Forgot your password?
typodupeerror
Privacy Security Your Rights Online

Un-killable 'Evercookie' Killed ... Sometimes 186

Posted by CmdrTaco
from the use-silver-bullets dept.
Trailrunner7 writes "The persistent method that security researcher Samy Kamkar introduced last week for storing tracking data on a user's machine, known as the 'Evercookie,' is even more worrisome when used on mobile devices, according to another researcher's analysis. The Evercookie is a simple method for forcing a user's machine to retain browser cookies by storing the data in a number of different locations. The method also has the ability to recreate deleted cookies if it finds that the user has removed them. Created by Kamkar as a demonstration of a way that sites could use to persistently track users even after they clear their browser cookies, the Evercookie has drawn the attention of a number of other researchers who have spent some time looking for methods to defeat it. A researcher in South Africa took a look at the way the the Evercookie works on both Safari on the desktop and on mobile devices, and found that it can be undone in some circumstances. However, he also found that the mobile version of Safari fares far worse in its handling of the Evercookie than the standard version does."
This discussion has been archived. No new comments can be posted.

Un-killable 'Evercookie' Killed ... Sometimes

Comments Filter:
  • Re:Solution: (Score:1, Insightful)

    by Anonymous Coward on Tuesday October 19, 2010 @05:32PM (#33954264)

    Better solution. Do all your browsing from a virtual machine running in non-persistent mode.

  • by Anonymous Coward on Tuesday October 19, 2010 @05:34PM (#33954286)

    While it is not un-killable, it is pretty much a pain in the ass to get rid of, since it will get back if you miss a single one and visit the site again.

    Didn't we used to call this kind of stuff "malware"? When did it become acceptable, no matter how annoying or unwanted the user is, to put something on their computer without their knowledge that is hard or near-impossible to remove?

  • Re:Solution: (Score:5, Insightful)

    by Anonymous Coward on Tuesday October 19, 2010 @05:35PM (#33954296)

    That's not the solution. The whole point of the "evercookie" is that it doesn't just use regular HTTP cookies to store information, but also abuses all kinds of common browser features related to CSS, caching, embedded Flash objects and anything else that can be exploited to store state. If all he did was store a cookie only, then any browser worth its salt could easily purge it from the browser history.

    So even if you just block cookies, that doesn't prevent this hack to work. You may need to block a whole range of features from JavaScript to HTTP caching to Flash support. It's certainly possible, but not something that an average user is prepared to do.

  • by countSudoku() (1047544) on Tuesday October 19, 2010 @05:43PM (#33954398) Homepage

    Not if they visit using a Live CD based OS. Ooops, sorry, just broke your new thing there. :) I'm not above using a Live CD to do things, and to collect stuff, which is stored on other things. IPs won't even help that now. Looks pretty broken. Hope the evercookie is chocolate.

  • by tehdaemon (753808) on Tuesday October 19, 2010 @06:03PM (#33954596)
    Malmarker then? Maldata? Evilbytes? I suppose at some level pedantry about word definitions makes sense, so fine, don't call it malware. But it is in the same 'badness' class as most malware, and needs an equally bad name to go with it.

    T

  • by The Wild Norseman (1404891) <(moc.liamg) (ta) (namesron.wt)> on Tuesday October 19, 2010 @06:04PM (#33954608)

    Malware is executable software. The evercookie isn't software, it's a simple marker.

    The cookie resides on my hardware, doing something (tracking -- albeit doing something passively in this case) which I only wish to grant it for a limited amount of time. When the makers of this cookie make it extremely difficult to delete, which takes away the control I have over the data on my computer, then I see no practical difference between this passive cookie and active malware. Just MHO.

  • by Anonymous Coward on Tuesday October 19, 2010 @06:27PM (#33954846)

    It's not a cookie either. A cookie goes in one place via an established set of rules and I can get rid of it by telling my browser to delete all cookies, none of which describes this thing.

  • by CCarrot (1562079) on Tuesday October 19, 2010 @06:35PM (#33954918)

    If we on Slashdot start calling cookies "malware" then it's no different than when ordinary computer users don't know the difference between a virus and a trojan.

    Ordinary cookies don't actively fight removal by the user, and once they're gone, they're gone.

    Ordinary (non-malware) applications don't actively fight removal by the user, and once they're gone, they're gone (okay, other than some leftover user/config data sometimes, but the program itself is gone and no longer does what it was designed to do).

    The 'Evercookie', on the other hand, behaves exactly like malware in that it actively resists being deleted by the user, even to the point of rebuilding itself after deliberate removal attempts, and all for the benefit of a third party.

  • by drcheap (1897540) on Tuesday October 19, 2010 @06:38PM (#33954952) Journal

    Malware is executable software. The evercookie isn't software, it's a simple marker.

    And what puts that "simple marker" on your computer? Oh yeah, JavaScript, which last time I checked is executable software.

  • by Firehed (942385) on Tuesday October 19, 2010 @06:39PM (#33954954) Homepage

    It's a fairly complex storage mechanism, designed to get around a user's preferences. In the wrong hands, it's very dangerous. I'd certainly call it closer to malware than, for example, the recent iPhone jailbreaks - which are so kind as to patch the security flaw that let the software run in the first place. Yet by your reasoning, jailbreaking is malware and evercookies are harmless. If you think that ad retargeting (ads that basically follow you around the web) is creepy, wait until they know with 100% certainty that you're a known user in some known demographic.

  • by Firehed (942385) on Tuesday October 19, 2010 @06:41PM (#33954974) Homepage

    Putting something in the TOS to "not [be] underhanded" is, in itself, being underhanded. Or perhaps you're that one non-crawler in my server logs with the request to /about/terms, in which case I take that back.

  • by Anonymous Coward on Tuesday October 19, 2010 @07:39PM (#33955500)

    Putting something in your Terms of Service isn't the same thing as informing the user, even if it's legally regarded to be so.

  • Re:Solution: (Score:3, Insightful)

    by thePowerOfGrayskull (905905) <marc,paradise&gmail,com> on Tuesday October 19, 2010 @07:46PM (#33955556) Homepage Journal

    Don't accept cookies.

    Also use Links2. (Links is crap, of course. ANd only losers use lynx...)

    Back in the real world, some of us do actually want to use the web for doing more than viewing static HTML pages. One or two of us even appreciate those awful persistent logins that cookies enable...

  • by thePowerOfGrayskull (905905) <marc,paradise&gmail,com> on Tuesday October 19, 2010 @07:50PM (#33955588) Homepage Journal

    Not if they visit using a Live CD based OS. Ooops, sorry, just broke your new thing there. :) I'm not above using a Live CD to do things, and to collect stuff, which is stored on other things. IPs won't even help that now. Looks pretty broken. Hope the evercookie is chocolate.

    Sooo... what's your point again? What percent of the population uses a LIveCD installation? And of that percentage, what further subset does so without any persistent storage (flash drive, etc) for user settings? (And if one person replies to me "I do, so there" [or its equivalent] , consider yourself virtually smacked for missing the point.)

    I'd say it's not broken until there's a less drastic means of evading it. If the only way to do so means - a) clearing history after every page and b) disabling cookies and c) disabling javascript OR d) running a Live CD OS ... well, I think it's pretty safe to say this is gonna be around for a while.

  • by davidbofinger (703269) on Tuesday October 19, 2010 @09:02PM (#33956112) Homepage
    It's not the same concept but "malcontent" deserves to be coined.
  • by Reziac (43301) * on Tuesday October 19, 2010 @10:53PM (#33956836) Homepage Journal

    Seems to me such stuff could be defeated (or at least rendered easily findable) if the browser is only allowed to write data to certain directories regardless of what some script might wish, unless the user actively specifies elsewhere (such as to save a download). Also seems to me this could be programmed into the browser so the user need not worry about it (indeed, would not need to even know about it).

    Someone will probably point out flaws in this scheme, but the concept is to make the "cure" as simple as possible.

  • by waveclaw (43274) on Tuesday October 19, 2010 @11:51PM (#33957188) Homepage Journal
    The Microsoft-is-the-computer idea is already well entrenched. You don't buy a computer anymore. You buy Windows or your buy a Mac.

    I bought a cheap, pre-built computer sitting in the font of a store to replace one of my (cheaper, older, dead) personal development servers. It had a Microsoft OS on it. I asked for the PC tech running the store to remove the OS and give me the price difference.

    His first reply was that PC's don't work without Windows.

    I told him I was going to just put Linux on it.

    They guy has been building and selling PCs at this place for years. His reply?

    "Uh, I don't think Linux runs on PCs."

    I just waited for him to crudely zero out the boot block on the HD I was going to trash anyway, bought my 'useless' PC and walked out.

    Evercookie is just another salvo in the silly Medieval/Industrial Age Idea of a war of control between producers verses consumer. Remember to be a good sheep, don't open those, you'll void the (useless) warranty! It comes in any color you want, as long as that color is black.

  • by notsinge (1925098) on Wednesday October 20, 2010 @02:49AM (#33958020) Homepage
    The user account you run your browser under makes no difference. This is about tracking you around the web. If you log into Google as your real identity, it sets a cookie (evercookie or otherwise), then every site you visit with adsense enabled marks your real identity down as having visited that site. You could be running your browser as whatever user you like in a chrooted Quebes VM all in a BSD jail and none of that will do a damn thing to stop this.
  • by bradley13 (1118935) on Wednesday October 20, 2010 @06:16AM (#33958946) Homepage

    It might have been malware (maldata?) if the guy had sold his work to unscrupulous companies. Instead, the researcher who developed the Evercookie has done us all a favor: he published exactly what Evercookie does. This makes everyone aware of the problem, and you can bet that browsers and add-ins will address the problem soon.

    Evercookie makes it clear that browsers need a central administration panel to manage all data that can be stored - directly or indirectly - by websites. I expect that the next major browser releases will include exactly this.

    Add-ins like Flash are a more difficult problem: Really, they should only be allowed to store data through the browser, so that their storage can also be properly managed. However, Adobe (and Microsoft, and Apple, and...) will try to keep this off the radar screen.

The speed of anything depends on the flow of everything.

Working...