2021/02/18 by Yana Dimova, Güneş Acar, Dimova, Yana +9 · 3 voices · 3 citations
Social Sciences · Computer Science · #Privacy, Security, and Data Protection #Internet Traffic Analysis and Secure E-voting #Spam and Phishing Detection
paper · pdf · doi:10.48550/arxiv.2102.09301
Online tracking is a whack-a-mole game between trackers who build and\nmonetize behavioral user profiles through intrusive data collection, and\nanti-tracking mechanisms, deployed as a browser extension, built-in to the\nbrowser, or as a DNS resolver. As a response to pervasive and opaque online\ntracking, more and more users adopt anti-tracking tools to preserve their\nprivacy. Consequently, as the information that trackers can gather on users is\nbeing curbed, some trackers are looking for ways to evade these tracking\ncountermeasures. In this paper we report on a large-scale longitudinal\nevaluation of an anti-tracking evasion scheme that leverages CNAME records to\ninclude tracker resources in a same-site context, effectively bypassing\nanti-tracking measures that use fixed hostname-based block lists. Using\nhistorical HTTP Archive data we find that this tracking scheme is rapidly\ngaining traction, especially among high-traffic websites. Furthermore, we\nreport on several privacy and security issues inherent to the technical setup\nof CNAME-based tracking that we detected through a combination of automated and\nmanual analyses. We find that some trackers are using the technique against the\nSafari browser, which is known to include strict anti-tracking configurations.\nOur findings show that websites using CNAME trackers must take extra\nprecautions to avoid leaking sensitive information to third parties.\n