Risk
10/10/2013
02:21 PM
Connect Directly
RSS
E-Mail
50%
50%

Advertisers Evade 'Do Not Track' With Supercookies

Many popular sites use JavaScript and Flash font probes to track users and their browsing habits across multiple devices, researchers say.

How many websites today are using latest-generation supercookies to secretly track a person's browsing habits across different websites, and even when they use different devices?

According to a new report, "FPDetective: Dusting the Web for Fingerprinters," from privacy researchers in Belgium and the United States, at least 404 of the world's 1 million most popular websites are using a never-before-seen tracking technology that fingers devices while evading detection. The researchers are due to present their paper at next month's 20th ACM Conference on Computer and Communications Security in Berlin.

Fingerprinting refers to creating a unique signature for a browser -- whether on a PC or mobile device -- that allows a tracking firm to watch which sites a user visits, no matter which device they're using. "Fingerprinting user devices through the browser is an increasingly common practice used of advertising and anti-fraud companies," according to the researchers.

But it's a practice that may exist in a legal gray area. "Stateless user tracking allows advertising companies to sidestep the limitations imposed by regulation on cookies in Europe and the United States," according to the researchers. "Moreover, with the advent of smartphones and tablets, fingerprinting allows advertisers to augment previously gathered user data and track the user across devices."

[ Privacy groups are suing the NSA over its call-tracking programs. Read NSA Lawsuit Proceeding, Despite Government Shutdown. ]

The researchers said their discovery of 16 new fingerprinting scripts and Flash objects, as well as counts of the sites using the technology, demonstrates "that fingerprinting is much more prevalent than previous studies estimated." Furthermore, while the total number of sites -- just 404 -- on which they found the JavaScript tracking technology might seem small, they cautioned that their Web crawling targeted only homepages, and couldn't penetrate paywalls or any site with a Turing test.

The JavaScript-based fingerprinting technology is being sold or distributed by tracking firm BlueCava, Bitcoin digital wallet provider CoinBase, geolocation and "online fraud prevention" firm MaxMind, and consumer tracking provider Mindshare Technology, among other companies. Some of those fingerprint scripts appeared to actively try to evade detection by deleting themselves as soon as they'd run and relayed a fingerprint to a third-party server.

BlueCava's font-probing JavaScript code was the most prevalent such script detected by the researchers, and ran on the homepages of 250 sites that are included in the Alexa index of the 1 million most popular websites. "[BlueCava's] is the only one of the discovered font-probing scripts that queries different sets of fonts based on the device's operating system: 231 fonts for Microsoft Windows, 167 for Mac OS and 62 for other operating systems," said the researchers.

The researchers also looked for Flash-based fingerprinting technology, although only on the world's 10,000 most popular websites as ranked by Alexa, and detected the technology in use on 95 of those sites.

Cookie-free tracking technologies -- often referred to as supercookies -- are typically designed to avoid detection as well as users' attempts to block the technology. Likewise, the technology historically hasn't ever been deterred by the presence of an active "do not track" flag in a user's browser. Many privacy advocates have long held that the only way to stop the cookies will be through legislation that requires websites to disclose the tracking technology they're using, as well as to respect people's DNT preferences.

Might an anonymizing browser, such as Tor, help block the latest generation of supercookies? While that would theoretically help a user defeat the tracking mechanisms, in fact Tor doesn't restrict the browser's ability to call system fonts, meaning Tor users' devices can still be fingerprinted using the font-probing techniques. But the researchers said they've alerted Tor to the vulnerability, and that it's been fixed in the forthcoming source code and version 2.4 of the Tor browser bundle.

Going forward, the researchers said they plan to release the source code for the tool they developed to crawl the Web in search of fingerprinting technology, which they dubbed FPDetective. They built it using modified versions of the PhantomJS "headless" Webkit browser, as well as the Chrome browser. FPDetective includes the ability to relay Flash files through "an SSL-capable intercepting proxy," which allowed the researchers to capture, decompile and analyze the font-probing Flash files using third-party tools.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
10/10/2013 | 7:05:05 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
I'm not entirely clear on why sites need/want to track us THAT closely. What's the payoff, exactly?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/10/2013 | 8:15:01 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
First, this type of personal information is a commodity -- it can be bought and sold (for profit). The more information, the more valuable the record associated with a given person.

Second, it gives advertisers "richer" insights into individual consumers (i.e. you and me). Visit a website that's concerned with menopause, pregnancy, erectile disfunction, baseball or divorce -- and the advertiser's algorithms can spot that and serve up more targeted (and thus theoretically likely to get clicked on and converted to a sale) advertising. And every click or completed sale equals revenue for the advertiser and commissions for affiliates.

The "benefit" for consumers, or hit to our privacy? That's open to debate.
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
10/10/2013 | 8:31:49 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
Ah, got it. Thanks.

And I'd say the answer to your question is: Both.
NG11209
50%
50%
NG11209,
User Rank: Apprentice
10/10/2013 | 9:15:12 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
I remember the do-not-track debate from my time working at a direct & digital marketing trade publication. This report makes it seem that the debate has shifted more to a steroids-in-baseball-style arms race, with one side racing to stay ahead of the rules. The New York Times has some recent reporting on the subject as well, so it's clearly in the public consciousness GÇö I wonder (if we ever have a functioning government again) if some legislation to codify what's appropriate is coming.
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/11/2013 | 9:49:09 AM
re: Advertisers Evade 'Do Not Track' With Supercookies
Arms race is the right metaphor. For every tracking technology that gets excoriated by privacy rights groups or interrogated by regulators/legislators, another one springs up.

That's why having a higher-level take on this might create the concept of user rights that aren't tied to technology, and thus subject to abuse, and get more people on the same page.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.