Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Advertisers Evade 'Do Not Track' With Supercookies

Many popular sites use JavaScript and Flash font probes to track users and their browsing habits across multiple devices, researchers say.

How many websites today are using latest-generation supercookies to secretly track a person's browsing habits across different websites, and even when they use different devices?

According to a new report, "FPDetective: Dusting the Web for Fingerprinters," from privacy researchers in Belgium and the United States, at least 404 of the world's 1 million most popular websites are using a never-before-seen tracking technology that fingers devices while evading detection. The researchers are due to present their paper at next month's 20th ACM Conference on Computer and Communications Security in Berlin.

Fingerprinting refers to creating a unique signature for a browser -- whether on a PC or mobile device -- that allows a tracking firm to watch which sites a user visits, no matter which device they're using. "Fingerprinting user devices through the browser is an increasingly common practice used of advertising and anti-fraud companies," according to the researchers.

But it's a practice that may exist in a legal gray area. "Stateless user tracking allows advertising companies to sidestep the limitations imposed by regulation on cookies in Europe and the United States," according to the researchers. "Moreover, with the advent of smartphones and tablets, fingerprinting allows advertisers to augment previously gathered user data and track the user across devices."

[ Privacy groups are suing the NSA over its call-tracking programs. Read NSA Lawsuit Proceeding, Despite Government Shutdown. ]

The researchers said their discovery of 16 new fingerprinting scripts and Flash objects, as well as counts of the sites using the technology, demonstrates "that fingerprinting is much more prevalent than previous studies estimated." Furthermore, while the total number of sites -- just 404 -- on which they found the JavaScript tracking technology might seem small, they cautioned that their Web crawling targeted only homepages, and couldn't penetrate paywalls or any site with a Turing test.

The JavaScript-based fingerprinting technology is being sold or distributed by tracking firm BlueCava, Bitcoin digital wallet provider CoinBase, geolocation and "online fraud prevention" firm MaxMind, and consumer tracking provider Mindshare Technology, among other companies. Some of those fingerprint scripts appeared to actively try to evade detection by deleting themselves as soon as they'd run and relayed a fingerprint to a third-party server.

BlueCava's font-probing JavaScript code was the most prevalent such script detected by the researchers, and ran on the homepages of 250 sites that are included in the Alexa index of the 1 million most popular websites. "[BlueCava's] is the only one of the discovered font-probing scripts that queries different sets of fonts based on the device's operating system: 231 fonts for Microsoft Windows, 167 for Mac OS and 62 for other operating systems," said the researchers.

The researchers also looked for Flash-based fingerprinting technology, although only on the world's 10,000 most popular websites as ranked by Alexa, and detected the technology in use on 95 of those sites.

Cookie-free tracking technologies -- often referred to as supercookies -- are typically designed to avoid detection as well as users' attempts to block the technology. Likewise, the technology historically hasn't ever been deterred by the presence of an active "do not track" flag in a user's browser. Many privacy advocates have long held that the only way to stop the cookies will be through legislation that requires websites to disclose the tracking technology they're using, as well as to respect people's DNT preferences.

Might an anonymizing browser, such as Tor, help block the latest generation of supercookies? While that would theoretically help a user defeat the tracking mechanisms, in fact Tor doesn't restrict the browser's ability to call system fonts, meaning Tor users' devices can still be fingerprinted using the font-probing techniques. But the researchers said they've alerted Tor to the vulnerability, and that it's been fixed in the forthcoming source code and version 2.4 of the Tor browser bundle.

Going forward, the researchers said they plan to release the source code for the tool they developed to crawl the Web in search of fingerprinting technology, which they dubbed FPDetective. They built it using modified versions of the PhantomJS "headless" Webkit browser, as well as the Chrome browser. FPDetective includes the ability to relay Flash files through "an SSL-capable intercepting proxy," which allowed the researchers to capture, decompile and analyze the font-probing Flash files using third-party tools.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
10/10/2013 | 7:05:05 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
I'm not entirely clear on why sites need/want to track us THAT closely. What's the payoff, exactly?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/10/2013 | 8:15:01 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
First, this type of personal information is a commodity -- it can be bought and sold (for profit). The more information, the more valuable the record associated with a given person.

Second, it gives advertisers "richer" insights into individual consumers (i.e. you and me). Visit a website that's concerned with menopause, pregnancy, erectile disfunction, baseball or divorce -- and the advertiser's algorithms can spot that and serve up more targeted (and thus theoretically likely to get clicked on and converted to a sale) advertising. And every click or completed sale equals revenue for the advertiser and commissions for affiliates.

The "benefit" for consumers, or hit to our privacy? That's open to debate.
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
10/10/2013 | 8:31:49 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
Ah, got it. Thanks.

And I'd say the answer to your question is: Both.
NG11209
50%
50%
NG11209,
User Rank: Apprentice
10/10/2013 | 9:15:12 PM
re: Advertisers Evade 'Do Not Track' With Supercookies
I remember the do-not-track debate from my time working at a direct & digital marketing trade publication. This report makes it seem that the debate has shifted more to a steroids-in-baseball-style arms race, with one side racing to stay ahead of the rules. The New York Times has some recent reporting on the subject as well, so it's clearly in the public consciousness G I wonder (if we ever have a functioning government again) if some legislation to codify what's appropriate is coming.
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/11/2013 | 9:49:09 AM
re: Advertisers Evade 'Do Not Track' With Supercookies
Arms race is the right metaphor. For every tracking technology that gets excoriated by privacy rights groups or interrogated by regulators/legislators, another one springs up.

That's why having a higher-level take on this might create the concept of user rights that aren't tied to technology, and thus subject to abuse, and get more people on the same page.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.