Home > IT > Charter Communications Hijacks Microsoft Live Search

Charter Communications Hijacks Microsoft Live Search

January 27th, 2007 Leave a comment Go to comments

I was browsing AntiOnline earlier today, a forum that I frequent and there was a post from another member regarding Charter Communications. It seems that his ISP (Charter Communications) has been redirecting search queries to Microsoft Live Search to their own search engine... which is conveniently powered by Yahoo. The AO member who ran into this problem is Tony Bradley from About.com and he's posted a full article on this phenomenon on his About.com Page.

Tony questions the legality of Charter's actions... and while I definitely don't agree with them... I don't think they're necessarily illegal... Tony considers it browser hijacking, which is his basis for the legality/ethics issues... However when the term "browser hijacking" comes to mind, I think BHO's and changes to software on the system... and as he says in his article, nothing of Charter's has been installed on his PC... This makes me think that they are changing the DNS entry (although I don't know what his Charter DNS servers are... I attempted to contact him but he was unavailable at the time)... The issue with that is that there "Opt-Out" process places a cookie on your computer and should you delete that cookie you'll no longer be "Opted-Out".

So here's my assumption of the process (and if anyone has Charter DNS servers and is experiencing this, I'd love to have the IPs of those servers passed my way)...

  • User attempts to search with Microsoft Live Search
  • Charter's DNS responds to the live.com query with a Charter IP
  • The web server records the query and checks for the cookie.
  • If the cookie exists it issues a redirect to the actual MS Live Search; If it doesn't exist it sends you to Charter Search powered by Yahoo!.

Interestingly enough, I managed to visit the opt-out page that Tony provided... It sets a cookie named choice with no contents... The cookie expires in 2 months.

I think this is an interesting concept... especially if it is the DNS server issue... ISPs own the DNS server, who says they can't provide their own responses... Symantec pays them to point McAfee.com to their own web server... SuSE pays them to point RedHat.com at their web server... At that point who's DNS server do you trust... and if this starts to happen is their legal protection to the end user? Or will we all end up going to OpenDNS?

[UPDATE] After speaking with Tony I learned two things... a) Outsiders can't use Charter DNS servers (my queries for live.com and www.live.com were REFUSED) b) That live.com and www.live.com resolve properly for Charter customers... Which throws away my DNS theory... Time for a new one... Some sort of proxy perhaps? 

Categories: IT Tags:
  1. January 28th, 2007 at 17:09 | #1

    This is interesting, I’ll see what I can find out.

    I’ll be talking to some folks at MAAWG this week.

  2. February 12th, 2007 at 05:33 | #2

    I’m an unfortunate Charter subscriber in Madison, WI. Starting earlier tonight (once their services came back from an 8 hour outage) I noticed that queries for non-existent URL’s are being 302 redirected to Charter’s spammy link-farm Yahoo search page. Since I clear my cookies regularly (and am overall just creeped out by all of this), I switched my DNS settings over to Level3 for the time being. I’ll be giving their customer service folks a call tomorrow to try and get some sort of explanation/statement about what the hell they’re doing.

  3. Earl
    February 12th, 2007 at 19:44 | #3

    I have 2 DNS servers running internally on my home network. I just noticed this problem with charter tonight. I checked my DNS server and I had them set to use charters DNS servers as a forwarder. I removed their servers as the forwarders and set it to just use the roots. Everything is fine now. So they are using DNS to hijack your browser…. on the phone with support now.

  4. Earl
    February 12th, 2007 at 19:52 | #4

    The Charter support guy is acting like he has never heard of this… sounds like a fun night on the phone bitching out charter even though I have it fixed…. not everyone has internal DNS servers running.

  5. February 12th, 2007 at 20:07 | #5

    Thanks for commenting all, we can keep each other up to date on this… There’s also a thread on AntiOnline following this issue. Feel free to contribute over there as well… A Charter customer has passed this on to Microsoft, so something may come of it.

  6. Earl
    February 12th, 2007 at 20:20 | #6

    I setup an account on AntiOnline just waiting on a moderator to approve my account so I can post.

    As for Charter support, the techs official word from his boss was:
    “We have received complaints and Charter is re-evaluating the situation”

  7. February 14th, 2007 at 00:20 | #7

    So I talked to a tech support guy about their redirects today. He had no idea this was going on, and rightfully thought it was a malware/spyware problem at first, until I explained a little more clearly what was going on, and he did some poking around and found other blog and forum posts about this (maybe even this one *waves to Charter tech*). He seemed somewhat surprised that Charter would engage in such a practice and that no one had been told about it.

    He was talking with level 2 support while he was on with me and said that they just kept telling him it was probably malware/spyware. Hilarious that they at least see it that way too, but sad that their company pulls this shit on them without telling anyone first. I asked him for a followup, he said he’d pass it along to level 2, I gave him my email address, and that was that.

    The questions I’d want answered, and that I hope other people start repeatedly and publicly asking are:

    - Were they ever going to make an announcement/disclosure to allow customers to opt-in, or at least tell their staff about it?
    - Will they provide options for customers who don’t allow or regularly clear cookies, such as a non-redirecting DNS?
    - Why are they pointing people towards http://optin.charter.net, which doesn’t exist?
    - How much information do they gather about visitors to their link farm?
    - Is there a third-party involved providing Charter the redirect (like Barefruit did for Earthlink?)
    - How much money are they making from their link farm affiliates?
    - Do we have any guarantees that they aren’t redirecting or degrading other network traffic?

  8. February 14th, 2007 at 01:27 | #8

    I will see if I can use the power of blogging to accomplish anything and I’ll see if I can get answers to questions..

  9. February 19th, 2007 at 08:55 | #9

    I noticed last night (in michigan) that charter has hijacked my DNS as well. Bastards…. I just sent support an email.

  10. February 22nd, 2007 at 02:06 | #10

    To those of you that are following this here.

    I have attempted to contact Charter (via phone, support chat and email (15 email addresses)). Currently all attempts have gone unanswered. The listed media contact is dmack@chartercom.com, however that email address doesn’t exist.

    I have also contacted Microsoft’s PR department to see if they have comment on the issue and to see if they are investigating it.

  11. Josh
    February 24th, 2007 at 21:00 | #11

    I don’t use Internet Explorer or Live Search but I have notice that this so called service from Charter has broken a frequently used function in Firefox. I like to just type a term into the address bar like “quicktime” to get to the quicktime movie site. Firefox basically takes the term in the address bar and does an “I’m feeling lucky” search on Google. Now when I do such a search I get directed to the Charter Yahoo site with a list of search results. When I opted-out and tried to do the term in the address bar search basically the same thing happened but the results came up in Windows Live Search. What a PITA!

  12. Joey Bickel
    February 26th, 2007 at 06:02 | #12

    Hi,

    Charter’s new “DNS Wildcard” service hit us here (Bay City, MI) last weekend. I’ve been discussing it over at dslreports.com and some other, well written, articles fulling explaining the problem are appearing.

    Some links:

    http://www.dslreports.com/forum/remark,17871432

    http://www.dslreports.com/shownews/81791

    http://www.networkcomputing.com/blog/dailyblog/archives/2007/02/breaking_dns_wi.html

  13. hacker
    March 27th, 2007 at 18:48 | #13

    charter uses tipping point units. they filter everything so that would be easy to filter the request. the tipping point (bought out by 3 com) messes them up real bad.

  14. Bruce
    April 21st, 2007 at 07:37 | #14

    I have just discovered your post in my effort to fix my address bar of the “Charter hijacking”. I am not very computer smart. Is there a fix yet? This has taken days trying to resolve it. I think it is a legal issue. PLEASE EMAIL ME IF YOU HAVE A SOLUTION, or need any numbers.
    Thank you, Bruce

  15. Jonathan
    April 22nd, 2007 at 19:36 | #15

    There are two solutions to fixing this. I have confirmed these fixes since I am on the charter network.

    The fixes are

    1. To change your manually set your dns to a non-charter dns such as 4.2.2.1 and 4.2.2.2

    2. To go to http://ww11.charter.net/options and accept the opt-out cookie.

  16. bruce
    April 28th, 2007 at 08:13 | #16

    thanks for the fix, I tried “opera” but the basterds found it in 2 days. changing dns worked, again, thankyou

  17. IT BRown
    May 3rd, 2007 at 15:18 | #17

    Here is what Charter had to say:

    Noelle: You’re welcome. Thank you for choosing Charter Communications. Answers to frequently asked questions and self help options can be found by looking in the “Customer Help” menu at http://www.charter.com. If you have further questions, please chat back with us again. Our chat support is available from 7 AM through 1:30 AM central time, 365 days a year. Have yourself a great day!

    Brown: No matter, I will take this up with the State of Texas. Texas does not stand for software companies that perform underhanded tactics. Thank you for your time.

    Brown: I tested this and there was no error in my type, I spelled my tests and was sent to your search engine (yahoo) instead of my designated search engine.

    Noelle: Charter is not installing software on the customer\u2019s computer, and we are not \u201Cwatching\u201D our customer surf. This lookup catches typographical errors and turns them into common search results. Customers who object may absolutely opt out of the service by clicking the \u201CAbout this page\u201D link in the lower left corner of their browser window.

    Brown: It’s not a service; it is an intrusion on my settings and my privacy. I’m afraid that if this continues I will be forced into using another ISP. I won’t have my computer searches hijacked by an ISP that thinks I need their so-called service.

    Noelle: If you use an anti-adware or spyware program, the cookie used for opt-out may be being erased. Without that cookie, the user will see the search results page of the service. To keep from having to opt-out, make sure your program does not delete the cookie with the domain name charter.net.

    Noelle: That’s ok. The service will only be re-enabled, after you opt-out, if you delete the cookies.

    Brown: That is not good enough. I did not opt in for this therefore I should not have to save a cookie to stop using this. Also the cookie expires in 2 months, I should not have to maintain the cookie or stop emptying my cookies in order for this issue to stop.

    Noelle: Clicking the \u201CAbout This Page\u201D button in the lower left corner of the screen accesses the information and options menu. From this popup, you have the option to no longer be directed to the search results page. If you choose \u201COpts-Out\u201D and then you clear your cookies, the service will be re-enabled. Is there anything else I can help you with today?

    Noelle: Please give me a few moments as I pull my resources.

    Noelle: I’ll certainly assist you and afterwards review your services if we have time.

    Noelle: I’m sorry to hear your issue with our search service.

    Brown: I want my searches to stop being redirected to your DNS servers. I am highly offended that my searches are being manipulated by Charter.

    Noelle: Thank you for contacting Charter. My name is Noelle. How may I help you today?
    [Noelle - A representative has joined the session.]
    A representative will be with you in about a minute.

  18. Howie
    May 13th, 2007 at 13:37 | #18

    I just added, to my HOSTS file,
    127.0.0.1 ww11.charter.net
    Now the charter search page is DENIED by my machine.
    ;-)

    It may not be the right fix for everyone but it works for me.

    Cheers !

  19. Chris
    May 23rd, 2007 at 23:27 | #19

    I was able to have customer service give me a primary and secondary DNS server address to enter into my router’s static DNS settings. This provides the original browser functionality (I have “I’m feeling lucky” set in FireFox so I get instant results) and is a temporary solution.

    Charter customers do need to voice their displeasure with this “feature” of the default DNS servers. If enough complaints are logged, I have to believe they will rethink this decision. (can they really be making a lot of money off this???)

  20. Chris
    May 23rd, 2007 at 23:29 | #20

    I meant to say these are alternate DNS servers and not the ones provided by DHCP. I would place them here, but I’m not sure they are appropriate for everyone in all areas.

  21. Chris
    May 23rd, 2007 at 23:41 | #21

    Sorry for so many posts. I just wanted to share the mail I sent to support. I will share any answers I get in this forum. Didn’t want anyone to think I was all talk and no type. :)

    To Charter communications:
    “Recent changes to the DHCP provided DNS servers cause a Yahoo/Charter branded search page to be returned when search terms are placed in the address field of my browser. I have examined the “opt-out” page and the options it offers and they are NOT acceptable. All of the options usurp or “hijack” both of my browser’s address bar search settings. These would include Windows Live search for internet Explorer 7 and Google “I”m Feeling Lucky” search in Firefox (for one click searching). I was able to obtain primary and secondary DNS server addresses that do not return these unwanted search pages and have entered them as static settings in my router. This is NOT an optimal solution though and I would like to know if Charter will address this issue in the near future.

    Thank you for reading,
    Chris Holt”

  22. May 24th, 2007 at 01:05 | #22

    I don’t know whether this is related to Yahoo/Charter branded search page.

    I’m trying to access my workplace intranet sites via Cisco VPN and get this Yahoo/Charter Search page. When I use Comcast, I’m able to access my workplace intranet sites via Cisco VPN. Does anybody know if this is related to Charter branded search? Is anybody having such problem?

    Thanks,
    semaj

  23. May 24th, 2007 at 01:13 | #23

    I think the above issue is due to Charter branded search service. When I manually set my dns to a non-charter dns such as 4.2.2.1 and 4.2.2.2, I’m able to access the intranet sites via VPN.

  24. Evil Jesus
    July 1st, 2007 at 21:27 | #24

    I think we need to have everyone send an email to abuse@charter.net. stating that Charter.net has hijacked our browsers! Only if the masses clamor will they listen!

    Send them 1 a day until they listen! I will start today!

  25. July 5th, 2007 at 22:30 | #25

    I just discovered this DNS hijacking and, as a Charter customer, I’m disgusted. This is exactly the same as what caused Verisign’s $100 million lawsuit; it’s dishonest and quite possibly illegal. I’ve sent emails to both Charter support and abuse@charter.net and I’m now looking at alternate internet providers.

  26. Evil Jesus
    July 7th, 2007 at 14:52 | #26

    This is the email i’ve been sending them:

    Hello,

    I am writing this email to advise you that this so called service that Charter.net provides when a customer types in a keyword in the address bar is nothing short of BROWSER HIJACKING! It is unacceptable and unethical. I should neither have to use your “service” nor should I have to permanently accept a cookie on my machine. This unethical activity should stop!

    I will continue to email abuse, every time I do a keyword search and find my page hijacked! I don’t understand how you do not hear the voice of your customers (just do a Google search on Charter.net hijacking browser and you will see what I mean).

    Here are a few links to get you started:
    http://www.robsanheim.com/2007/03/19/reason-303-charter-cable-sucks-browser-hijack/

    http://rockymoore.com/Tech/archive/2007/02/21/Bad_Charter_Communications.aspx

    http://forums.speedguide.net/showthread.php?t=221015

    http://www.computerdefense.org/?p=217

    Please listen to your customers!

  27. JF
    October 1st, 2007 at 16:51 | #27

    I am so happy that I found this! I had no idea what it was called, but I knew it was infuriating! I have tried to change the search from address bar option and it always goes back to Charter. It’s not a user-friendly engine, and I want it gone! I have small children and not a ton of time to be scouting the internet trying to find out why this is happening. Now I find out it’s my ISP??!!
    I am not impressed.

  28. Brian Chesnutt
    February 26th, 2008 at 02:56 | #28

    Will someone please post all of the email addresses for charter so anyone can write to them. I am not able to find their email address anywhere. Any and all will do.

    That being said… Sorry guys, I have a different issue with charter. Customer Service overseas hung up on me twice tonight. I called for tech support, and instead I was downgraded from a service I have already paid for because ‘my computer can’t handle it’ then they try to get me to upgrade to the service they just downgraded me from?

    Just to give you guys a break…here is a transcript of the session (which they closed on me)

    Diliesa : Hi! This is Diliesa. Thank you for contacting Charter High Speed Internet Support. How may I assist you today?

    Brian Chesnutt: hi, I had a chat earlier and troubleshooting asked me to go to the website ndt troubleshooter.

    Brian Chesnutt: I ran a diagnostic.

    Currently experiencing network delays, one moment please….

    Network connection re-established.

    Brian Chesnutt: It is saying my download speed is fine (8.68mb/s) but my upload speed is 49.56 kb/s

    Diliesa : I am sorry that you are having problem with slow speed connection. This is really frustrating if I’ll be in your case. However, please do not worry, I can certainly help you troubleshoot the problem today. If this is a network-related problem, we will know it today. I will also take a look at your services, and inform you of the Charter Bundles available in your area.
    .
    Diliesa : Brian, may I know what internet speed package you are subscribed to?

    Brian Chesnutt: I ran the diagnostic, what is the email address I can send a screen shot of the results to. It won’t paste in here.
    Brian Chesnutt: high speed

    Diliesa : As I have checked, you are only paying for the 5 Meg Internet Package.

    Diliesa : It can give you a download speed of 5 Mbps download speed.

    Brian Chesnutt: well, my upload speed is 49.56Kb/s right now.

    Diliesa : And as I have checked it on the provisioning tools for your speed package, you are receiving a lot. I will be provisioning it to the 5 Meg internet Package instead of 10 Meg Package.

    Brian Chesnutt: do you have the email address I can send the screen shot to tech support. It will not paste in this screen

    Currently experiencing network delays, one moment please….

    Diliesa : Please read my responce.

    Network connection re-established.

    Brian Chesnutt: no, 10 was part of the deal they offered me on the phone

    Diliesa : I will be reprosioning your speed into 5 Meg Internet Package.

    Diliesa : You are only paying for 5 Meg Internet Package, Brian. Your modem might not be capable of receiving the 10 Meg Internet Package.

    Diliesa : I would advise you to powercycle your modem and computer after we chat because I will

    Brian Chesnutt: no, they offered me 10 when I re-signed. Anyway, please send me the tech support address so I can email them a screen shot of the NDT results. I can’t paste them in here

    Brian Chesnutt: I am paying for the 10 package, that was part of the deal when I re-signed.

    Brian Chesnutt: i did power cycle it.

    Diliesa : Do you want me to upgrade your billing information right now? As I can see here, you are paying for the 5 Meg Package for about $29.99.

    Brian Chesnutt: no, I don’t want an upgrade, please send me the address for tech support. I don’t need an upgrade because I am already getting high speed

    Currently experiencing network delays, one moment please….
    Currently experiencing network delays, one moment please….

    Diliesa : I cannot do that.
    Network connection re-established.

    Brian Chesnutt: anyway, I wrote about a problem and I just need the email address for tech support. Thanks!

    Brian Chesnutt: you can’t give me the email address?

    Diliesa : Brian, the reason why you are not receiving a stable speed is because your modem might not be capable of receiving the 10 Meg Package.

    Diliesa : Please powercycle your modem and your computer, so you may received the new signal. I have reprovisioned your signal to 5 Mbps download speed and 512 Kbps upload speed.

    Currently experiencing network delays, one moment please….

    Diliesa : If you want to receive the 10 Meg Internet Package, just contact us at 1-888-438-2427 to have a service upgrade. You can also chat us back for more information about this package.

    Diliesa : Thank you for choosing Charter Communications…. disconnects

  29. dhawk
    February 27th, 2008 at 21:54 | #29

    I have charter and live in GA – this isn’t the exact same thing but your solution resolved the problem i was having. Had one particular website i could not get to because charter was not resolving the dns. I change the dns from automatic to specific IP and then i was able to get to the site. FYI in case anyone else runs across this.

  30. Jeff
    February 27th, 2008 at 23:42 | #30

    I just Found this page and am not nearly as computer literate as you all. I have been having problems with charter for sometime now.
    Let me give you come info before i bitch though. I live in Northern California. I use Mozilla Firefox for my browser, I pay for a 10Mb connection and according to Speakeasy Speed Test 10mb is what I’m getting;

    Last Result:
    Download Speed: 10653 kbps (1331.6 KB/sec transfer rate)
    Upload Speed: 957 kbps (119.6 KB/sec transfer rate)

    Although the test says I’m good most of my website pages load up like I was using dial-up. As I said before I use firefox so I’ve been able to try tweaking firefox to improve performance, yet nothing has improved my performance.
    Like other users have noted the change in my service came after a long period of no service, before this mysterious shutdown I was able to generate up to 30Mb/ps by tweaking my browser (See Boost Firefox) and my browser behaved like it should have very fast. Im not so sure that speakeasy is giving me accurate information, My friends dialup is just as fast.
    Maybe someone in here could give me some hints as to what’s happened to my net speed.
    Jeff

  31. August 19th, 2008 at 22:08 | #31

    I have Charter out of Sanford/Lillington, NC. Since the whole DNS hijack thing a few weeks ago, I changed DNS servers. I have set up my router to forward DNS requests to opendns.com's DNS servers.They are

  32. August 19th, 2008 at 22:09 | #32

    they are quicker than charter and work great!

  33. Oregoonian
    September 27th, 2008 at 00:32 | #33

    FUCK CHARTER. I live in Gold Beach, Oregon. These jerk-offs not only hijack our browser but also redirect websites like foxnews.com to their search page. Funny how CNN comes through without problem……. Avoid these fraudsters like the plague!

  34. January 8th, 2009 at 20:55 | #34

    I just found this bc i was looking how to change charter taking over my search page. I cant believe they are getting away with this since it seems to be 2 years since people online have been talking about it.

    You can try emailing the GM, he advertises his email address on the radio here in st. louis, its stevegm@charter.net

    hopefully more people can see this and lets hope they do the right thing.

  35. Larry Anderson
    March 12th, 2011 at 15:54 | #35

    This a.m. I accessed Internet by laptop through wireless connection through router/modem at private residence (Charter ISP) Eau Claire, WI. When I attempted a simple search (via Bing) I was directed to a (Charter) page where I was given very simple results of my search. I was informed that they have [I forget their exact wording]… joined with Yahoo, Bing, Google to provide a better access to available inf, etc. (or words to that effect).

    This upset me as I have used Bing consistently and wish to remain with that setup. I don’t need someone else determining how my activities on the Net will be affected. Also on that page, I was told I could go to “preferences” page and “disable this option”. I followed that direction (by link at top of page), to the “preferences” page (also Charter) and spent long minutes trying to locate any kind of “opt out” link or any means of making a change. I could find nothing!

    After closing those pages I then tried to simply highlite a term on another random page being displayed… chose the “search Bing” option… I was surprized when I was returned to the original search page (at Charter)… where I am left with no option to “disable this feature” as promised on the original page.

    I’m wondering WHAT GIVES…???? I wonder if this is an indication of the illegal efforts by the FCC to “neutralize” the Internet (which they continue to persue despite orders by congress and the courts). Perhaps they are doing some beginning experiments at re-direction and diverting certain chosen communications to a cyber-death!

    I plan to seek some answers from Charter… if I can find a way past the insulating maze of phone referrals, etc and trying to speak with someone in another state across the nation – and that with one who can barely speak English!!!!!!!!!!!

    Oh, yes… I have Bing selected as home page… and that still takes me directly to Bing Search.

  36. Awake
    November 16th, 2011 at 02:58 | #36

    Several years pass, and this is still happening.
    Charter will not allow you to do a search from the address bar without redirecting you.
    The only apparent solution is to change your router to a static DNS such as OpenDNS, so the Charter DNS doesn’t mess with you.
    Maybe someday they will realize that stuff like this is what kills businesses, since I would not recommend them (who knows what less obvious stuff they are doing with your data), and I’m the guy that people tend to ask for ISP advice.

  1. February 19th, 2007 at 09:00 | #1
  2. July 1st, 2007 at 22:00 | #2
  3. July 26th, 2008 at 23:57 | #3