What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

Question

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not accessible directly through the url provided).

What does beacon.js do? What does this report mean?

As far as I understand beacon.js along with cookies does a bunch of tracking of visitors, but I am unclear as to details and implications.

Here is the only hard coded JS on the pages that show the beacon.js script

<script type="text/javascript">
    /* * * CONFIGURATION VARIABLES: EDIT BEFORE PASTING INTO YOUR WEBPAGE * * */
    var disqus_shortname = 'netlumination'; // required: replace example with your forum shortname

    /* * * DON'T EDIT BELOW THIS LINE * * */ (function () {
        var dsq = document.createElement('script');
        dsq.type = 'text/javascript';
        dsq.async = true;
        dsq.src = 'http://' + disqus_shortname + '.disqus.com/embed.js';
        (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
    })();
</script>

The above ends up modifying the html on my page to include a script link to "scorecardresearch.com/beaons.js"

This is the get request to scorecardresearch.com when I am completely logged out in Chrome incongnito mode:

http://b.scorecardresearch.com/b2?c1=7&c2=10137436&c3=1&ns__t=1356321346996&ns_c=UTF-8&c8=Disqus%20Comments&c7=http%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Ff%3Dnetlumination%26t_u%3Dhttp%253A%252F%252Fnetlumination.com%252Fdo-not-stop-not-thinking-negatively%252F%26t_t%3DDo%2520not%2520stop%2520not%2520thinking%2520negatively%26s_o%3Dpopular%231&c9=http%3A%2F%2Fnetlumination.com%2Fdo-not-stop-not-thinking-negatively%2F

And here is Disqus' embed script, which adds in scorecardresearch.com and google-analytics too:

http://mediacdn.disqus.com/1356132141/build/next/embed.js

Prettifed version of embed.js

---

My questions:

1. Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, since the script tag is on my page?
2. What does this mean? I assume they have the same power to parse my user traffic as, say Google Analytics.
3. Could they use the Disqus cookies stored on my site to log in to a user's Disqus account or access Disqus on another domain somehow?
4. What practical implication does that xss report have?
5. What are the disadvantages of allowing third party cookies on your site?

Answer 1

Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, since the script tag is on my page?

Yes. Any script included in your page either directly or indirectly (via disqus) has full access to interfere with the user's experience for everything on the hostname it is included on.

Stealing client-side (non-httponly) cookies is only one potential attack - if they wanted to, they could include a JavaScript keylogger to intercept all keypresses on your site, steal passwords, make the user automatically delete their account, and so on.

You will have to decide how much you trust Disqus and their partners, and gauge how sensitive the material on your site is, to come to a conclusion on whether this level of access is an acceptable bargain for the benefit of having a chat system for free. I'm a paranoid sort who can remember back to the days when TMRG (scorecardresearch) had their MarketScore spyware silent-installed in software bundles, so I'm not keen, personally.

If you're worried about this but still want to keep the chat feature, a potential workaround might be to include the chat in an iframe served from another domain that doesn't get scripting access into your main site domain.

As far as I understand beacon.js along with cookies does a bunch of tracking of visitors

Yep.

What does this report mean?

It's an automated vulnerability scan of the beacon service; it hasn't been processed manually to rate how much of a problem the detected issues actually are.

From the issues listed here we have the ability to inject unescaped HTML content into files from scorecardresearch.com. That would normally be an XSS vulnerability, albeit mitigated by the files that are being injected into being JavaScript files. So you could inject into scorecardresearch.com if you could make some visit that address using a browser that can be fooled into thinking the file is HTML by the presence of content like <html>. This is 'MIME-sniffing' and it's typically more of a problem for older browsers.

In any case, this probably doesn't affect you. You are including the script from scorecardressearch into your site's security context, not using scorecardresearch's potentially-compromised own context. Including a file as a <script> doesn't give MIME-sniffing any chance to misinterpret the string literal content as HTML, and there's no evidence of any holes in the script that would allow content to break out of the Javascript string literal (unescaped quote mark).

Answer 2

Very generally, a beacon is a periodically sent message that is transmitted to the service provider to show that the user is still present. Beacon examples include Wi-Fi access points (beaconing its presence), google analytics (users' beacons show how long the user has been on the site), etc.

By the way, this question could be better answered at SuperUser.