Feeds

Sneaky tracking code (finally) purged from Microsoft sites

'Supercookies' eluded user privacy choices

  • alert
  • submit to reddit

Website security in corporate America

Microsoft has deleted code on its MSN website that secretly logged visitors' browsing histories across multiple web properties, even when the users deleted browser cookies to elude tracking.

Microsoft announced the move in a tersely worded blog post published on Thursday. That's the same day that a researcher revealed that MSN and three other Microsoft websites hosted JavaScript that uniquely identified users in the event they deleted tracking cookies from their hard drives. The code was copyrighted in 2007, indicating the practice may have been in place for more than four years.

To survive the cookie purges that many users perform to preserve their privacy, the JavaScript was stashed in a browser's cache folder and contained two separate means to uniquely identify visitors. First, it included the MUID, or machine unique identifier, contained in the tracking cookie, along with instructions to recreate the file in the event it was no longer found in the browser's cookie folder. The script also included the MUID in what's known as an ETag that was also stored in the cache.

“We don't really know what they were doing with this information, but it's not obvious what this explanation would be,” said Jonathan Mayer, a graduate student in Stanford University's computer science department, whose research brought the practice to light.

“The burden is on Microsoft to explain how it came to be there and how they used it and what they're going to do to make sure it doesn't happen again. As we turned over this ETag mechanism, we thought long and hard about how could they be using this legitimately. We couldn't come up with anything.”

A spokeswoman at Microsoft's outside PR firm declined to answer any questions about the practice, including whether it's been discontinued on all Microsoft properties or only on MSN. She said no one inside Microsoft was available to speak about the issue.

The revelation comes as hundreds of sites including Hulu.com, Spotify, and GigaOm were recently observed using similar “cookie respawning” techniques, which are controversial because they resurrect the browsing history of users who take pains to erase them. In addition to the use of cache cookies and ETags, the respawning can also rely on cookies based on Adobe Flash, Microsoft SilverLight, and the HTML5 specification, making it hard for many people to evade.

The practice of issuing so-called supercookies and zombiecookies is the subject of numerous lawsuits. Last week, Microsoft and several other companies were dismissed from a suit alleging cookie respawning abuse because the plaintiff couldn't quantify the monetary damages she suffered.

According to Mayer, the cookies respawned by the wlHelper.js JavaScript hosted on Microsoft sites allowed Microsoft to sync browsing histories across at least six sites, including bing.com, microsoft.com, msn.com, live.com, xbox.com, and atdmt.com, its ad-serving network.

In Thursday's 225-word blog post, Microsoft Associate General Counsel Mike Hintze said Microsoft curtailed the practice after Mayer brought it to the company's attention.

“We determined that the cookie behavior he observed was occurring under certain circumstances as a result of older code that was used only on our own sites, and was already scheduled to be discontinued," he wrote. "We accelerated this process and quickly disabled this code. At no time did this functionality cause Microsoft cookie identifiers or data associated with those identifiers to be shared outside of Microsoft.”

For Mayer, who along with colleagues at the University of California at San Diego, UC Berkeley, and elsewhere have repeatedly documented websites that respawn cookies or sniff browsing history to track users against their wishes, he no longer believes companies when they say they can be trusted to police themselves.

“I really don't think that's possible to accept any more,” he said. “The fact of the matter is that we're seeing, intentionally or not, companies doing things that circumvent privacy choice in a way that suggests they need to have more of a spotlight put on them, possibly by regulators.” ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.