Wherever You Go, There They Are: The Perils of Cross-Site Tracking
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
If you think that when you visit a website you are only touching a single web server, think again. The most popular and less popular websites on the Web are intentionally instrumented to share information about your visit with third parties, including information aggregators, advertisers, media content suppliers, and free service providers.
Using a variety of techniques, the HTML and JavaScript contained within many web pages direct your browser to contact third parties, sometimes more than a dozen at a time. At best, you'll see only a flicker in the browser status bar as a sign that something is amiss.
Such tracking isn't new; chances are you first heard the term "web bug" in the late 90s, but since then cross-site tracking techniques have evolved into far more sophisticated, and far more prevalent, ways to track users as they hop from site to site across the Web. Because there is a relatively small number of tracking hubs but an ever increasing number of complicit web pages, third parties can observe your activities as you visit any of tens, hundreds, or even thousands of web sites.
Countermeasures exist, but unfortunately there is no single silver bullet. In fact, tracking techniques are integrated so tightly with the content available on the Web that separating the two is nearly impossible in many cases. If you want access to the content, tracking is part of the (Faustian) bargain.
Cross-site tracking thrives because webmasters insert small snippets of HTML and JavaScript into their web pages that contact third-party servers once the page is viewed by the end user. Including these snippets provides a payoff to the webmaster, such as providing free web analytics, affiliate network sales commissions, advertising revenue, social networking widgets, or content such as videos and maps. The strength of the Web is its intensely interconnected nature. Unfortunately, these interconnections facilitate and encourage cross-site tracking.
The information collected by these third parties is sensitive, including IP addresses, sites visited, individual pages viewed, and date and time of viewing. Because these services function by requesting the user's browser to contact their servers, the third party can tag the user's browser with a cookie.
More important, because large swaths of the web are instrumented to contact third parties, the largest third-party networks possess the capability to track users across a great deal of the Web. Thus it is possible to know much more about individuals' and organizations' web browsing history and behavior.
The information collected is extremely valuable and can be used for user profiling, data mining, and targeted advertising.
In addition, the mere existence of this tracking data makes it a ripe target for covetous attackers, governments, and competitors.
Prevalence on the Web
Instrumenting the Web to track the depth and breadth of individual web surfing is commonplace. Let's look at an example using the top 20 sites from Alexa's Kids and Teen website rankings (see Figure 1).
)
Figure 1 Third-party servers contacted when visiting popular children's websites.
There are numerous technical means to monitor third-party tracking. For this example, I chose one of the easiest. To gather this information I installed the Adblock Plus Firefox add-on and visited the websites one by one.
Adblock has a convenient feature that displays many forms of embedded content as each page is visited, and I used this technique to gather the data for Figure 1.
In the figure I listed my intended destination sites on the left and unintended destinations on the right. As you examine the figure, several important details stand out.
First consider the outdegree—the number of outbound connections from the intended destination. Outliers such as http://www.gamespot.com immediately emerge. Sites with a high number of outbound connections contact many third-party servers.
Some sites, such as Wikipedia, contact another domain (Wikimedia in this case), but the connections appear to be for legitimate processing requirements such as load balancing, not for suspect information sharing.
More important, consider the indegree—the number of inbound connections, for the third-party sites. The larger the indegree of a given third-party server, the greater that organization's visibility on the Web. In this example, google-analytics and doubleclick.net have the largest number of inbound connections.
It is important to note that you should consider these figures as a lower bound. There are numerous techniques, such as obfuscated JavaScript and DNS manipulations that can hide or mask third-party communications.
A detailed analysis at the packet level would yield additional insights and discoveries of previously undetected behind-the-scenes third-party communications.