AdGuard names 6,000+ web trackers that use CNAME chicanery: Feel free to feed them into your browser's filter

[mood]

AdGuard names 6,000+ web trackers that use CNAME chicanery: Feel free to feed them into your browser's filter

Assuming your content blocker can scrutinize DNS

 

AdGuard on Thursday published a list of more than 6,000 CNAME-based trackers so they can be incorporated into content-blocking filters.

 

CNAME tracking is a way to configure DNS records to erase the distinction between code and assets from a publisher's (first-party) domain and tracking scripts on that site that call a server on an advertiser's (third-party) domain. Such domain cloaking – obscuring who controls a domain – undoes privacy defenses, like the blocking of third-party cookies, by making third-party assets look like they're associated with the first-party domain.

 

As privacy barriers have gone up to prevent marketers from gathering data from web users, CNAME manipulation has become more popular. As we reported last week, privacy researchers recently found that the presence of CNAME trackers has increased 21 per cent over the past 22 months and that CNAME trackers show up on almost 10 per cent of the top 10,000 websites. Worse still, 95 per cent of websites that fiddle with their domain records in this manner leak cookies, which sometimes contain sensitive information.

 

The most commonly detected CNAME trackers, according to the researchers, come from the following companies, in order of prevalence: Pardot, Adobe Experience Cloud, Act-On Software, Oracle Eloqua, Eulerian, Webtrekk, Ingenious Technologies, TraceDock, LiveIntent, AT Internet, Criteo, Keyade, and Wizaly.

 

One reason for the growing popularity of CNAME tracking is that the deceptive use of its records can't currently be prevented – companies are free to configure their DNS records to disguise partners' servers as they see fit. So far as we are aware, the practice hasn't been challenged under existing privacy laws. And ad tech firms talk openly about bypassing defenses against CNAME data collection.

 

Absent a way to forbid the practice, the defenses that exist are necessarily reactive. But they're not currently commonplace. Since last October, the Brave browser can detect CNAME cloaking and will attempt to determine the cloaked domain to block its cookies if appropriate. Firefox can do it too, with an extension like uBlock Origin or AdGuard DNS.

 

Safari offers only a way to limit the lifespan of cookies set via CNAME abuse. Chrome lacks an API for scrutinizing DNS in the same way as Firefox (dns.resolve), which limits what Chrome (and Edge) extensions can do.

 

"In order to prevent it you'll need to use a content blocker that can access DNS queries," Andrey Meshkov, CEO of AdGuard, told The Register.

"The whole problem is that the majority of users don't use them and just stick to Chrome or Safari browsers with extensions. These users can only 'react' to the problem, they can only start blocking a new disguised tracker as soon as we detect it on AdGuard DNS and update the list."

 

Meshkov acknowledged that this is not a proactive approach, but it works within the existing system for applying filtering lists to content blockers.

Without the equivalent of Firefox's dns.resolve in Chrome, AdGuard is using its own DNS service to tease out whether domains are engaged in CNAME manipulation and has now made a list of those domains so they can be blocked by extensions and applications that integrate filtering lists.

 

Meshkov in a blog post pledged to keep the CNAME tracker list updated but cautioned there's a limit to the number of filters that can be checked.

Chrome and Safari both take a declarative approach for their extensions – meaning content blocking tools need to declare the domains to be blocked in advance – that limits the number of blocking rules to 50,000 and 150,000 respectively.

 

"Even today we see that Safari's 50,000 rules are barely enough to protect yourself against ads, trackers, and everything else bad that's lurking on the web," warned Meshkov. "One day they will simply run out of space to protect users against actual threats, and this day is closer than you might think."

 

 

Source: AdGuard names 6,000+ web trackers that use CNAME chicanery: Feel free to feed them into your browser's filter

[aum]

It’s time to outsmart the trackers

 

(Image credit: Shutterstock / Valery Brozhinsky)

 

With Google all set to wage a war against online trackers, AdGuard, which develops a line of ad blocking and privacy protection browser extensions, has released a list of over six thousand CNAME-based web trackers.

 

CNAME (Canonical name) is a DNS record used to alias one domain name to another - so thanks to CNAME it’s possible to run multiple services from a single IP address. However, online advertisers and other unscrupulous agents abuse CNAME records to hide tracking scripts behind trusted domains.

 

“As content blocking has become widespread, most tools for excessive tracking proved to be fairly useless. But with the market moving more and more towards massive data collection, the tendency was to push it as far as possible. Some opt for a blatant approach, and some seek more inventive ways to collect users' data," noted AdGuard CEO Andrey Meshkov in a blog post as he shared the list of CNAME abusing trackers.

 

Arm yourself

Reportedly, one of the main reasons for the growing use of CNAME-based trackers is that there isn’t a law against using CNAME records deceptively.

 

However, user’s aren’t completely defenseless. Last year, the privacy-focussed Brave browser announced its ability to detect and block tracking cookies from cloaked CNAMEs. And Firefox users can protect themselves using third-party extensions such as uBlock Origin and AdGuard.

 

However, according to Meshkov Safari, Chromium, and Chromium-powered browsers like Google Chrome and Microsoft Edge, can’t yet examine DNS. This means they can only be effective against CNAME-based trackers using filter lists such as the one released by AdGuard.

 

“Thanks to our own DNS server, plus a set of standalone and browser-based content blocking tools, we've been able to hunt the hunters (or rather track the trackers), list them, and block them,” notes Meshkov adding that the company has shared the list on GitHub for other content blockers to use as well.

 

Source

[Karlston]

Similar topics merged.

[rseiler]

I think this is going to be (or now has been) added to the EasyPrivacy list, at least according to posts in uBO's Reddit group.

 

Update: I've confirmed, by updating and then looking at the contents of EasyPrivacy, that it has been added.