Solving Distributed Retail IT Challenges with MITM-DOMAIN-CONTROLLER

9-minute read • homemadesoftware.net

A retail shop runs many computers at its checkout counters, using Windows, macOS, and Linux. One day, the shop installed a required sales app from a partner company. Right after that, every computer began opening a survey popup window each time it started up. Workers had to deal with this every single morning before they could even begin their work.

It got worse. If a worker closed the popup without answering it, the vendor's system marked it as "Viewed." That triggered follow-up sales calls the shop did not want. And when the shop's IT team tried to remove the files that caused the popup, a hidden background helper inside the sales app quietly put the files back every time the computer restarted. Normal fixes could not win this fight, so the shop asked us for help. This is the story of how we fixed it for one store using our tool, MITM-DOMAIN-CONTROLLER, and then how we used the exact same idea to protect hundreds of stores at once.

The fix: stop the popup before it can even ask for the page

We put our tool, MITM-DOMAIN-CONTROLLER, in charge of controlling the sales domain. We told it one simple rule: whenever a computer sends traffic for sales feedback domain we tell it to block.

The policy ensures that the traffic doesn't not go anywhere for this domain. So the device tries to open the popup, fails right away, and shows nothing. The background helper inside the sales app can keep putting its startup files back all day long. It does not matter, because the application can't reach it no matter what. Nothing needed to change on the computers themselves, and every other website the shop uses, including its own billing software, kept working normally.

How MITM-DOMAIN-CONTROLLER decides what to block

The good part about this fix is how precise it is. MITM-DOMAIN-CONTROLLER only blocks the one website address we tell it to block. Every other address, from any computer, still works exactly as before:

From one store to every store

The fix worked so well at the first store that the shop's owner asked us for something bigger: could we do this for every store in the whole company, right away, without visiting each one? Doing this by hand on hundreds of computers across many stores would take a lot of time and people, and it would be easy to miss a computer or make a mistake. New computers arriving at new stores would also start out unprotected until someone remembered to fix them by hand. We needed one central place to manage the rule for every store at once.

One rule, every store, automatically

We placed a single copy of MITM-DOMAIN-CONTROLLER in charge of the whole company's network and wrote one rule for it in a simple configuration file

Then, at each store, we changed one setting on the store's internet router, called DHCP, so that every device connecting to the store's network would automatically be told to use MITM-DOMAIN-CONTROLLER for its website lookups. That is the only change needed. A new laptop, tablet, or handheld scanner is protected the moment it joins the store's WiFi or network cable, with nothing installed on the device itself. For laptops that travel between locations, we also set a backup network profile so the same rule still applies wherever they connect. If the popup's address ever changes, we only have to update it in one place, and every store gets the update right away.

You do not need hundreds of stores to use this

This story happens to be about a retail chain, but the fix itself has nothing to do with being big. The exact same router setting and the exact same one-line rule work just as well on a single router at home, a small business with a handful of computers, or a personal project on your desk. If an app, a smart TV, or any device on your network keeps opening a popup or "calling home" to an address you do not want it to reach, MITM-DOMAIN-CONTROLLER can block just that one address while leaving everything else on your network working normally, whether that is one device or a thousand.