: r8169: eth0: link up
Sep 27 14:09:15 localhost NetworkManager: <info>  (eth0): preparing device.
Sep 27 14:09:15 localhost NetworkManager: <info>  (eth0): deactivating
device (reason: 2).
Sep 27 14:09:16 localhost NetworkManager: <info>  (ttyS0): ignoring due to
lack of mobile broadband capabilties
Sep 27 14:09:16 localhost NetworkManager: <info>  (eth0): carrier now ON
(device state 2)
Sep 27 14:09:16 localhost NetworkManager: <info>  (eth0): device state
change: 2 -> 3 (reason 40)
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0)
starting connection 'System eth0'
Sep 27 14:09:16 localhost NetworkManager: <info>  (eth0): device state
change: 3 -> 4 (reason 0)
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
1 of 5 (Device Prepare) scheduled...
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
1 of 5 (Device Prepare) started...
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) scheduled...
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
1 of 5 (Device Prepare) complete.
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) starting...
Sep 27 14:09:16 localhost NetworkManager: <info>  (eth0): device state
change: 4 -> 5 (reason 0)
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) successful.
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
3 of 5 (IP Configure Start) scheduled.
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
2 of 5 (Device Configure) complete.
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
3 of 5 (IP Configure Start) started...
Sep 27 14:09:16 localhost NetworkManager: <info>  (eth0): device state
change: 5 -> 7 (reason 0)
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0)
Beginning DHCP transaction.
Sep 27 14:09:16 localhost NetworkManager: <info>  dhclient started with
pid 4336
Sep 27 14:09:16 localhost NetworkManager: <info>  Activation (eth0) Stage
3 of 5 (IP Configure Start) complete.

Etc. I hope this helps, but I'm far from sure. Instructions would be
appreciated.