8 ms·
AdGuard publishes a list of 6K+ trackers abusing the CNAME cloaking technique
- gramakri 6y agoThis is also part of AdGuard Home . I think this was the PR that fixed it - https://github.com/AdguardTeam/AdGuardHome/issues/1185 https://github.com/AdguardTeam/AdGuardHome/issues/1185 . If you haven't tried out AdGuard Home, I can highly recommend it. Has same feature set as Pi-Hole and support DoT as well. It's also super trivial to install since it's just a Go binary. Have been using it for ages now and love it!
- minxomat 6y agoAdGuard is all around great. Been using their native apps, too.
- dvcrn 6y agoAnother AdGuard home user here! I actually discovered it when I wanted to install pi-hole on my mac server and it just wouldn't work besides with the Docker container, which had other issues like not being able to see the client IP that made the request. Been running AdGuard Home for a couple months now and it's really nice!
- dastx 6y agoTotally! I used to use pi-hole, and I genuinely much prefer AGH.
- fireattack 6y agoI want to try these DNS-based blockers (AGH or Pi-hole) but am always wondering: is it easy to temporarily disable, or "debug" them? I have encountered multiple times (not common, but not trivial) that a filter blocks something wrong. With traditional ad-blocker as extension, I can quickly find it out by using build-in logger, and then simply either temporarily disable them or add the site to whitelist with a single click (if I feel like it, I can write my own rule too.) If I have to change my DNS setting everytime this happens with these DNS-based blockers, I feel like to stick with extensions since I don't really use my phone to browse Internet too much.
- dawnerd 6y agoYep, literally a button that says Disable / Enable. The only problem is browsers like Chrome that are pretty aggressive with DNS caching.
- rmrfrmrf 6y agoPiHole has a web admin UI that's pretty slick. It has options to disable the entire thing indefinitely/for a set period of time if you need to, and it can log all DNS queries, so you can override/manually block anything you need. There's also nifty charts and metrics to show you how much traffic has been blocked. I found that, after tinkering with blocklists for a bit, I turned off logging altogether and just let it run. The one thing that gives us grief occasionally is (unsurprisingly) tracking links from promo emails and social media. These are usually easy enough to bypass, but it can be a pain for non-tech-savvy people.
- fireattack 6y agoThanks! Does it have "cosmetic filters" (the ones that block certain elements on page) or similar feature?
- tuxracer 6y agoNo. It inherently cannot. Pi-Hole isn't a proxy where all traffic is flowing through it and has a chance to be modified. Pi-Hole is strictly answering the question, "What is the IP address for this hostname?" If a given hostname is known to host trackers or something undesirable Pi-Hole will claim it's an unknown host so the device is unable to reach it.
- dastx 6y agoThis is a feature that has been requested, but isn't implemented yet. Suggest you give it a thumbs up on github as they implement things in order of highest number of thumbs.
- crtasm 6y ago
- rmrfrmrf 6y agoWorth noting that PiHole also resolves CNAMEs and blocks them if they're on your filter list.
- fomine3 6y agoI had thought that their all software is proprietary, but it's OSS and looks good.
- jrochkind1 6y agoi'm embaresed that this really obvious and straightforward means of evading third-party-cookie-blocking never occurred to me before.
- tapper 6y agoJust asked if this can be added to the adblocker in OpenWrt.
- teruakohatu 6y agoThe next step is simply proxying the tracker through the original website. /img/logo.png?uuid=..&res=1920&os=MacOS&osv=11.2 and when heuristics catch up with that ... /img/logo.png?757569643D2E2E267265733D31393230266F733D4D61634F53266F
- lights0123 6y agoYou could do the same thing with a separate subdomain like this—the CNAME strategy is just using DNS to point to your provider so you never have to serve analytics requests yourself. If you self-host analytics, CNAME blocking was never intended to nor will prevent that.
- zelphirkalt 6y agoOK, we can still run some user script or have a browser setting, which removes the ?757569643D2E2E267265733D31393230266F733D4D61634F53266F part for things like images. What would be the level after that?
- temp667 6y agoYou just have unique names for images - isn't that already used for email pixels? ie, se09d.png Also used sometimes for standard cache invalidation efforts so common for both nontracking purposes too. Worst case sites will just install a middleware layer to proxy all their requests and traffic back to ad tech machine I'd imagine or install some middleware on their stack.
- gruez 6y agoThe endgame is that the browser is only a thin client (think VNC) and the actual website is rendered server-side.
- slaymaker1907 6y agoI think for ads this might actually be an improvement (compared to no blocking). A big reason why ads continue to stink is because they always seem to be much more poorly optimized than the actual site. I'm probably being too optimistic though, they'll probably just move the slowdown to the server rather than on the client...
- endisneigh 6y agoI wonder if the end game of adblocking is simply to proxy the entire page to the client - completely obscuring who you are or where the request originated. edit: I almost wonder if this could be done safely in a decentralized manner. Everyone runs a BitTorrent like service and when you make a request the swarm proxies it to a specific node who then serves the page back to you. Under this scheme it would become impossible to trace who you are.
- getcrunk 6y agoI've been thinking about this too. But taking it a step further. Streaming not only web pages but apps from a virtualized enviornment .
- bordercases 6y agoThere already exist Linux distros which do this natively.
- endisneigh 6y agoI think this is a better approach than what I described - but how would we make it so the virtualization doesn’t expose fingerprints? With VirtualBox for example it’s possible to figure out you’re in a VM from outside the guest.
- getcrunk 6y agoYou would just need alot of users/be very popular. And then have a standardized vm
- vulcan01 6y agoThe idea you propose in your edit is basically Tor, no?
- endisneigh 6y agoI am familiar with tor but wasn’t sure how it was implemented. After briefly checking the tor wiki it appears you are right. I guess the only thing that’s necessary now is to set it up so that the node could be another mobile client. Maybe it’s possible with webrtc or an extension?
- bpodgursky 6y agoWhy cares? These are useless as third-party cookies -- you can't track users cross domains! It's a first-party cookie! It's just a hack around analytics software needing an on-prem deployment or server-to-server integration. Whatever!
- oehpr 6y agoI dunno if the downvotes are deserved. I think you are correct in that the amount of data exfiltrated is limited. But it's still exfiltrated data, and if the user was given the choice they would almost certainly choose to block such requests. Further, it strikes me that such trackers engaging in this behavior are knowingly subverting user wishes. Which is sort of demonstrating bad faith. I believe attempting to demonstrate the bad faith of tracking companies was a motivator for the DNT flag. They slithered out of that issue by arguing that because people were setting it as default, users didn't effectively consent to not being tracked. This case seems more clear, where they are subverting anti tracking plugins.
- bpodgursky 6y agoI just don't see a functional difference between doing this and sending your server logs to Datadog or Cloudwatch for analysis. It's sorta convenient, but nothing you can't do on the server side with slightly more fuss. There's no cross-site aggregation (much less in-browser tracking) possible in this model, unless I'm missing something major.
- viraptor 6y ago> These are useless as third-party cookies -- you can't track users cross domains http://uniquemachine.org/ http://uniquemachine.org/ As long as you can run scripts, you can be matched between sites. But even before you get into completely unique identifiers, you can get lots of data from repeating ip/location - people are fairly predictable that way.
- jameshart 6y agoWait, SaaS is evil now? Even if track.a.com and track.b.com are both CNAMEd to eviltracker.com, the server at eviltracker.com doesn't have any special ability to crossreference traffic between those two domains. At this point, you're effectively blocking first party tracking. Except, if you make it hard for sites to employ even SaaS-based first-party tracking solutions, then you probably encourage them to roll their own or use hosted first-party tracking, which is less likely to support features like cookie opt-outs or GDPR compliant data handling.
- viraptor 6y ago> server at eviltracker.com doesn't have any special ability to crossreference traffic between those two domains Sure it does. It generates the IDs in the first place, so it knows how if they match between the sites. Not perfectly precisely (at least not for now), but with high confidence by the source of traffic and browser fingerprint. > use hosted first-party tracking, which is less likely to support features like cookie opt-outs or GDPR compliant data handling On the other hand it doesn't aggregate data between unrelated services. And the first party can access a lot of the same data just from standard logs.
- SheinhardtWigCo 6y agoBe careful what you wish for. Ultimately you can't stop publishers from using third-party tracking code in a first-party context. This is just the easiest (laziest) way for publishers to do so. It's not like publishers will give up on integrating third-party tracking code into their tech stacks once this technique is dead. They'll have to do so at a deeper level, e.g. reverse proxies, NPM modules, etc. Next battle in this war: adtech code becomes indistinguishable; tracking IDs start appearing in all exit links from major publishers; adtech firms & publishers coordinate on the backend to sync those IDs. What then, get rid of URLs?
- gruez 6y ago>Next battle in this war: adtech code becomes indistinguishable; tracking IDs start appearing in all exit links from major publishers; adtech firms & publishers coordinate on the backend to sync those IDs. that can be easily filtered out eg. https://addons.mozilla.org/en-US/firefox/addon/link-cleaner/ https://addons.mozilla.org/en-US/firefox/addon/link-cleaner/
- unlog 6y agoThey mean the link won't work unless it has the id, which could be as mentioned indistinguishable
- SheinhardtWigCo 6y agoIt would be easy to come up with an encoding scheme that evades detection.
- nnutter 6y agoFor fellow Pi-hole users deep CNAME inspection was added in [v5.0](https://github.com/pi-hole/FTL/releases/tag/v5.0 https://github.com/pi-hole/FTL/releases/tag/v5.0).
- jvilalta 6y agoFor me this broke Google docs, but happy with it otherwise. It makes troubleshooting harder though since querying the blacklists will not show you the actual domain being blocked
- kevin_thibedeau 6y agoOnly a matter of time til one of these trackers gets owned or bought by blackhats and starts impersonating other sites with their subdomain credentials. Green lock means I'm safe right?
- tobib 6y agoFor anyone else unfamiliar with CNAME cloaking, here's what I think is a much better explanation of the issue: https://webkit.org/blog/11338/cname-cloaking-and-bounce-tracking-defense/ https://webkit.org/blog/11338/cname-cloaking-and-bounce-trac...
- nr2x 6y agoLots of "first-party" domains used the same IP address of known adtech servers, it's pretty easy to find if you have the data.
- tehjoker 6y agoWe should just make third party tracking illegal. We also need a GDPR for the US.
- yalogin 6y agoWe can never win this game. If the CNAME strategy is blocked, the web sites will themselves write the trackers into their code and funnel everything through the backend to the trackers. There is no way to detect this.
- dang 6y agoRelated ongoing thread: The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion - https://news.ycombinator.com/item?id=26347110 https://news.ycombinator.com/item?id=26347110 - March 2021 (51 comments)
- xnx 6y agoIn the future, ad networks will serve content instead of content networks serving ads.
- fomine3 6y agoI confirmed that my bank, credit card, and stock broker on the list (mainly uses Adobe Experience Cloud), horrible.
- amluto 6y agoI think that treating this as a tracking problem is misstating the issue. First party isolation largely solves this particular tracking problem On the other hand, this is a gaping security problem in which a website (the first party) willfully grants unlimited privilege to an unrelated third party. Let’s solve it with regulatory / legal fixes. If you willfully grant your origin permission to a third party (by CNAME cloaking, subdomain delegation by other means, loading third party JS, etc), then, unless the third party has the appropriate certification and/or contracts in place, the first party suffers the natural consequences: - Loss of HIPAA and PCI compliance. - Loss of trade secret protection for contents of the website. - Liability for security breaches due to third party capture of sensitive information. And anything else that follows. If e-commerce sites with dubious trackers and ad networks can’t take credit card payments, they’ll quit the trackers.
- kdeldycke 6y agoI just proposed to this merged to NextDNS.io (a kind of Pi-Hole in the cloud) reference blocklists: https://github.com/nextdns/metadata/issues/601 https://github.com/nextdns/metadata/issues/601