Feeds

Sneaky tracking code (finally) purged from Microsoft sites

'Supercookies' eluded user privacy choices

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

Microsoft has deleted code on its MSN website that secretly logged visitors' browsing histories across multiple web properties, even when the users deleted browser cookies to elude tracking.

Microsoft announced the move in a tersely worded blog post published on Thursday. That's the same day that a researcher revealed that MSN and three other Microsoft websites hosted JavaScript that uniquely identified users in the event they deleted tracking cookies from their hard drives. The code was copyrighted in 2007, indicating the practice may have been in place for more than four years.

To survive the cookie purges that many users perform to preserve their privacy, the JavaScript was stashed in a browser's cache folder and contained two separate means to uniquely identify visitors. First, it included the MUID, or machine unique identifier, contained in the tracking cookie, along with instructions to recreate the file in the event it was no longer found in the browser's cookie folder. The script also included the MUID in what's known as an ETag that was also stored in the cache.

“We don't really know what they were doing with this information, but it's not obvious what this explanation would be,” said Jonathan Mayer, a graduate student in Stanford University's computer science department, whose research brought the practice to light.

“The burden is on Microsoft to explain how it came to be there and how they used it and what they're going to do to make sure it doesn't happen again. As we turned over this ETag mechanism, we thought long and hard about how could they be using this legitimately. We couldn't come up with anything.”

A spokeswoman at Microsoft's outside PR firm declined to answer any questions about the practice, including whether it's been discontinued on all Microsoft properties or only on MSN. She said no one inside Microsoft was available to speak about the issue.

The revelation comes as hundreds of sites including Hulu.com, Spotify, and GigaOm were recently observed using similar “cookie respawning” techniques, which are controversial because they resurrect the browsing history of users who take pains to erase them. In addition to the use of cache cookies and ETags, the respawning can also rely on cookies based on Adobe Flash, Microsoft SilverLight, and the HTML5 specification, making it hard for many people to evade.

The practice of issuing so-called supercookies and zombiecookies is the subject of numerous lawsuits. Last week, Microsoft and several other companies were dismissed from a suit alleging cookie respawning abuse because the plaintiff couldn't quantify the monetary damages she suffered.

According to Mayer, the cookies respawned by the wlHelper.js JavaScript hosted on Microsoft sites allowed Microsoft to sync browsing histories across at least six sites, including bing.com, microsoft.com, msn.com, live.com, xbox.com, and atdmt.com, its ad-serving network.

In Thursday's 225-word blog post, Microsoft Associate General Counsel Mike Hintze said Microsoft curtailed the practice after Mayer brought it to the company's attention.

“We determined that the cookie behavior he observed was occurring under certain circumstances as a result of older code that was used only on our own sites, and was already scheduled to be discontinued," he wrote. "We accelerated this process and quickly disabled this code. At no time did this functionality cause Microsoft cookie identifiers or data associated with those identifiers to be shared outside of Microsoft.”

For Mayer, who along with colleagues at the University of California at San Diego, UC Berkeley, and elsewhere have repeatedly documented websites that respawn cookies or sniff browsing history to track users against their wishes, he no longer believes companies when they say they can be trusted to police themselves.

“I really don't think that's possible to accept any more,” he said. “The fact of the matter is that we're seeing, intentionally or not, companies doing things that circumvent privacy choice in a way that suggests they need to have more of a spotlight put on them, possibly by regulators.” ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.