AdGuard names 6,000+ web trackers that use CNAME chicanery: Feel free to feed them into your browser's filter

Assuming your content blocker can scrutinize DNS

AdGuard on Thursday published a list of more than 6,000 CNAME-based trackers so they can be incorporated into content-blocking filters.

CNAME tracking is a way to configure DNS records to erase the distinction between code and assets from a publisher's (first-party) domain and tracking scripts on that site that call a server on an advertiser's (third-party) domain. Such domain cloaking – obscuring who controls a domain – undoes privacy defenses, like the blocking of third-party cookies, by making third-party assets look like they're associated with the first-party domain.

As privacy barriers have gone up to prevent marketers from gathering data from web users, CNAME manipulation has become more popular. As we reported last week, privacy researchers recently found that the presence of CNAME trackers has increased 21 per cent over the past 22 months and that CNAME trackers show up on almost 10 per cent of the top 10,000 websites. Worse still, 95 per cent of websites that fiddle with their domain records in this manner leak cookies, which sometimes contain sensitive information.

The most commonly detected CNAME trackers, according to the researchers, come from the following companies, in order of prevalence: Pardot, Adobe Experience Cloud, Act-On Software, Oracle Eloqua, Eulerian, Webtrekk, Ingenious Technologies, TraceDock, LiveIntent, AT Internet, Criteo, Keyade, and Wizaly.

One reason for the growing popularity of CNAME tracking is that the deceptive use of its records can't currently be prevented – companies are free to configure their DNS records to disguise partners' servers as they see fit. So far as we are aware, the practice hasn't been challenged under existing privacy laws. And ad tech firms talk openly about bypassing defenses against CNAME data collection.

Absent a way to forbid the practice, the defenses that exist are necessarily reactive. But they're not currently commonplace. Since last October, the Brave browser can detect CNAME cloaking and will attempt to determine the cloaked domain to block its cookies if appropriate. Firefox can do it too, with an extension like uBlock Origin or AdGuard DNS.

Safari offers only a way to limit the lifespan of cookies set via CNAME abuse. Chrome lacks an API for scrutinizing DNS in the same way as Firefox (dns.resolve), which limits what Chrome (and Edge) extensions can do.

"In order to prevent it you'll need to use a content blocker that can access DNS queries," Andrey Meshkov, CEO of AdGuard, told The Register.

"The whole problem is that the majority of users don't use them and just stick to Chrome or Safari browsers with extensions. These users can only 'react' to the problem, they can only start blocking a new disguised tracker as soon as we detect it on AdGuard DNS and update the list."

Meshkov acknowledged that this is not a proactive approach, but it works within the existing system for applying filtering lists to content blockers.

Without the equivalent of Firefox's dns.resolve in Chrome, AdGuard is using its own DNS service to tease out whether domains are engaged in CNAME manipulation and has now made a list of those domains so they can be blocked by extensions and applications that integrate filtering lists.

Meshkov in a blog post pledged to keep the CNAME tracker list updated but cautioned there's a limit to the number of filters that can be checked.

Chrome and Safari both take a declarative approach for their extensions – meaning content blocking tools need to declare the domains to be blocked in advance – that limits the number of blocking rules to 150,000 and 50,000 respectively.

"Even today we see that Safari's 50,000 rules are barely enough to protect yourself against ads, trackers, and everything else bad that's lurking on the web," warned Meshkov. "One day they will simply run out of space to protect users against actual threats, and this day is closer than you might think." ®