3 Ways To Get Tracked Online
There is a small article on MercuryNews today about three ways to be tracked online. Well that’s three of maybe hundreds of ways, but it’s kind of interesting reading from a newbie’s perspective only because it’s clear they do not have a grasp of all that is out there. Yes, cookies, IP address and registration (not sure how that third one isn’t really just a combination of the first two + more information), but there are dozens of other ways to track movements across the internet. Here are a few in no particular order:
Referring URL. This is one of the most interesting environmental variables because it’s not used that often for tracking purposes except for websites, but really, it’s a pretty useful tool for knowing information about your users. For instance if you see them coming in from a particular search engine you can know what they were actually looking for which can give you insight into that user.
Language encoding. That’s a pretty simple way to at least know which languages the user is interested in, if not which country they are from or currently living in.
X-Forwarded-For. Well, using a proxy is a great idea, but not if it gives up your remote IP address.
Flash cookies. Why not cookie the user with flash? It’s harder for them to clean, and lesser known!
Persistance. Only works in IE, but hey, it’s hardly known and hard to clean.
SSL session IDs. They only change when you tell them to, so you can track people between pages on SSL connections unless the user closes their browser.
CSS history tracking. As Jeremiah found, I can know where you were. The possibilities here, are practically endless as far as knowing things about the user. Clean your history often!
Browser plugins. Spyware is the best way to track users, bar none - well maybe besides a full blown trojan.
DNS tracking. Well if you’re going to be a man in the middle why not know every single website the user is going and track that back to a user? Sounds like a good way to track people to me! I wonder why Google would want to start it’s own ISP? Hm!
MITM sniffing. If you happen to run an ISP, why not track every single request? In the case of content filters, it’s a given anyway!
Mail. You write it, your ISP routes it, your freemail provider logs it forever. There are tons of places for this to be used against you.
Search engines. Ever used a public social networking site? It’s public record now and forever thanks to the WayBackMachine. Think twice before sending that email to the public mailing list.
I’ve probably missed a few hundred others, but trust me, there are way more than three ways to be tracked online. Sometime I’ll have to write up the story about how one of the anti-virus guys ended up tracking down a few phishers using nothing but some photographs. The point being, if you are on the net and you have any discernable patterns and use any machines that can be tracked back to you, you are leaving a trail that can be followed.
August 20th, 2006 at 4:52 pm
I really like the CSS history tracking…
the possibilities are quite huge. Thinking of site history related ads, or links (such as delicious, msypace(, … ) btns)…
August 20th, 2006 at 4:55 pm
That’s exactly right. Another example is if the user has some session variable in a URL that is too short (something shy of 1MM possibilities) you can enumerate though that list in barely anytime at all to get their session ID to enable your CSRF. This could also be used to guess a username in the same way, if it’s in a common URL string. The list goes on and on. So much for same domain policies, huh?
August 21st, 2006 at 8:08 am
Brian Eaton forwarded me this link about how you can use the E-Tag to track people as well: http://www.securityfocus.com/archive/1/350261/2004-01-17/2004-01-23/0
That’s a pretty clever implementation of E-Tag, and would just require that you insert an E-Tag that is unique for every user (not particularly difficult).
Pretty tricky. Thanks, Brian!