• Your favorite

    Apple

    ,

    iPhone

    ,

    iPad

    ,

    iOS

    ,
    Jailbreak
    , and
    Cydia
    site.
  • AT&T vs Unlimited Plan Users: Round 2


    We reported that AT&T was cracking down on tethering 3 weeks ago, and it looks like they're up to it again. Based on forum comments, we've summarized what we're seeing from AT&T.

    The first round appeared to be users on AT&T unlimited data plans that used more than 10GB of data in March. The latest round appears to be similar users using more than 5GB in March. It appears AT&T is on a data witch hunt. We've seen the message sent to users who simply use a lot of bandwidth (and never even tether/jailbreak) as well as users that use unauthorized tethering. What's most shocking is that many users have reported calling AT&T and were asked if they were using Netflix, Pandora, etc. Some have been told that using those services is the definition of tethering. We're not sure if this is coming down from the AT&T top, or if this is simply non-technical AT&T customer service reps that are confused about what tethering is. However, based on the number of user reports, and the chances that users are very likely reaching different reps, this seems like deliberate AT&T rep training. Seemingly unethically, many customers are being convinced to pay for a tethering plan when they're in fact not tethering at all.

    For users that have been wondering, here's some analysis and summarization of posts across the forums:

    1. Some users who never have jailbroken have stumbled upon our forums and have reported that they have received the infamous "Did you know tethering your Smartphone ....?" texts.
    2. Users of MyWi, PDANet, and TetherMe have received the texts.
    3. Users are of all iOS's versions (at least we've seen 3.1.3 - 4.3). There's no iOS version pattern.
    4. Only unlimited data plan users are receiving the texts.


    As AT&T is only pursuing unlimited data plan users, it seems this is most likely a data witch hunt rather than anything else. Obviously, if AT&T starts pursuing 2GB capped plans, then I think the perspective changes. It may simply be that they're chasing the biggest users right now.

    Need To Know Information on Tethering

    We've got a fairly techy community here, and users have been speculating all sorts of ways AT&T could be monitoring. We wanted to clear up some of the misinformation:

    1. HTTP User Agent: As some AppStore apps allow different user agents, this is not a 100% positive indiciator.
    2. DNS entries: Your tethered OSX/Windows computer hits specific entries like windowsupdates.microsoft.com. This is a pretty good indicator that your tethering with an OS other than iOS. While you could argue that you could point your browser to these URL's, that doesn't explain why data was transferred back and forth. (If you want to make an app that you can install on your iPhone that simulates the communication of Windows update chatter and send that to AT&T as an explanation, we wish you luck!). This does not apply for iPad to iPhone tethering of course.
    3. Content: Your Safari browser won't download Flash. Given that Flash is in widespread use, most pages you visit on a tethered PC will access Flash content. However, this is also not a 100% positive indicator as you could have installed comex's awesome Frash.
    4. TCP signatures: OS's have specific ways of ack/nack, TTL (time to live) start, congestion, and more for TCP requests/responses. It's possible to guess at the OS based on these signatures. However, because the tethered device is behind the NAT, active fingerprinting is not possible. Passive fingerprinting is possible if the tethering app is not completely rewriting the packets, using elements like OS IPid patterns, ttl, and others.


    These seem to be the 4 big mentions - with the DNS entries to OSX/Windows updates being the most vulnerable (and probably least likely to be used). We're guessing it's probably #4. While that's probably the most network appliance intensive, it appears AT&T only has a few huge pipes for it's 3G network traffic to go out of, so there's not many places this needs to be done. Unless of course it's PURELY based on the amount of data - possible, since users are asked if they "use Netflix or Pandora."

    We'll do a roundup on what each of the tethering apps do with respect to TCP signatures, as we're strongly convinced AT&T's data witch hunt has no merit (again, evidenced by many users that don't tether at all receiving those "nasty" messages simply because they have an untethered plan and are using > 5GB per month). We'll have another article with our analysis of tethering apps TCP signatures in the next few days!
    This article was originally published in forum thread: AT&T vs Unlimited Plan Users: Round 2 started by Kyle Matthews View original post
    Comments 38 Comments
    1. Cody Overcash's Avatar
      Cody Overcash -
      test
    1. ynotrhyme's Avatar
      ynotrhyme -
      My cutoff date for my plan to get automatically changed is the 29th, lets see what happens.
    1. Browning151's Avatar
      Browning151 -
      Just got a second text this morning from AT&T:

      Quote Originally Posted by AT&T View Post

      AT&T Free Msg: We've noticed you're continuing to enjoy the tethering feature with your smartphone service. Remember, you need a tethering plan ($45/mo, incl. 4GB) to use this feature, so we're planning to update your line with the required plan soon. Visit att.com/dataplans or call 866-679-7118.
      Called the number and got their "specialist" department or whatever it was that I got the first time I called, she said they still indicated that I was tethering and that my plan was being changed. My original date was April 16, after getting the first message I cut my data usage from 14gb down to about 6 and I quit using MyWi around the 20th and it went down to about 5gb between Apr 11 to May 11 and since May 11 I've only used 199mb this month. The lady in that department said there was nothing that I could do and that it was going to be changed to the $45 plan, period, nothing I could do about it. I tried to get her to transfer me to someone else and she pretty much flat out refused and said that there was no one else I could talk to except the "presidents office" and she refused to transfer or give me a number to that office. I hung up with her, found the number to the presidents office of investor relations for my region, explained that I had quit doing everything in the long list of things they told me could be considered tethering very calmly. The lady I spoke to there checked my account and noticed there was a corporate discount through my moms employer since we share a family plan, took down all my information and said she was going to forward it to their business something or other department within the presidents office and that they would be in touch with me within 24 hrs. I will update with what happens once I hear from them, but apparently AT&T isn't bluffing and they are starting to change plans now.

      TL;DR

      I tethered ~4 days or so past the cut off, haven't used it since and drastically reduced data usage and still getting the wrath of AT&T and they say there is nothing that can be done to stop my plan being changed.
    1. MacDevil7334's Avatar
      MacDevil7334 -
      While that certainly sucks, AT&T was also quite clear that if you tether past the date on the notice, your plan will be changed. You tethered after the date and now are receiving the promised consequence. I hope you can talk your way out of it, but I'd say its a long shot since you have already admitted getting the first notice and tethering past the indicated date.
    1. Browning151's Avatar
      Browning151 -
      Quote Originally Posted by MacDevil7334 View Post
      While that certainly sucks, AT&T was also quite clear that if you tether past the date on the notice, your plan will be changed. You tethered after the date and now are receiving the promised consequence. I hope you can talk your way out of it, but I'd say its a long shot since you have already admitted getting the first notice and tethering past the indicated date.
      Yes, my fault, I agree. The only reason I tethered past the date was that I actually had forgotten about it, no excuse, just what happened, and I never told AT&T that I was actually using tethering. Hopefully I can get it stopped, but just a word of caution to others still using MyWi or possibly other tethering options, AT&T isn't bluffing and they will change your plan so continue at your own risk.
    1. js81082's Avatar
      js81082 -
      I talked to the special dept because I got the second text and she explained to me how they can tell if your tethering they notice if something irregular comes from your data and that is how they are able to determine tethering and if your peruse the issue they have the right to monitor and look deeper to find where the irregular comes from it's in the terms and not worth fighting
    1. jeffs64's Avatar
      jeffs64 -
      I feel bad for the people who get their plan changed. If you were worned and continued to tether after you got the text then not too much to say but, I guess At&T is not fooling around with this. I am running 4.3.3 32Gb 3Gs Fully Jailbroke and never got the text or E-mail used about 3 Gb last month. Also I wonder if the people that are near the end of their contrack are getting the message. Or are they are looking for people with a long term left on their contrack. Mine will expire on 7.3.11
    1. ynotrhyme's Avatar
      ynotrhyme -
      My contract ends in a month and i got the warning... Im also cancelling my account if my plan gets changed, i know thats for sure.
    1. Dragonsoul80's Avatar
      Dragonsoul80 -
      I havent got the notice yet, I'm using an iPhone 4 32gb running 4.3.3 ( just upgraded a few days ago ) also I only tether my iPad 1st Gen ( TTL changed ) and I use around 7 or 8 GB a month , I used PDAnet with hide level one for about a month, I've been using tetherme for about 3 weeks now
    1. ynotrhyme's Avatar
      ynotrhyme -
      Is the data downloaded off newsgroups a really easy thing to detect compared with average user surfing data? Just wanna know just in case.
    1. cldipad's Avatar
      cldipad -
      Sorry guys... I've been reporting that I have been using TetherMe and changed the TTL on my iPad and laptop without a problem. I received the second TOD. I called ATT and they said something is triggering tethering. Well I am tethering, but I didn't say that. I played dumb and she asked what apps I use because they are having issues with some applications showing as tethering. She said Netflix is a problem if the phone is plugged into anything other than the wall to charge. I'm not sure what they would see. She said that LogMeIn is also a problem. I told her I do connect to my computer and I use an app to log into my work computer for email. She seemed to think that might be the problem. She didn't say anything about jailbreaking but did refer to the handylight app. I asked her to check the other lines on my account and she said my wife's line was flagged. That raised a red flag for me because my wife's phone has never been jailbroken. I thought it might be because I'm the primary, but the CSR assured me it wasn't. I filed their "appeal" so they could look into it. She said I wouldn't hear for a couple months. Not sure what I'm going to do at this point. I'm not under contract so I don't mind leaving. Verizon? Probably the same BS eventually.
    1. Larzen23's Avatar
      Larzen23 -
      So this means all of these illegal tethering of ATT users will get switched SOON to a $45 tethering plan even if they use tetherme or planet level 2. No more tethering then. Just wifi.
    1. Dragonsoul80's Avatar
      Dragonsoul80 -
      Quote Originally Posted by cldipad View Post
      Sorry guys... I've been reporting that I have been using TetherMe and changed the TTL on my iPad and laptop without a problem. I received the second TOD. I called ATT and they said something is triggering tethering. Well I am tethering, but I didn't say that. I played dumb and she asked what apps I use because they are having issues with some applications showing as tethering. She said Netflix is a problem if the phone is plugged into anything other than the wall to charge. I'm not sure what they would see. She said that LogMeIn is also a problem. I told her I do connect to my computer and I use an app to log into my work computer for email. She seemed to think that might be the problem. She didn't say anything about jailbreaking but did refer to the handylight app. I asked her to check the other lines on my account and she said my wife's line was flagged. That raised a red flag for me because my wife's phone has never been jailbroken. I thought it might be because I'm the primary, but the CSR assured me it wasn't. I filed their "appeal" so they could look into it. She said I wouldn't hear for a couple months. Not sure what I'm going to do at this point. I'm not under contract so I don't mind leaving. Verizon? Probably the same BS eventually.

      I'm so sorry they cracked down on u man, I havent got anything yet , if I ever get caught Ill just Get the 2GB PLAN for my iPad , I can live with no tethering , and u were using tetherme lately right? It could b that since u got the first notice they been keeping taps on u, I'm wondering how r they missing me for so long I'll keep the forum updated
    1. cldipad's Avatar
      cldipad -
      Quote Originally Posted by Dragonsoul80 View Post
      I'm so sorry they cracked down on u man, I havent got anything yet , if I ever get caught Ill just Get the 2GB PLAN for my iPad , I can live with no tethering , and u were using tetherme lately right? It could b that since u got the first notice they been keeping taps on u, I'm wondering how r they missing me for so long I'll keep the forum updated
      Thanks for the support. I might just pick up the $25 iPad 3G service. Then I don't have to tether. It's still a bunch of crap. What still has me bothered is the flagging on my wife's line when she hasn't jailbroken. Can't figure that one out. I have been using TetherMe for a while but I did use PDANet for a short time after my cutoff date. They could have caught me then. Another interesting thing is that I don't see people on the 2G capped plan getting the notice. I'm sure there are people tethering with that plan. Why aren't people with the unlimited iPad plan (ATT originally offered) or capped iPad plan getting flagged? What about Android users who rooted their device to tether for free? This seems to be specifically targeted at unlimited iPhone plans. If they change my plan, I'll fight it and ask for proof. I want to see what they're looking at. I probably won't get it, but I figure I'll give it a shot. I don't mind harassing ATT a little. If I do get proof, all of you will be the first to know. BTW... The CSR said I should hear from someone in one to two months. She said if I don't hear anything then it's good news. Now that's customer service.
    1. ynotrhyme's Avatar
      ynotrhyme -
      A friend of mine just called me and told me his story. He told me that he received a tod on the 17th of may and that he called on the 19th and they told him that if he continued tethering after the 19th that he would have his plan changed. He told me that he continued tethering with PDANET Hide Level 2 and that he called today just to check (8 days of tethering heavy later)and he spoke with some lady that told him that his plan hasn't been changed yet? He also told me that the lady told him that if they did detect tethering again they would send him a 2nd warning stating they were in process of changing the plan which he never got even though he has been tethering an heavy he told me 70gb. So I dunno y'all take his story how you wish but it seems to me that the PDAnet might be safe guarding him for now. I say to myself, can it be safe to say since he hasn't received a 2nd tod warning even though he is still tethering a sign he's clear or is it that they're waiting to send the 2nd tod? How long does it usually take for the 2nd tod to show up if you are caught tethering? Im bringin this to the table hoping it sheds some sort of light... Prolly not hahaha. Let me knOw what y'all think..

      Cheers
    1. hailtoredskins's Avatar
      hailtoredskins -
      reading all these posts r making me hate att even more...the worst part is that i use att
    1. Browning151's Avatar
      Browning151 -
      Quote Originally Posted by ynotrhyme View Post
      A friend of mine just called me and told me his story. He told me that he received a tod on the 17th of may and that he called on the 19th and they told him that if he continued tethering after the 19th that he would have his plan changed. He told me that he continued tethering with PDANET Hide Level 2 and that he called today just to check (8 days of tethering heavy later)and he spoke with some lady that told him that his plan hasn't been changed yet? He also told me that the lady told him that if they did detect tethering again they would send him a 2nd warning stating they were in process of changing the plan which he never got even though he has been tethering an heavy he told me 70gb. So I dunno y'all take his story how you wish but it seems to me that the PDAnet might be safe guarding him for now. I say to myself, can it be safe to say since he hasn't received a 2nd tod warning even though he is still tethering a sign he's clear or is it that they're waiting to send the 2nd tod? How long does it usually take for the 2nd tod to show up if you are caught tethering? Im bringin this to the table hoping it sheds some sort of light... Prolly not hahaha. Let me knOw what y'all think..

      Cheers
      I doubt he would get a notice within 8 days. I got my first notice on Apr 7 and when I called I was told to stop by the 16th, tethered until about 25th then quit completely, got my second notice on May 23 roughly 45 days between the two. I may finally have been able to get mine straightened out to keep my unlimited data plan but will have to wait til June 13 to know for sure.
    1. ynotrhyme's Avatar
      ynotrhyme -
      Quote Originally Posted by Browning151 View Post
      I doubt he would get a notice within 8 days. I got my first notice on Apr 7 and when I called I was told to stop by the 16th, tethered until about 25th then quit completely, got my second notice on May 23 roughly 45 days between the two. I may finally have been able to get mine straightened out to keep my unlimited data plan but will have to wait til June 13 to know for sure.
      You continue tethering? Is that why ur waiting till June?
    1. Browning151's Avatar
      Browning151 -
      Quote Originally Posted by ynotrhyme View Post
      You continue tethering? Is that why ur waiting till June?
      No, I quit tethering completely about 9 days after my "cut off" date because I forgot about the date. June 11 is the date my billing cycle starts over and my plan is supposed to be changed and the rep that I have been dealing with said to call on the 13th (because 11th is a saturday so they won't be in the office until that monday) and they would put my unlimited plan back on so long as I didn't continue to tether and my account wasn't flagged again. Also FWIW I was using MyWi.
    1. ynotrhyme's Avatar
      ynotrhyme -
      Ok..lemme know how that goes. Good luck!

      Cheers