Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evercookie: A cookie that undeletes itself from 8 different storages

samy.pl

Post reply on HN
Print view View original

21–30 of 114 posts

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#21

Post by nl »

nl wrote: post #18
Groxx wrote: post #3

Earlier quoted context omitted.

No kidding. I especially liked: > Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out and: > Storing cookies in Web History (seriously. see FAQ) Brilliant and EVIL . Wow.

Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out That's pretty "nice". It might be possible to "improve" it by storing metadata inside the PNG, and then reading it by parsing it out of the raw data after the call to getDataURL(). I haven't tried this though, and it's possible browsers drop the metadata when they recreate the image. The spec sa…

Thinking about it a bit more, it's actually worse than that.

http://www.nihilogic.dk/labs/imageinfo/ shows how to extract EXIF data from JPEG files, so using EXIF + the cache hack is possible for sure.

http://www.nihilogic.dk/labs/id3/ shows how to extract ID3 metadata from MP3s in Javascript, so you could do a similar thing like that.

Can anyone think why just using the cache hack + a JSON data file wouldn't work?

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#22

Post by skymt »

JeremyHerrman wrote: post #16

I feel sick after reading this. Would a browser extension be able to clear everything?

The privacy tools built into all current browsers can clear all but one of evercookie's storage methods. Specifically, cookies, cache, history & HTML5 storage should all be included in your browser's "clear private data" feature. Flash cookies are a bit more of a problem: they're in a plugin, so the browser doesn't know about them. A tool like CCleaner would work, or you could clear them manually with Adobe's Flash control panel: http://www.macromedia.com/support/documentation/en/flashplay...

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#23

Post by olegkikin »

kogir wrote: post #9
danilocampos wrote: post #5

Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)

All of the methods he uses have been known to the web-app security community for a while. He's simply raising awareness of what's already broken. Keeping these things quiet helps nobody. We need more privacy and security issues to be publicly demonstrated so that they'll get fixed instead of ignored. As an example, his work exploiting wireless routers to get location is genius. Who would have thought that having your…

That MAX thing is not precise at all. Around 600 miles away from my real location.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#24

Post by pyre »

JeremyHerrman wrote: post #16

I feel sick after reading this. Would a browser extension be able to clear everything?

Flash Cookies: I imagine that if he can create them, then you can remove them, though I'm doubtful that extensions have full access to Flash internals.

HTML5 Storage: I'm not an expert on the different types of HTML5 storage, though since this is at the browser-level, I imagine the it would be easy for an extension to access them.

Regular Cookies: Obviously extensions have access to these.

Force-Cached PNGs: Not sure what access extensions have, though I imagine that Firefox extensions have a higher likelihood of access than Chrome/Chromium extensions. This is also hard to detect automatically though, unless you want to take the NoScript route and block all force-cached images unless they meet a whitelist.

Web History: Extensions obviously have access to web history, though this is something that would vary from implementation to implementation of evercookie, so it would be fighting an endless battle, like spam email filters. The best fix here would be to close the css history hack hole.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#25

Post by pyre »

toolate wrote: post #20
Groxx wrote: post #3

Earlier quoted context omitted.

No kidding. I especially liked: > Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out and: > Storing cookies in Web History (seriously. see FAQ) Brilliant and EVIL . Wow.

I wrote up a technique for storing values in the cache a little while back, no PNG or canvas necessary. http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...

True, but it's more difficult to analyze and attempt to filter a PNG based on content.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#26

Post by Groxx »

kogir wrote: post #9
danilocampos wrote: post #5

Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)

All of the methods he uses have been known to the web-app security community for a while. He's simply raising awareness of what's already broken. Keeping these things quiet helps nobody. We need more privacy and security issues to be publicly demonstrated so that they'll get fixed instead of ignored. As an example, his work exploiting wireless routers to get location is genius. Who would have thought that having your…

/me tries router xss

>400 Bad Request

Cross Site Action detected!

Sweet :) Though that's vs the vanilla script. Anyone know if there's one that works against DD-WRT?

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#27

Post by mey »

nl wrote: post #21
nl wrote: post #18

Earlier quoted context omitted.

Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out That's pretty "nice". It might be possible to "improve" it by storing metadata inside the PNG, and then reading it by parsing it out of the raw data after the call to getDataURL(). I haven't tried this though, and it's possible browsers drop the metadata when they recreate the image. The spec sa…

Thinking about it a bit more, it's actually worse than that. http://www.nihilogic.dk/labs/imageinfo/ shows how to extract EXIF data from JPEG files, so using EXIF + the cache hack is possible for sure. http://www.nihilogic.dk/labs/id3/ shows how to extract ID3 metadata from MP3s in Javascript, so you could do a similar thing like that. Can anyone think why just using the cache hack + a JSON data file wouldn't work?

It's even worse then that. http://en.wikipedia.org/wiki/Steganography That slightly larger in disk size logo on the main site could be hiding a tracking token for you....

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#28

Post by smurfpellet »

skymt wrote: post #22
JeremyHerrman wrote: post #16

I feel sick after reading this. Would a browser extension be able to clear everything?

The privacy tools built into all current browsers can clear all but one of evercookie's storage methods. Specifically, cookies, cache, history & HTML5 storage should all be included in your browser's "clear private data" feature. Flash cookies are a bit more of a problem: they're in a plugin, so the browser doesn't know about them. A tool like CCleaner would work, or you could clear them manually with Adobe's Flash c…

i use a ff extension called better privacy for managing flash cookies, it comes in handy: https://addons.mozilla.org/en-US/firefox/addon/6623/
Post reply on HN