Security

AdGuard names 6,000+ web trackers that use CNAME chicanery: Feel free to feed them into your browser's filter

Assuming your content blocker can scrutinize DNS


AdGuard on Thursday published a list of more than 6,000 CNAME-based trackers so they can be incorporated into content-blocking filters.

CNAME tracking is a way to configure DNS records to erase the distinction between code and assets from a publisher's (first-party) domain and tracking scripts on that site that call a server on an advertiser's (third-party) domain. Such domain cloaking – obscuring who controls a domain – undoes privacy defenses, like the blocking of third-party cookies, by making third-party assets look like they're associated with the first-party domain.

As privacy barriers have gone up to prevent marketers from gathering data from web users, CNAME manipulation has become more popular. As we reported last week, privacy researchers recently found that the presence of CNAME trackers has increased 21 per cent over the past 22 months and that CNAME trackers show up on almost 10 per cent of the top 10,000 websites. Worse still, 95 per cent of websites that fiddle with their domain records in this manner leak cookies, which sometimes contain sensitive information.

The most commonly detected CNAME trackers, according to the researchers, come from the following companies, in order of prevalence: Pardot, Adobe Experience Cloud, Act-On Software, Oracle Eloqua, Eulerian, Webtrekk, Ingenious Technologies, TraceDock, LiveIntent, AT Internet, Criteo, Keyade, and Wizaly.

One reason for the growing popularity of CNAME tracking is that the deceptive use of its records can't currently be prevented – companies are free to configure their DNS records to disguise partners' servers as they see fit. So far as we are aware, the practice hasn't been challenged under existing privacy laws. And ad tech firms talk openly about bypassing defenses against CNAME data collection.

What's CNAME of your game? This DNS-based tracking defies your browser privacy defenses

READ MORE

Absent a way to forbid the practice, the defenses that exist are necessarily reactive. But they're not currently commonplace. Since last October, the Brave browser can detect CNAME cloaking and will attempt to determine the cloaked domain to block its cookies if appropriate. Firefox can do it too, with an extension like uBlock Origin or AdGuard DNS.

Safari offers only a way to limit the lifespan of cookies set via CNAME abuse. Chrome lacks an API for scrutinizing DNS in the same way as Firefox (dns.resolve), which limits what Chrome (and Edge) extensions can do.

"In order to prevent it you'll need to use a content blocker that can access DNS queries," Andrey Meshkov, CEO of AdGuard, told The Register.

"The whole problem is that the majority of users don't use them and just stick to Chrome or Safari browsers with extensions. These users can only 'react' to the problem, they can only start blocking a new disguised tracker as soon as we detect it on AdGuard DNS and update the list."

Meshkov acknowledged that this is not a proactive approach, but it works within the existing system for applying filtering lists to content blockers.

Without the equivalent of Firefox's dns.resolve in Chrome, AdGuard is using its own DNS service to tease out whether domains are engaged in CNAME manipulation and has now made a list of those domains so they can be blocked by extensions and applications that integrate filtering lists.

Meshkov in a blog post pledged to keep the CNAME tracker list updated but cautioned there's a limit to the number of filters that can be checked.

Chrome and Safari both take a declarative approach for their extensions – meaning content blocking tools need to declare the domains to be blocked in advance – that limits the number of blocking rules to 150,000 and 50,000 respectively.

"Even today we see that Safari's 50,000 rules are barely enough to protect yourself against ads, trackers, and everything else bad that's lurking on the web," warned Meshkov. "One day they will simply run out of space to protect users against actual threats, and this day is closer than you might think." ®

Send us news
38 Comments

In-app browsers are still a privacy, security, and choice problem

Regulators reminded that longstanding concerns haven't been addressed

Majority of Americans now use ad blockers

We're dreaming of a white list, because we're just like the ones you used to know

Meta accused of snarfing people's Snapchat data via traffic decryption

I ain't afraid of no ghosts, but in this case...

Google gooses Safe Browsing with real-time protection that doesn't leak to ad giant

Rare occasion when you do want Big Tech to make a hash of it

US and Europe try to tame surveillance capitalism

Trade watchdog argues that browsing and location data are sensitive and deserve to be defended

Microsoft Copilot for Security prepares for April liftoff

Automated AI helper intended to make security more manageable

In the rush to build AI apps, please, please don't leave security behind

Supply-chain attacks are definitely possible and could lead to data theft, system hijacking, and more

IAB Europe's ad consent popups pose privacy problem

Court of Justice of the European Union says consent identifers are personal info, subject to GDPR

March Patch Tuesday sees Hyper-V join the guest-host escape club

Critical bugs galore among 61 Microsoft fixes, 56 from Adobe, a dozen from SAP, and a fistful from Fortinet

Infosec teams must be allowed to fail, argues Gartner

But failing to recover from incidents is unforgivable because 'adrenalin does not scale'

Forget TikTok – Chinese spies want to steal IP by backdooring digital locks

Uncle Sam can use this snooping tool, too, but that's beside the point

FreeBSD Foundation hands out Beacon gongs for safer software

Multiple CHERI-related projects win money for important research that prizes safety over speed