Quantcast
Connect with us

Visited porn? Web browser flaw secretly bares all

Published

on

Some websites use browser flaw to expose where you’ve gone

Dozens of websites have been secretly harvesting lists of places that their users previously visited online, everything from news articles to bank sites to pornography, a team of computer scientists found.

The information is valuable for con artists to learn more about their targets and send them personalized attacks. It also allows e-commerce companies to adjust ads or prices — for instance, if the site knows you’ve just come from a competitor that is offering a lower price.

ADVERTISEMENT

Although passwords aren’t at risk, in harvesting a detailed list of where you’ve been online, sites can create thorough profiles on its users.

The technique the University of California, San Diego researchers investigated is called “history sniffing” and is a result of the way browsers interact with websites and record where they’ve been. A few lines of programming code are all a site needs to pull it off.

Although security experts have known for nearly a decade that such snooping is possible, the latest findings offer some of the first public evidence of sites exploiting the problem. Current versions of the Firefox and Internet Explorer browsers still allow this, as do older versions of Chrome and Safari, the researchers said.

The report adds to growing worry about surreptitious surveillance by Internet companies and comes as federal regulators in the U.S. are proposing a “Do Not Track” tool that would prevent advertisers from following consumers around online to sell them more products.

ADVERTISEMENT

The researchers found 46 sites, ranging from smutty to staid, that tried to pry loose their visitors browsing histories using this technique, sometimes with homegrown tracking code. Nearly half of the 46 sites, including financial research site Morningstar.com and news site Newsmax.com, used an ad-targeting company, Interclick, which says its code was responsible for the tracking.

Interclick said the tracking was part of an eight-month experiment that the sites weren’t aware of. The New York company said it stopped using the technique in October because it wasn’t successful in helping match advertisers to groups of Internet users. Interclick emphasized that it didn’t store the browser histories.

Morningstar said it ended its relationship with Interclick when it found out about the program, and NewsMax said it didn’t know that history sniffing had been used on its users until The Associated Press called. NewsMax said it is investigating.

ADVERTISEMENT

The researchers studied far more sites — a total of the world’s 50,000 most popular sites — and said many more behaved suspiciously, but couldn’t be proven to use history sniffing. Nearly 500 of the sites studied had characteristics that suggested they could infer browsers’ histories, and more than 60 transferred browser histories to the network. But the researchers said they could only prove that 46 had done actual “history hijacking.”

“Browser vendors should have fixed this a long time ago,” said Jeremiah Grossman, an Internet security expert at WhiteHat Security Inc., which wasn’t involved in the study. “It’s more evidence that we not only needed the fix, but that people really should upgrade their browsers. Most people wouldn’t know this is possible.”

The latest versions of Google Inc.’s Chrome and Apple Inc.’s Safari have automatic protections for this kind of snooping, researchers said. Mozilla Corp. said the next version of Firefox will have the same feature, adding that a workaround exists for some older versions as well.

ADVERTISEMENT

Microsoft Corp. noted that Internet Explorer users can enable a private browsing mode that prevents the browser from logging the user’s history, which prevents this kind of spying. But private browsing also strips away important benefits of the browser knowing its own history, such as displaying Google links you’ve visited in different colors than those you haven’t.

“It’s surprising, the lifetime that this fundamental a privacy violation can stick around,” said Hovav Shacham, an assistant professor of computer science and engineering at UC San Diego and one of the paper’s authors.

Internet companies are obsessed with tracking users’ behavior so they can target their ads better. Uproar has prompted the Federal Trade Commission to propose rules that would limit advertisers’ ability to track Internet users to show them advertisements. The “Do Not Track” tool the commission is proposing could eventually take the form of a browser setting that tells advertisers which visitors are off limits; such a setting, though, wouldn’t necessarily block history sniffing.

ADVERTISEMENT

History sniffing is essentially a side-by-side comparison of Web pages you’ve already visited with Web pages that a particular site wants to see if you’ve visited. If there’s a match, users likely would never know, but the site administrators would learn a lot about their audiences.

For instance, a popular porn site was checking its visitors’ histories to see if they’d visited 23 other pornography sites, and the code used on the Morningstar and NewsMax.com sites looked for matches against 48 specific Web pages, all related to Ford automobiles.

Sites can carry on this kind of inspection very quickly. Grossman said modern programs can check as many as 20,000 Internet addresses per second.

Mochila insert follows…

ADVERTISEMENT


Report typos and corrections to: [email protected].
READ COMMENTS - JOIN THE DISCUSSION
Continue Reading

Breaking Banner

Trump whistleblower needs to go directly to FBI because Bill Barr can’t be trusted: Ex-FBI director

Published

on

Appearing on MSNBC with host Alex Witt, former FBI Assistant Director for Counterintelligence Frank Figliuzzi blew up Donald Trump's claim that he is the victim of a "Ukraine Witchhunt."

He then added that the whistleblower who went to the inspector general with a serious charge against the president should take what he has and go to the FBI within a week if nothing happens.

"We've got to get to the bottom of this, and we can't rely on leaks and certain reporters getting certain tidbits of information," the ex-FBI man explained. "This needs to be explored and it's likely this could end up in a criminal investigation."

Continue Reading

Raw Exclusives

California finally has a progressive government. Here’s how it’s changing the game.

Published

on

Democrats won supermajorities in both houses of the California legislature in 2006. They have dominated Golden State politics ever since, defying conservative expectations. Instead of sinking into deficits and collapsing, California is running a budget surplus, and has become the world’s 5th largest economy.

However, tensions between the Democratic establishment and grassroots activists have continued – until now. In 2019, reams of progressive legislation are finally becoming law after years of resistance from centrist forces within the party, a barrier that only dissolved after the 2018 elections. Put simply, now that a truly progressive majority has taken power, the people of California can at last have nice things.

Continue Reading
 

Facebook

Furious Biden goes scorched earth on ‘serial abuser’ Trump over smears in epic rant

Published

on

On Saturday in Des Moines, Iowa, former Vice President Joe Biden furiously laid into President Donald Trump amid reports he tried to strong-arm the Ukrainian government into digging up dirt on him and his son.

"Here's what I know, I know Trump deserves to be investigated," said Biden. "He is violating every basic norm of a president. You should be asking him the question, why is he on the phone with a foreign leader trying to intimidate a foreign leader, if that's what happened? That appears to have happened. You should be looking at Trump. Trump's doing this because he knows I'll beat him like a drum and he's using the abuse of power and every element of the presidency to try to do something to smear me."

Continue Reading
 
 
Help Raw Story Investigate and Uncover Injustice. Join Raw Story Investigates for $1 and go ad-free.
close-image