10 ms·

Evercookie: A cookie that undeletes itself from 8 different storages

391 points by codexon 16y ago

shib71 16y ago
Once again I am forced to golf clap for a horrifying idea brilliantly executed.
- Groxx 16y ago
  No kidding. I especially liked: >Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out and: >Storing cookies in Web History (seriously. see FAQ) Brilliant and EVIL. Wow.
  - nl 16y ago
    Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out That's pretty "nice". It might be possible to "improve" it by storing metadata inside the PNG, and then reading it by parsing it out of the raw data after the call to getDataURL(). I haven't tried this though, and it's possible browsers drop the metadata when they recreate the image. The spec says A future version of this specification will probably define other parameters to be passed to toDataURL() to allow authors to more carefully control compression settings, image metadata, etc.
    - nl 16y ago
      Thinking about it a bit more, it's actually worse than that. http://www.nihilogic.dk/labs/imageinfo/ http://www.nihilogic.dk/labs/imageinfo/ shows how to extract EXIF data from JPEG files, so using EXIF + the cache hack is possible for sure. http://www.nihilogic.dk/labs/id3/ http://www.nihilogic.dk/labs/id3/ shows how to extract ID3 metadata from MP3s in Javascript, so you could do a similar thing like that. Can anyone think why just using the cache hack + a JSON data file wouldn't work?
      - mey 16y ago
        It's even worse then that. http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography That slightly larger in disk size logo on the main site could be hiding a tracking token for you....
        nl 16y ago
        It's unlikely they'd use a logo, because of the brittleness of the technique (ie, it relies on sending 304 Not Modified response due to the absence of the special tracking cookie, not due to the actual cache status). Also, it's not clear if you get access to the actual binary data from the image as it is served, or new data generated from the image as it is displayed - hence my question as to if using the metadata would work.
  - toolate 16y ago
    I wrote up a technique for storing values in the cache a little while back, no PNG or canvas necessary. http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracking-users-without-cookies/ http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...
    - pyre 16y ago
      True, but it's more difficult to analyze and attempt to filter a PNG based on content.
      - pornel 16y ago
        You can analyze and filter script that extracts information from PNG, and such unusual script would draw attention. Cookie stored as a simple variable in a cached JS file is IMHO better solution if you're trying to be sneaky — there's nothing unusual in variable assignment or cacheable JS file.
- points 16y ago
  Of course though it's fairly unnecessary. If all you want to do is track users, it's far easier to use UserAgent/screensize/plugins/etc to uniquely identify users. https://panopticlick.eff.org/ https://panopticlick.eff.org/ You can then store anything heavier server side.
  - eru 16y ago
    It seems to work remarkably well. And they do not even use all the tricks imaginable. E.g. you could add lots of more volatile information to the fingerprint, if you also added some statistical intelligence.
- VMG 16y ago
  One possible good application: effectively banning trolls and spammers
83457 16y ago
Sure hope everyone got that css history hack fix.
- alanh 16y ago
  Not sure what you mean by ‘got the fix’ — wouldn’t the fix be completely disabling browser history?
  - 83457 16y ago
    There was a hack to see what pages someone visited. I see that they actually link to a page about that. The problem with that approach would seem to be that it is a cross-domain vulnerability so other domains could detect the history thus ever-cookie data. Not sure if they have some other mechanism for preventing this problem. I actually thought this problem had been resolved in some manner in many browsers but that doesn't appear to be the case.
danilocampos 16y ago
Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)
- kogir 16y ago
  All of the methods he uses have been known to the web-app security community for a while. He's simply raising awareness of what's already broken. Keeping these things quiet helps nobody. We need more privacy and security issues to be publicly demonstrated so that they'll get fixed instead of ignored. As an example, his work exploiting wireless routers to get location is genius. Who would have thought that having your router's wireless MAC available to your internal network allows a website to determine your location to within a few hundred feet? It uses well known and oft ignored attack methods to produce a sensational result with which everyone can immediately identify. See: http://samy.pl/mapxss/ http://samy.pl/mapxss/
  - danilocampos 16y ago
    Important point. Better to let everyone see the truth of evercookie than let the bad guys enjoy it in the dark. Still, with it all packed up so tidily, a few rascals will do something interesting with it.
    - barrybe 16y ago
      Also now that it's packed up so tidily, we'll probably get some better tools for blocking/removing all of those tricks. Think of it like an Acid3 test for browser security.
      - danilocampos 16y ago
        That's a good perspective. It's my fervent hope someone names their tool everenema.
joshu 16y ago
samy is a rockstar. also did the myspace worm thing.
- deleted 16y ago
  [deleted]
swankpot 16y ago
so now that I visited his page, how to I get rid of his supercookie? could a grease monkey script automatically clean up the supercookies after they have been planted?
- deleted 16y ago
  [deleted]
- tbrownaw 16y ago
  http://www.dban.org/ http://www.dban.org/ (the only way to be sure)
- kuahyeow 16y ago
  Good Q. In Chrome, you can add a block action under the 'Exceptions' list. You can add blocks for Cookies(includes HTML5 storage), Javascript, and Images (shudder). Before you do that though, have a look at what info is stored under samy.pl. Nice to see Chrome list HTML5 storage and cookies etc in one place. * I'm not sure whether the above is really effective. * Repeating this for N sites that uses this is going to be fun. There's always the whitelisting approach, which is available in Chrome too.
BenSchaechter 16y ago
Heh, after a quick look at some of the source code for storing the "cookie" in the browser history: // sorry google. var url = 'http://www.google.com/evercookie/cache/ http://www.google.com/evercookie/cache/ + this.getHost() + '/' + name;
kuahyeow 16y ago
This just reinforces the need for NoScript. Neat thing I discovered about Chrome is that it treats HTML5 storage like normal cookies as well, i.e. you can easily delete them or block.
JeremyHerrman 16y ago
I feel sick after reading this. Would a browser extension be able to clear everything?
- skymt 16y ago
  The privacy tools built into all current browsers can clear all but one of evercookie's storage methods. Specifically, cookies, cache, history & HTML5 storage should all be included in your browser's "clear private data" feature. Flash cookies are a bit more of a problem: they're in a plugin, so the browser doesn't know about them. A tool like CCleaner would work, or you could clear them manually with Adobe's Flash control panel: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html http://www.macromedia.com/support/documentation/en/flashplay...
  - smurfpellet 16y ago
    i use a ff extension called better privacy for managing flash cookies, it comes in handy: https://addons.mozilla.org/en-US/firefox/addon/6623/ https://addons.mozilla.org/en-US/firefox/addon/6623/
  - code_duck 16y ago
    rm -rf ~/.macromedia works pretty well.
    - obiterdictum 16y ago
      ...followed by ln -s /dev/null ~/.macromedia
      - LordLandon 16y ago
        That breaks some things. i.e. the escapist thinks you're a scraping bot and bans you from viewing their videos for a week.
- pyre 16y ago
  Flash Cookies: I imagine that if he can create them, then you can remove them, though I'm doubtful that extensions have full access to Flash internals. HTML5 Storage: I'm not an expert on the different types of HTML5 storage, though since this is at the browser-level, I imagine the it would be easy for an extension to access them. Regular Cookies: Obviously extensions have access to these. Force-Cached PNGs: Not sure what access extensions have, though I imagine that Firefox extensions have a higher likelihood of access than Chrome/Chromium extensions. This is also hard to detect automatically though, unless you want to take the NoScript route and block all force-cached images unless they meet a whitelist. Web History: Extensions obviously have access to web history, though this is something that would vary from implementation to implementation of evercookie, so it would be fighting an endless battle, like spam email filters. The best fix here would be to close the css history hack hole.
redemade 16y ago
check out http://www.convertro.com/visitor-tracking.html http://www.convertro.com/visitor-tracking.html . looks like the analytics guys are already using similar sketchy methods.
- dageroth 16y ago
  Well, it does not say anything about the methods they are using... cross machine tracking definitely seems somewhat strange and unexplainable to me...
xtacy 16y ago
So by default, I should be browsing every site in Incognito/private browsing mode, then.
- phil 16y ago
  Will that defeat Flash storage and the PNG caching trick, too?
  - StavrosK 16y ago
    It doesn't look like it. Neither will clearing your private data (I tried).
  - sorbus 16y ago
    Well, if you're not writing anything to disk, nothing should get cached. So PNG caching wouldn't work. But I'm not so sure about flash storage ... if it's using a bit of flash to store that, then flashblock should stop it, if it's allowed to run in incognito, but if there's some other way then perhaps not.
  - _delirium 16y ago
    On the newest Flash, it looks like Adobe's added specific private-browsing support. No idea how solid it is, but from http://www.adobe.com/devnet/flashplayer/articles/privacy_mode_fp10_1.html http://www.adobe.com/devnet/flashplayer/articles/privacy_mod...: "Starting with Flash Player 10.1, Flash Player actively supports the browser's private browsing mode, managing data in local storage so that it is consistent with private browsing. So when a private browsing session ends, Flash Player will automatically clear any corresponding data in local storage."
uuoc 16y ago
And this is an excellent example of why I have NoScript installed.
- eli 16y ago
  I'm pretty sure some of those cache abusing techniques could be made to work without javascript.
- kree10 16y ago
  Cookie Monster (set to deny cookies by default) plus Flashblock seems to be enough to stop evercookie from setting an id on Firefox for me.
- 9ec4c12949a4f3 16y ago
  This is exactly why I browse with telnet.
phil 16y ago
Seems like this will be pretty effective even if widely known, since clearing one of these 'cookies' will require deleting a lot of info, including some you were probably using. You'll be simultaneously clearing history and cache, logging yourself out of every site you're logged into, clearing all offline state in every web app you use, etc. Most people won't want to do that often.
- piguy314 16y ago
  It's not a big deal. I have Firefox purge everything except saved passwords every time I quit. I also use better privacy to purge LSOs and DOM storage. It really doesn't effect my quality of life when browsing the web. That being said I don't use a lot of sophisticated web applications that require complex preferences to be set and kept in local storage.
lukifer 16y ago
What's truly disturbing is that this absolutely meets a need for a paid gig I'm working on now, where the client wants persistent identity tracking for the purposes of marketing and analytics. (I'm part of the problem, aren't I?)
- BenSchaechter 16y ago
  Now, playing devil's advocate and judging by the number of upvotes this comment got -- couldn't the idea behind evercookie be used for good and not evil in some instances? I'm curious more than anything else. For example, using this persistent cookie as an alternative to having users login?
  - ithkuil 16y ago
    the essential reason of this kind of persistence is that it has to survive the explicit deletion of the cookie by the user. Browser offer the user the possibility to remove cookies (manually or delete all), and this is because users want privacy. This clever library manages to exploit browser features to go around this and store some identification information persistently against the will of the user If the user doesn't want to delete or disable cookies, then you can use normal cookies for the purpose of legitimate "remember me" functionalities. However I can understand that not all users know what cookies are, and there are many people who might have cookies disabled by default (sysadmin choice in a company) or somebody told them to do that. So, you could reason this way: "There is no point disabling the cookies anymore, since anybody could employ this trick to circumvent it. There are people which disable cookies because an obsolete 'security policies' which is not anymore secure. I want to make a webapp that works for everybody. It requires cookies. People are paranoid but employ obsolete security policies which don't protect them anymore. I can exploit the same trick to circumvent their default security policy for morally good reasons"
    - eli 16y ago
      The deletion isn't always explicit. Several consumer "web security" applications delete cookies automatically and the user may not be aware.
naturalized 16y ago
I know that in Chrome's incognito mode, nothing gets written to the disk at all (including Flash's Shared Objects). So if I open an incognito window, browse, then close Chrome, then open another incognito window and return to the page, does this defeat all this?
- atldev 16y ago
  Nope, just tried it. Incognito, cookies there. Clear cache, incognito mode again and 3 types still captured. Really quite fascinating.
  - naturalized 16y ago
    Did you completely quit the browser in between your visits? Because if the instance of Chrome from which you opened the incognito windows have been running between your visits, it may have retrieved these from the memory, even if you closed the incognito window after the first visit.
  - lukasb 16y ago
    So we need a stateless browser and don't have one.
    - c00ki3s 16y ago
      wget or curl come to my mind
- StavrosK 16y ago
  Why doesn't anyone try this? I did, and it seems that incognito mode does defeat this. However, since this always sets the same cookie, I couldn't tell if it read it or set it. From the looks of things, it only read the cookie, which means that closing incognito mode deletes it.
- sireat 16y ago
  I have gotten Flash Objects before, while using Chrome incognito mode. Will have to repeat this experiment with the current version.
wildjim 16y ago
Where's the evercookie-kill script?
- tjarratt 16y ago
  NoScript. No seriously.
herf 16y ago
Missed one: ETag with If-None-Match (server roundtrip), similar to RGB method...
- jrockway 16y ago
  Brilliant.
pavel_lishin 16y ago
What does it do if instead of deleting cookies, you modify the contents? What takes precedence?
- eli 16y ago
  If it gets conflicting values, it goes with the one that is stored in the most places.
ck2 16y ago
In firefox set about:config -> dom.storage.enabled -> false Use flashblock and also block cookies by default. The above causes evercookie to fail for me. No need to block javascript.
- mike-cardwell 16y ago
  Personally, I prefer to allow websites to use those things, but to then clear them between browser sessions. Just use the Firefox BetterPrivacy addon.
  - ck2 16y ago
    I don't know how you work but I keep the browser open 12 hours a day which is a very long session. During that time they can track you across their network of sites if you allow those types of storage by default in the first place.
    - mike-cardwell 16y ago
      This is true. I do however use AdBlock, Ghostery, Flashblock and NoScript as well, which should stop the vast majority of that sort of tracking.
ilmare 16y ago
This is brilliant, now we need someone to write javascript polymorphic engine.
deleted 16y ago
[deleted]
jorangreef 16y ago
That's what Charlie Mungur would call a Lollapalooza Effect: http://en.wikipedia.org/wiki/Charlie_Munger#Lollapalooza_Effect http://en.wikipedia.org/wiki/Charlie_Munger#Lollapalooza_Eff...
- lanstein 16y ago
  Munger. Come on, it's right in the link.
mike-cardwell 16y ago
Firefox's BetterPrivacy addon defeats all of these techniques. I just tested and confirmed this myself.
- mike-cardwell 16y ago
  I also have Firefox clearing all cookies and all history on exit so that probably helped during my testing. BetterPrivacy dealt with the lso stuff though. I don't know why people allow cookies to persist between browser sessions. I've been clearing them on exit for years now and it really doesn't make it more difficult to use the Web.
  - Retric 16y ago
    I only restart Firefox 1 or 2 times a month. Keeping all those tabs open really is far more useful than having the same sites bookmarked.
    - eru 16y ago
      You can ask Firefox to restore the tabs from the last session. So restarting becomes cheap. (You can also do this to Chrome and Opera, and probably other browsers.)
- mike463 16y ago
  but you have to exit the browser
jrmg 16y ago
What are the privacy laws surrounding conciously cirumventing user intent like is? Is it legal to use this in the USA? In Europe?
- danielnicollet 16y ago
  for me that the major question here. what are the legal implications since using this sort of cookie involves a set of hacks that derive the normal use of various systems for a purpose they were not intended for in the first place, and since it is intended to defeat some of the privacy protections of browsers. I am not condemning this clever system but I am curious of the privacy and other legal issues here...
spyder 16y ago
It doesn't remember me in Chrome after deleting cache and cookies as i usualy do.
hackermom 16y ago
Why would anyone want to create this monster?!? (I have to admit it's very well done, though...)
barfoomoo 16y ago
How will the PNG caching work if you have asked your browser to delete all local files?
ilitirit 16y ago
Someone's probably working on an anti-measure right now.
Pistos2 16y ago
Just tried this in Opera. Having never visited the site before, I opened it in a "New Private Tab". Set Opera to reject all [normal] cookies from that domain. Saw an ID number on the page; recorded it. Opened another private tab. Saw a different ID number. Refreshed page; got yet another (different) ID number. Revisited page within same [private] tab (pressed Enter in address bar): got yet another (different) ID number. Did the same in Chrome (regular tabs): saw same behaviour. Using two different private tabs in Opera, I get two different IDs to start with, but when using the "click to rediscover" buttons, both allegedly private tabs [eventually] end up with the same ID.
kungfooey 16y ago
I think it's appropriate to mention that the New York Times just ran an article covering some lawsuits related to tracking users: http://www.nytimes.com/2010/09/21/technology/21cookie.html?pagewanted=all http://www.nytimes.com/2010/09/21/technology/21cookie.html?p... I think the take-away here is that if you're going to use a trick like this, it might be in your best interest to be transparent with your users and offer a way for them to remove all of this information. Of course, if you're using this particular hack then you probably don't want your users to remove the cookie to begin with.
9ec4c12949a4f3 16y ago
* yawn * Chrome Incognito mode. New cookie every F5. :)
abyssknight 16y ago
I'm reading a ton of posts saying how terrible this is, why anyone would do it, and so on. If you don't know, Samy also created the MySpace worm. OWASP built a project called Anti-Samy to combat the work he did on the MySpace worm. He was sentenced to three years probation, 90 days community service and an undisclosed amount of restitution. I'm pretty sure he knows how terrible it is, and that's the point. He spoke at Black Hat 2010 USA as well... "How I Met Your Girlfriend: The discovery and execution of entirely new classes of attacks executed from the Web in order to meet your girlfriend. This includes newly discovered attacks including HTML5 client-side XSS (without XSS hitting the server!), PHP session hijacking and weak random numbers (accurately guessing PHP session cookies), browser protocol confusion (turning a browser into an SMTP server), firewall and NAT penetration via Javascript (turning your router against you), remote iPhone Google Maps hijacking (iPhone penetration combined with HTTP man-in-the-middle), extracting extremely accurate geolocation information from a Web browser (not using IP geolocation), and more."
johnzabroski 16y ago
so who wants to team up and create a _N_evercookie plug-in for browsers.
stevefink 16y ago
samy is simply one of the brightest minds in our field, period.
cpg 16y ago
This is like the equivalent of stem cell work for online privacy, isn't it? ;)

391 points by codexon 16y ago

shib71 16y ago

Once again I am forced to golf clap for a horrifying idea brilliantly executed.

Groxx 16y ago
No kidding. I especially liked: >Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out and: >Storing cookies in Web History (seriously. see FAQ) Brilliant and EVIL. Wow.
- nl 16y ago
  Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out That's pretty "nice". It might be possible to "improve" it by storing metadata inside the PNG, and then reading it by parsing it out of the raw data after the call to getDataURL(). I haven't tried this though, and it's possible browsers drop the metadata when they recreate the image. The spec says A future version of this specification will probably define other parameters to be passed to toDataURL() to allow authors to more carefully control compression settings, image metadata, etc.
  - nl 16y ago
    Thinking about it a bit more, it's actually worse than that. http://www.nihilogic.dk/labs/imageinfo/ http://www.nihilogic.dk/labs/imageinfo/ shows how to extract EXIF data from JPEG files, so using EXIF + the cache hack is possible for sure. http://www.nihilogic.dk/labs/id3/ http://www.nihilogic.dk/labs/id3/ shows how to extract ID3 metadata from MP3s in Javascript, so you could do a similar thing like that. Can anyone think why just using the cache hack + a JSON data file wouldn't work?
    - mey 16y ago
      It's even worse then that. http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography That slightly larger in disk size logo on the main site could be hiding a tracking token for you....
      - nl 16y ago
        It's unlikely they'd use a logo, because of the brittleness of the technique (ie, it relies on sending 304 Not Modified response due to the absence of the special tracking cookie, not due to the actual cache status). Also, it's not clear if you get access to the actual binary data from the image as it is served, or new data generated from the image as it is displayed - hence my question as to if using the metadata would work.
- toolate 16y ago
  I wrote up a technique for storing values in the cache a little while back, no PNG or canvas necessary. http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracking-users-without-cookies/ http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...
  - pyre 16y ago
    True, but it's more difficult to analyze and attempt to filter a PNG based on content.
    - pornel 16y ago
      You can analyze and filter script that extracts information from PNG, and such unusual script would draw attention. Cookie stored as a simple variable in a cached JS file is IMHO better solution if you're trying to be sneaky — there's nothing unusual in variable assignment or cacheable JS file.
points 16y ago
Of course though it's fairly unnecessary. If all you want to do is track users, it's far easier to use UserAgent/screensize/plugins/etc to uniquely identify users. https://panopticlick.eff.org/ https://panopticlick.eff.org/ You can then store anything heavier server side.
- eru 16y ago
  It seems to work remarkably well. And they do not even use all the tricks imaginable. E.g. you could add lots of more volatile information to the fingerprint, if you also added some statistical intelligence.
VMG 16y ago
One possible good application: effectively banning trolls and spammers

83457 16y ago

Sure hope everyone got that css history hack fix.

alanh 16y ago
Not sure what you mean by ‘got the fix’ — wouldn’t the fix be completely disabling browser history?
- 83457 16y ago
  There was a hack to see what pages someone visited. I see that they actually link to a page about that. The problem with that approach would seem to be that it is a cross-domain vulnerability so other domains could detect the history thus ever-cookie data. Not sure if they have some other mechanism for preventing this problem. I actually thought this problem had been resolved in some manner in many browsers but that doesn't appear to be the case.

danilocampos 16y ago

Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)

kogir 16y ago
All of the methods he uses have been known to the web-app security community for a while. He's simply raising awareness of what's already broken. Keeping these things quiet helps nobody. We need more privacy and security issues to be publicly demonstrated so that they'll get fixed instead of ignored. As an example, his work exploiting wireless routers to get location is genius. Who would have thought that having your router's wireless MAC available to your internal network allows a website to determine your location to within a few hundred feet? It uses well known and oft ignored attack methods to produce a sensational result with which everyone can immediately identify. See: http://samy.pl/mapxss/ http://samy.pl/mapxss/
- danilocampos 16y ago
  Important point. Better to let everyone see the truth of evercookie than let the bad guys enjoy it in the dark. Still, with it all packed up so tidily, a few rascals will do something interesting with it.
  - barrybe 16y ago
    Also now that it's packed up so tidily, we'll probably get some better tools for blocking/removing all of those tricks. Think of it like an Acid3 test for browser security.
    - danilocampos 16y ago
      That's a good perspective. It's my fervent hope someone names their tool everenema.

joshu 16y ago

samy is a rockstar. also did the myspace worm thing.

deleted 16y ago
[deleted]

swankpot 16y ago

so now that I visited his page, how to I get rid of his supercookie? could a grease monkey script automatically clean up the supercookies after they have been planted?

deleted 16y ago
[deleted]
tbrownaw 16y ago
http://www.dban.org/ http://www.dban.org/ (the only way to be sure)
kuahyeow 16y ago
Good Q. In Chrome, you can add a block action under the 'Exceptions' list. You can add blocks for Cookies(includes HTML5 storage), Javascript, and Images (shudder). Before you do that though, have a look at what info is stored under samy.pl. Nice to see Chrome list HTML5 storage and cookies etc in one place. * I'm not sure whether the above is really effective. * Repeating this for N sites that uses this is going to be fun. There's always the whitelisting approach, which is available in Chrome too.

BenSchaechter 16y ago

Heh, after a quick look at some of the source code for storing the "cookie" in the browser history: // sorry google. var url = 'http://www.google.com/evercookie/cache/ http://www.google.com/evercookie/cache/ + this.getHost() + '/' + name;

kuahyeow 16y ago

This just reinforces the need for NoScript. Neat thing I discovered about Chrome is that it treats HTML5 storage like normal cookies as well, i.e. you can easily delete them or block.

JeremyHerrman 16y ago

I feel sick after reading this. Would a browser extension be able to clear everything?

skymt 16y ago
The privacy tools built into all current browsers can clear all but one of evercookie's storage methods. Specifically, cookies, cache, history & HTML5 storage should all be included in your browser's "clear private data" feature. Flash cookies are a bit more of a problem: they're in a plugin, so the browser doesn't know about them. A tool like CCleaner would work, or you could clear them manually with Adobe's Flash control panel: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html http://www.macromedia.com/support/documentation/en/flashplay...
- smurfpellet 16y ago
  i use a ff extension called better privacy for managing flash cookies, it comes in handy: https://addons.mozilla.org/en-US/firefox/addon/6623/ https://addons.mozilla.org/en-US/firefox/addon/6623/
- code_duck 16y ago
  rm -rf ~/.macromedia works pretty well.
  - obiterdictum 16y ago
    ...followed by ln -s /dev/null ~/.macromedia
    - LordLandon 16y ago
      That breaks some things. i.e. the escapist thinks you're a scraping bot and bans you from viewing their videos for a week.
pyre 16y ago
Flash Cookies: I imagine that if he can create them, then you can remove them, though I'm doubtful that extensions have full access to Flash internals. HTML5 Storage: I'm not an expert on the different types of HTML5 storage, though since this is at the browser-level, I imagine the it would be easy for an extension to access them. Regular Cookies: Obviously extensions have access to these. Force-Cached PNGs: Not sure what access extensions have, though I imagine that Firefox extensions have a higher likelihood of access than Chrome/Chromium extensions. This is also hard to detect automatically though, unless you want to take the NoScript route and block all force-cached images unless they meet a whitelist. Web History: Extensions obviously have access to web history, though this is something that would vary from implementation to implementation of evercookie, so it would be fighting an endless battle, like spam email filters. The best fix here would be to close the css history hack hole.

redemade 16y ago

check out http://www.convertro.com/visitor-tracking.html http://www.convertro.com/visitor-tracking.html . looks like the analytics guys are already using similar sketchy methods.

dageroth 16y ago
Well, it does not say anything about the methods they are using... cross machine tracking definitely seems somewhat strange and unexplainable to me...

xtacy 16y ago

So by default, I should be browsing every site in Incognito/private browsing mode, then.

phil 16y ago
Will that defeat Flash storage and the PNG caching trick, too?
- StavrosK 16y ago
  It doesn't look like it. Neither will clearing your private data (I tried).
- sorbus 16y ago
  Well, if you're not writing anything to disk, nothing should get cached. So PNG caching wouldn't work. But I'm not so sure about flash storage ... if it's using a bit of flash to store that, then flashblock should stop it, if it's allowed to run in incognito, but if there's some other way then perhaps not.
- _delirium 16y ago
  On the newest Flash, it looks like Adobe's added specific private-browsing support. No idea how solid it is, but from http://www.adobe.com/devnet/flashplayer/articles/privacy_mode_fp10_1.html http://www.adobe.com/devnet/flashplayer/articles/privacy_mod...: "Starting with Flash Player 10.1, Flash Player actively supports the browser's private browsing mode, managing data in local storage so that it is consistent with private browsing. So when a private browsing session ends, Flash Player will automatically clear any corresponding data in local storage."

uuoc 16y ago

And this is an excellent example of why I have NoScript installed.

eli 16y ago
I'm pretty sure some of those cache abusing techniques could be made to work without javascript.
kree10 16y ago
Cookie Monster (set to deny cookies by default) plus Flashblock seems to be enough to stop evercookie from setting an id on Firefox for me.
9ec4c12949a4f3 16y ago
This is exactly why I browse with telnet.

phil 16y ago

Seems like this will be pretty effective even if widely known, since clearing one of these 'cookies' will require deleting a lot of info, including some you were probably using. You'll be simultaneously clearing history and cache, logging yourself out of every site you're logged into, clearing all offline state in every web app you use, etc. Most people won't want to do that often.

piguy314 16y ago
It's not a big deal. I have Firefox purge everything except saved passwords every time I quit. I also use better privacy to purge LSOs and DOM storage. It really doesn't effect my quality of life when browsing the web. That being said I don't use a lot of sophisticated web applications that require complex preferences to be set and kept in local storage.

lukifer 16y ago

What's truly disturbing is that this absolutely meets a need for a paid gig I'm working on now, where the client wants persistent identity tracking for the purposes of marketing and analytics. (I'm part of the problem, aren't I?)

BenSchaechter 16y ago
Now, playing devil's advocate and judging by the number of upvotes this comment got -- couldn't the idea behind evercookie be used for good and not evil in some instances? I'm curious more than anything else. For example, using this persistent cookie as an alternative to having users login?
- ithkuil 16y ago
  the essential reason of this kind of persistence is that it has to survive the explicit deletion of the cookie by the user. Browser offer the user the possibility to remove cookies (manually or delete all), and this is because users want privacy. This clever library manages to exploit browser features to go around this and store some identification information persistently against the will of the user If the user doesn't want to delete or disable cookies, then you can use normal cookies for the purpose of legitimate "remember me" functionalities. However I can understand that not all users know what cookies are, and there are many people who might have cookies disabled by default (sysadmin choice in a company) or somebody told them to do that. So, you could reason this way: "There is no point disabling the cookies anymore, since anybody could employ this trick to circumvent it. There are people which disable cookies because an obsolete 'security policies' which is not anymore secure. I want to make a webapp that works for everybody. It requires cookies. People are paranoid but employ obsolete security policies which don't protect them anymore. I can exploit the same trick to circumvent their default security policy for morally good reasons"
  - eli 16y ago
    The deletion isn't always explicit. Several consumer "web security" applications delete cookies automatically and the user may not be aware.

naturalized 16y ago

I know that in Chrome's incognito mode, nothing gets written to the disk at all (including Flash's Shared Objects). So if I open an incognito window, browse, then close Chrome, then open another incognito window and return to the page, does this defeat all this?

atldev 16y ago
Nope, just tried it. Incognito, cookies there. Clear cache, incognito mode again and 3 types still captured. Really quite fascinating.
- naturalized 16y ago
  Did you completely quit the browser in between your visits? Because if the instance of Chrome from which you opened the incognito windows have been running between your visits, it may have retrieved these from the memory, even if you closed the incognito window after the first visit.
- lukasb 16y ago
  So we need a stateless browser and don't have one.
  - c00ki3s 16y ago
    wget or curl come to my mind
StavrosK 16y ago
Why doesn't anyone try this? I did, and it seems that incognito mode does defeat this. However, since this always sets the same cookie, I couldn't tell if it read it or set it. From the looks of things, it only read the cookie, which means that closing incognito mode deletes it.
sireat 16y ago
I have gotten Flash Objects before, while using Chrome incognito mode. Will have to repeat this experiment with the current version.

wildjim 16y ago

Where's the evercookie-kill script?

tjarratt 16y ago
NoScript. No seriously.

herf 16y ago

Missed one: ETag with If-None-Match (server roundtrip), similar to RGB method...

jrockway 16y ago
Brilliant.

pavel_lishin 16y ago

What does it do if instead of deleting cookies, you modify the contents? What takes precedence?

eli 16y ago
If it gets conflicting values, it goes with the one that is stored in the most places.

ck2 16y ago

In firefox set about:config -> dom.storage.enabled -> false Use flashblock and also block cookies by default. The above causes evercookie to fail for me. No need to block javascript.

mike-cardwell 16y ago
Personally, I prefer to allow websites to use those things, but to then clear them between browser sessions. Just use the Firefox BetterPrivacy addon.
- ck2 16y ago
  I don't know how you work but I keep the browser open 12 hours a day which is a very long session. During that time they can track you across their network of sites if you allow those types of storage by default in the first place.
  - mike-cardwell 16y ago
    This is true. I do however use AdBlock, Ghostery, Flashblock and NoScript as well, which should stop the vast majority of that sort of tracking.

ilmare 16y ago

This is brilliant, now we need someone to write javascript polymorphic engine.

deleted 16y ago

[deleted]

jorangreef 16y ago

That's what Charlie Mungur would call a Lollapalooza Effect: http://en.wikipedia.org/wiki/Charlie_Munger#Lollapalooza_Effect http://en.wikipedia.org/wiki/Charlie_Munger#Lollapalooza_Eff...

lanstein 16y ago
Munger. Come on, it's right in the link.

mike-cardwell 16y ago

Firefox's BetterPrivacy addon defeats all of these techniques. I just tested and confirmed this myself.

mike-cardwell 16y ago
I also have Firefox clearing all cookies and all history on exit so that probably helped during my testing. BetterPrivacy dealt with the lso stuff though. I don't know why people allow cookies to persist between browser sessions. I've been clearing them on exit for years now and it really doesn't make it more difficult to use the Web.
- Retric 16y ago
  I only restart Firefox 1 or 2 times a month. Keeping all those tabs open really is far more useful than having the same sites bookmarked.
  - eru 16y ago
    You can ask Firefox to restore the tabs from the last session. So restarting becomes cheap. (You can also do this to Chrome and Opera, and probably other browsers.)
mike463 16y ago
but you have to exit the browser

jrmg 16y ago

What are the privacy laws surrounding conciously cirumventing user intent like is? Is it legal to use this in the USA? In Europe?

danielnicollet 16y ago
for me that the major question here. what are the legal implications since using this sort of cookie involves a set of hacks that derive the normal use of various systems for a purpose they were not intended for in the first place, and since it is intended to defeat some of the privacy protections of browsers. I am not condemning this clever system but I am curious of the privacy and other legal issues here...

spyder 16y ago

It doesn't remember me in Chrome after deleting cache and cookies as i usualy do.

hackermom 16y ago

Why would anyone want to create this monster?!? (I have to admit it's very well done, though...)

barfoomoo 16y ago

How will the PNG caching work if you have asked your browser to delete all local files?

ilitirit 16y ago

Someone's probably working on an anti-measure right now.

Pistos2 16y ago

Just tried this in Opera. Having never visited the site before, I opened it in a "New Private Tab". Set Opera to reject all [normal] cookies from that domain. Saw an ID number on the page; recorded it. Opened another private tab. Saw a different ID number. Refreshed page; got yet another (different) ID number. Revisited page within same [private] tab (pressed Enter in address bar): got yet another (different) ID number. Did the same in Chrome (regular tabs): saw same behaviour. Using two different private tabs in Opera, I get two different IDs to start with, but when using the "click to rediscover" buttons, both allegedly private tabs [eventually] end up with the same ID.

kungfooey 16y ago

I think it's appropriate to mention that the New York Times just ran an article covering some lawsuits related to tracking users: http://www.nytimes.com/2010/09/21/technology/21cookie.html?pagewanted=all http://www.nytimes.com/2010/09/21/technology/21cookie.html?p... I think the take-away here is that if you're going to use a trick like this, it might be in your best interest to be transparent with your users and offer a way for them to remove all of this information. Of course, if you're using this particular hack then you probably don't want your users to remove the cookie to begin with.

9ec4c12949a4f3 16y ago

* yawn * Chrome Incognito mode. New cookie every F5. :)

abyssknight 16y ago

I'm reading a ton of posts saying how terrible this is, why anyone would do it, and so on. If you don't know, Samy also created the MySpace worm. OWASP built a project called Anti-Samy to combat the work he did on the MySpace worm. He was sentenced to three years probation, 90 days community service and an undisclosed amount of restitution. I'm pretty sure he knows how terrible it is, and that's the point. He spoke at Black Hat 2010 USA as well... "How I Met Your Girlfriend: The discovery and execution of entirely new classes of attacks executed from the Web in order to meet your girlfriend. This includes newly discovered attacks including HTML5 client-side XSS (without XSS hitting the server!), PHP session hijacking and weak random numbers (accurately guessing PHP session cookies), browser protocol confusion (turning a browser into an SMTP server), firewall and NAT penetration via Javascript (turning your router against you), remote iPhone Google Maps hijacking (iPhone penetration combined with HTTP man-in-the-middle), extracting extremely accurate geolocation information from a Web browser (not using IP geolocation), and more."

johnzabroski 16y ago

so who wants to team up and create a _N_evercookie plug-in for browsers.

stevefink 16y ago

samy is simply one of the brightest minds in our field, period.

cpg 16y ago

This is like the equivalent of stem cell work for online privacy, isn't it? ;)