[ NNSquad ] Tethered vs embedded web browsing endpoints

[Tod Beardsley <todb@planb-security.net>]

Hi NN Squad.

A friend clued me in to your mailing list, after I told him I was 
messing around with a tethered computer on AT&T's Blackberry network. 
The most interesting fact I found was that when you use the on board 
browser, your web requests are proxied through RIM, in Canada. However, 
when you're tethered (ie, using another computer connected to the 
BlackBerry, and using the device as a ppp access point), you pop out of 
AT&T's network (in my case, Florida).

This is interesting because I can't find a way to turn off the RIM 
proxying within the phone (I'm using a BlackBerry 8310). I have no idea 
what impact this might have on DPI or other privacy concerns, or on data 
plan billing (I do not pay any extra fee for tethering, so we'll see if 
this all counts as an overage or something). One cornball conspiracy 
theory I came up with was that browsing on the phone automatically makes 
all communications "foriegn communications" for the purposes of FISA 
court wiretapping warrants.

In my test run, the RIM-based proxy server was at 206.53.157.56.
    OrgName:    Research In Motion Inc.
    OrgID:      RIM-9
    Address:    295 Phillip Street
    City:       Waterloo
    StateProv:  ON
    PostalCode: N2L-3W8
    Country:    CA

The AT&T-based proxy was at 32.178.218.129:
    OrgName:    AT&T Global Network Services, LLC
    OrgID:      ATGS
    Address:    3200 Lake Emma Road
    City:       Lake Mary
    StateProv:  FL
    PostalCode: 32746
    Country:    US

At any rate, if you've similarly goofed around inside AT&T's tether 
network, I'd love to hear from you -- especially if you can tell me what 
the service is running (on apparently several computers) at TCP/1111. 
(Hint, it has nothing to do with Flash).

Thanks! If this is inappropriate for this list, please let me know and 
I'll shut my yap.

-tod