Robert MacLean

Telkom is using a man-in-the-middle attack to change your websites

Published on Estimated reading time: 5 minutes

Part 2 is here, click that now (it will open in a new window) so you can continue when you’re done here.

The following is a screenshot I took of a webpage in Chrome. If you visit that same website, you’ll experience a different result because Telkom is using techniques similar to a man-in-the-middle attack to modify the website’s code and inject its own content.

Clipboard01

The key addition—visible in the lower right corner of the page—was inserted by Telkom without the website owner’s or Telkom ISP customer’s permission.

Image

While this seems harmless—even potentially useful—it’s deceptive. Even this seemingly minor change could cause major issues.

Breaking websites

Telkom cannot predict how this injection will affect every website on the web. While I’ll explain the technical details below, the core issue is that they’re injecting JavaScript into every page. This extra code could conflict with existing scripts, leading to unpredictable behavior and broken websites. Given the internet’s scale and complexity, it’s impossible to guarantee that no website will be disrupted.

Exposing security risks

The second major issue is the security vulnerability this creates. Telkom may argue their code is secure now—and it’s true for now—but security is never static.

They’re using an outdated version of jQuery (version 1.7.1), which has no reported vulnerabilities yet. But security flaws can emerge at any time. If a vulnerability is discovered in this library or in Telkom’s injected code, attackers could exploit it to launch attacks against users. Do you trust Telkom’s developers that much to have no security flaws?

A second risk: Telkom must host the servers and systems running this injection. If those servers are compromised—by hackers or even a disgruntled employee—they could be used for XSS attacks or key sniffing. As awareness grows, these servers will become prime targets. It’s only a matter of time before they’re breached.

Violating net neutrality and privacy

While ISPs should monitor traffic (with oversight), this practice makes it far too easy for Telkom to intercept and manipulate your data in ways you won’t even notice.

Telkom claims they handle this responsibly—but what prevents executives from using this to block unwanted content (e.g., MTN ads) or suppress websites critical of them (like those supporting the EFF or DA)? Without transparency or consent, do you trust them not to abuse this power? Their actions violate a core principle of the internet: net neutrality.

Performance impact

Lastly (though least concerning), Telkom forces users to download ~84.8 KB of extra JavaScript (see data here) and ~120 KB of extra images. This manipulation also slows down page rendering, increasing load times and bandwidth usage. They introduce unnecessary network hops, further degrading performance.

Technical details

Telkom only targets HTTP traffic—not HTTPS, which is encrypted. While HTTPS should be secure, it’s not impossible to bypass (as seen in the Superfish controversy). While unlikely, they could extend this to secure sites if motivated.

How it works

Telkom doesn’t alter the original HTML—they inject JavaScript after it loads. Here’s how:

  1. A website loads a JavaScript file (e.g., jQuery).
  2. Instead of fetching it directly, Telkom’s proxy intercepts the request.
  3. If the file is JavaScript, Telkom reroutes it to their server.
  4. Their server fetches the original file from the real website.
  5. Telkom appends their own code (including jQuery 2.0.1 and custom scripts).
  6. The modified file is sent back to your browser.

Normal flow (unmodified): Example1

  1. Browser requests a file.
  2. Request hits Telkom’s proxy (for caching/performance).
  3. Proxy fetches from the original server if needed.
  4. Unaltered file returns to the browser.

Modified flow (Telkom injection): Example2

  1. Browser requests JavaScript.
  2. Telkom’s proxy detects it’s JS and reroutes the request.
  3. Their server fetches the original file.
  4. Telkom appends their code.
  5. Modified file returns to the browser.

Evidence of injection: You can spot this by checking JavaScript file URLs—they redirect through Telkom’s servers, e.g.:

http://196.25.211.41/n/50fc073bb429a4eb303a6420235e9381.js?q=Pb4KQL0xYJ%2F53kOn%2FSnvQA%3D%3D%7C1435397545%7C02dfd5fbe207b80c1859ed08333cd16d&url=http%3A%2F%2Fajax.googleapis.com%2Fajax%2Flibs%2Fjquery%2F1.7.1%2Fjquery.min.js

Note: These URLs only work on Telkom’s network.

FAQ

Is this definitely Telkom’s doing?

Yes. I tested this on:

Windows Phone/Edge jQuery on Edge

How are they injecting content without changing the HTML?

JavaScript can dynamically modify the page. Here’s the original HTML (source) vs. the rendered output:

Original vs. Rendered

Could this be an agreement with website owners?

No. This affects all HTTP sites, including:

StackOverflow never approved this.

Examples of the injected code

Why don’t I see this?

Possible reasons:

How can I protect myself?

  1. Opt out via Telkom’s tracker: https://secure.telkomsa.net/titracker (unverified effectiveness).
  2. Use HTTPS Everywhere: Install the EFF’s extension to force encrypted connections.
  3. Switch ISPs if you don’t trust Telkom with your data.

Opting out isn’t enough.

Updates