SmartFren Iframe Ads Injection Fixes

An Indonesian ISP called SmartFren is now injecting ads to all web pages loaded without SSL -- to their paying customers! This case file is updated whenever there are more news. Last updated: 2015/05/29.

==== UPDATE: Here is a simple, beautiful fix! ====

Install a browser plugin that allows you to modify request headers; e.g. https://addons.mozilla.org/en-us/firefox/addon/modify-headers/ for Firefox. Then, add in a rule to "Modify" header "Accept" to "*/*" in place of the default accept-header. Then all your HTTP requests and responses are untouched. Credit to Steven at StackOverflow for the elegant solution!

Discussion here: http://stackoverflow.com/questions/30505416/eliminate-isp-injects-pages-with-iframe-script-for-ads

==================================================

SmartFren's poorly implemented iframing script also breaks functionality on many pages. Such as:

Page titles get blanked. Anchors don't work. Many AJAX features don't work (SmartFren also tries to iframe content that's asynchronously loaded). Some AJAX and SocNet javascript plugins break out by themselves and result in a blank page; etc.

The included GreaseMonkey (http://en.wikipedia.org/wiki/Greasemonkey) script attempts to fix some of the damage, including busting out of the iframe and cleaning the DOM. It also has some unintended side-effects that can break pages with legit iframes.

I am also experimenting with a local proxy server for filtering this; using Privoxy (http://www.privoxy.org/). You can find an injection-filtering configuration included. While it prevents the injected script from executing altogether, being a safer option than the GreaseMonkey clean-up, it likewise, causes some problems with legitimate iframes.

Ideally I could configure Privoxy to immediately resend the request when the alteration is detected, instead of filtering out the injected JS and replacing it with a JS redirection to the original URL. (The ISP-injection gets switched off when the same request is resent without delay.) I'm yet to figure out how to accomplish that.

Only requests on port :80 are affected. In addition, SmartFren blocks port 53 to prevent the use of external DNS services.

You should block the IP address 10.20.173.44 in your firewall to ensure that no further ad-injection code is loaded. At least saves that bit of unnecessary extra bandwidth. Any further suggestions, please let me know. This is very annoying. If all else fails, use the TOR Browser. It's immune to this nuisance. Otherwise, set up a VPN. Bad Smartfren, bad...



============ PRIVOXY FILTERING ============

1. Install Privoxy and configure your browsers to use it as a local proxy server.

2. In user.action, insert the following:

	{+filter{smartfren}}
	/

3. In user.filter, insert the following:

	FILTER: smartfren Redirect to source URL before injection is activated.
	s@(.*)function bsxz(.*)@top.location.replace(self.location.href);</script>@igmsx

This results in the blanking out of the entire injected page; and a Javascript redirection back to the requested URL.




============ GREASEMONKEY SCRIPT ============

// ==UserScript==
// @name        SmartFrenCrapBuster
// @namespace   http://*
// @include     *
// @version     1
// @grant       none
// ==/UserScript==

// Redefine the 'u' variable. SmartFren script only logs the URL without the #anchor etc.

u = self.location.href;


// Cancel out those ugly functions ya. (Unfortunately we can't intercept the process here, because this script only runs after the function gets executed. Need a local proxy filter instead.)

if (typeof bsxz == 'function') {
 bsxz = function() { return false; }
}

if (typeof go == 'function') {
 go = function() { top.location.replace(u); }
}


// If in frame-holder, undo the DOM modifications.

if (typeof document.getElementById('rf') !== undefined) {
  unDoDom(document.getElementById('rf').contentDocument);
}


// If in frame, break from frames and redirect to the actual page.

if (typeof parent.document.getElementById('rf') !== undefined) {
  doReMi(u);
  unDoDom(document);
}


// Function: Redirect to the page referenced in the URL.

function doReMi(u) {

  if (location.protocol == 'https') {
    return false; // Not that they can tweak https anyways.
  }

  if (u.search(/twitter|facebook|google/i) > -1) {
	// Things that should be in iframes without SmartFren, like SocNet plugins, shoulnd't break out of frames. This doesn't quite work yet.
    return false;
  }
  top.location.replace(u);
}


// Function: Reverse the DOM changes the SmartFren script does.

function unDoDom(docSrc) {

  y = docSrc;

  var an = y.getElementsByTagName("a");
  var i = an.length;

  while(i--) {
    if (an[i].target == "_top") {
      an[i].removeAttribute('target');
    }
  }

  var an = y.getElementsByTagName("base");
  var i = an.length;

  while(i--) {
    if (an[i].target == "_top") {
      an[i].removeAttribute('target');
    }
  }
}




============ INJECTION SAMPLES ============

#### SAMPLE OF THE MAIN INJECTION (Formatted for readability) ####

<html>
<head>

<script>

function bsxz(fr){
	try{
		var y=fr.contentDocument;
		try{
			var h=y.getElementsByTagName('head')[0];
			var bt=y.createElement("base");
			bt.target="_top";
			h.appendChild(bt);
			var an=y.getElementsByTagName("a");
			for (var i in an) {
				an[i].target="_top";
			}
		}
		catch(ee){
		}
	}
	catch(e){
	}
}

function go(w,u){
	var x=w.frames['rf'];
		if (x==null){
		x=w.document.getElementById('rf');
		if (x!=null)x.src=u;
	}
	else
	x.location=u;
}

var xu="http://10.20.173.44:8080/AdsInsert/";

var d=document;
var w=window;
var res;
var ip='10.123.123.123'; // My IP Address
var vid='2';
var md='6288123123123'; // My Modem Number

var u='http://www.scriptoq.com/'; // Requested URL

if (w.location.hostname.indexOf("m.")>=0)
	d.writeln('<meta id="xvw" name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">');

</script>

</head>

<body style="margin:0;padding:0;overflow:hidden;width:100%;">

<script>
if (w.location == w.parent.location){
	d.writeln('<iframe src="about:blank" allowtransparency=true frameborder=0 name="rf" id="rf" scrolling=auto style="width:100%;height:100%;" onload="bsxz(this);"></iframe>');
	go(w,u);
	d.writeln('<sc'+'ript src="'+xu+'AdsServer?url='+w.location.hostname+'&mdn='+md+'&lac=1&ci=1">'+'</scri'+'pt>');
}
else{
	go(w.top,u)
};
</script>

<iframe src="about:blank" allowtransparency="true" name="rf" id="rf" scrolling="auto" style="width:100%;height:100%;" onload="bsxz(this);" frameborder="0"></iframe>

<script src="http://10.20.173.44:8080/AdsInsert/AdsServer?url=www.scriptoq.com&amp;mdn=6288123123123&amp;lac=1&amp;ci=1"></script>

</body>
</html>




#### SAMPLE OF THE /AdsServer? SCRIPT LINKED FROM ABOVE ####

//mdn=6288123123123
//user-agent=Mozilla/5.0 (Windows Private) Gecko/00000000 Firefox/X.XX
//lac=1
//ci=1

if ((window.location == window.parent.location) && (window.innerHeight>175)) {
	var toolbar_id=12341234
	var application_dir="http://10.20.173.44:8080/AdsInsert/"
	var data_dir="http://10.20.173.44:8080/data/banner/"
	var toolbar_image_dir = "http://10.20.173.44:8080/data/toolbar/"
	var search_key_word = /seveneleven|alphamart|circle k|indomart|hypermart|carefour|supermarket/i

	var image_width,image_height,image_file,flying_image_file_width_a,flying_image_file_height_a,flying_image_file_a,flying_image_file_width_b,flying_image_file_height_b,flying_image_file_b,flying_image_file_width_c,flying_image_file_height_c,flying_image_file_c,flying_ads_type,flying_ads_timeout=5000,flying_ads_start=2000,flying_clicklink;

	var banner_ads_start,banner_ads_timeout,banner_image_file_width,banner_image_file_height,image_file_banner,banner_clicklink,banner_image_file_width_a,banner_image_file_height_a,banner_image_file_a,banner_image_file_width_b,banner_image_file_height_b,banner_image_file_b,banner_image_file_width_c,banner_image_file_height_c,banner_image_file_c,banner_ads_type;

	flying_ads_type=-1
	exp_ads_type=-1;
	exp_ads_start=0;
	exp_ads_timeout=0;
	exp_toolbar_type=0;
	//UaAgent='-11100~1234~1234~'
	//Urlid='-1'
	var UrlValue='www.scriptoq.com'
	var LocationValue='1:1'
	var MSISDNValue='6288123123123'
	var lng=''
	var lat=''
	var label=''
	document.write('<link rel="stylesheet" href="http://10.20.173.44:8080/AdsInsert/BannerAds.css">')
};