Cookie Swap Party: Abusing First-Party Cookies for Web Tracking
Cookie Swap Party: Abusing First-Party Cookies for Web Tracking
复制标题
Cookie 交换派对：滥用第一方 Cookie 进行网络跟踪
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
A. Kapravelos
中科院分区：
文献类型：
--
作者：
Quan Chen;Panagiotis Ilia;M. Polychronakis;A. Kapravelos
作为保护用户隐私的一步，大多数Web浏览器默认执行某种形式的第三方HTTP cookie阻止或定期删除，而用户通常可以选择更严格的阻止策略。因此，网络跟踪器已经改变了他们的努力，以解决这些限制，并保留甚至提高其跟踪能力的范围。在本文中，我们揭示了越来越多地使用依赖第三方JavaScript代码设置的第一方cookie来实现用户跟踪和其他可能不需要的功能的做法。虽然与第三方cookie不同，第一方cookie不会在HTTP请求时由浏览器自动发送给第三方，但这种跟踪是可能的，因为任何包含的第三方代码都在父页面的上下文中运行，因此可以完全设置或读取现有的第一方cookie-然后它可以泄漏给相同或其他第三方。以前的作品，调查用户隐私在网络上的cookie，第三方或其他方面，没有充分探讨这一机制。为了解决这一问题，我们提出了一个基于Chromium的动态数据流跟踪系统，用于跟踪第一方cookie向第三方的泄漏，并使用它对Alexa前10 K网站进行了大规模的研究。总体而言，我们发现97.72%的网站具有由第三方JavaScript设置的第一方Cookie，并且在这些网站中，有57.66%的网站至少有一个包含唯一用户标识符的Cookie，该标识符被传播给多个第三方。我们的研究结果突出了第一方cookie的隐私侵入能力，即使是在隐私意识强的用户采取了诸如阻止第三方cookie或使用流行的众包过滤器列表（如EasyList/EasyPrivacy和Disconnect列表）等缓解措施的情况下。
As a step towards protecting user privacy, most web browsers perform some form of third-party HTTP cookie blocking or periodic deletion by default, while users typically have the option to select even stricter blocking policies. As a result, web trackers have shifted their efforts to work around these restrictions and retain or even improve the extent of their tracking capability. In this paper, we shed light into the increasingly used practice of relying on first-party cookies that are set by third-party JavaScript code to implement user tracking and other potentially unwanted capabilities. Although unlike third-party cookies, first-party cookies are not sent automatically by the browser to third-parties on HTTP requests, this tracking is possible because any included third-party code runs in the context of the parent page, and thus can fully set or read existing first-party cookies—which it can then leak to the same or other third parties. Previous works that survey user privacy on the web in relation to cookies, third-party or otherwise, have not fully explored this mechanism. To address this gap, we propose a dynamic data flow tracking system based on Chromium to track the leakage of first-party cookies to third parties, and used it to conduct a large-scale study of the Alexa top 10K websites. In total, we found that 97.72% of the websites have first-party cookies that are set by third-party JavaScript, and that on 57.66% of these websites there is at least one such cookie that contains a unique user identifier that is diffused to multiple third parties. Our results highlight the privacy-intrusive capabilities of first-party cookies, even when a privacy-savvy user has taken mitigative measures such as blocking third-party cookies, or employing popular crowd-sourced filter lists such as EasyList/EasyPrivacy and the Disconnect list.