Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite
2

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore consider this GET request as well as sent cookie invalid. But what about iframe-based cookie stuffing?

share|improve this question
You require automation for this, and without business model it's hard to say anything concrete, but basically partner and the website validation and verification has to be employed, so the fake requests are detected also based on signal analysis as well on the global databases. Also your qualification criteria, limits, the time-limited and review should help as well. Basically to answer complex problem is easy is concrete scenario. – Andrew Smith Jul 25 '12 at 8:52
If you're running something like "NoScript" would it not work in this scenario as it's unlikely that you've whitelisted the webite and so the code in the iframe can't run? – Mark Hillick Jul 25 '12 at 11:45
@MarkHillick how does NoScript protect you against HTTP cookies? – curiousguy Jul 25 '12 at 16:44
@AndrewSmith my business model is similar to Amazon - I have partners which produce some traffic to my website and in case of user's purchase I pay them money. So, any ideas how to protect it? – Paul Podlipensky Jul 25 '12 at 17:34
digeratimarketing.co.uk/images/iframes.jpg ;-) I am checking it actually I am looking into partner websites too heh – Andrew Smith Jul 25 '12 at 21:10
show 1 more comment

1 Answer

up vote 3 down vote accepted

There is no one solution to this complex problem.

A client can enable the Do Not Track http header element. But there is no guarentee that the server will respect it. The PrivacySuite addon goes one step further to actively block tracking gadgets. There are *MANY* other anti-tracking addons for firefox as well as some for Chrome and I have no idea which one(s) are the best.

Ad-block Plus will keep your browser from loading many of these tracking gadgets, and even if such a gadget where to be loaded it will block the targeted ads. This solves the symptom but not the root of the problem.

NoScript might help, but this doesn't stop a server from setting a cookie via the http cookie header. It does however prevent some evercookie techniques.

Relivent TED talk: Tracking the Trackers

Also its wroth while to learn about Google's "Remarketing" feature for advertizes.

share|improve this answer
Nice answer.... – Mark Hillick Jul 26 '12 at 8:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.