Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From EFF's Web Bug FAQ(point 6),

What information is sent to a server when a Web Bug is viewed?

  1. The IP address of the computer that fetched the Web Bug
  2. The URL of the page that the Web Bug is located on
  3. The URL of the Web Bug image
  4. The time the Web Bug was viewed
  5. The type of browser that fetched the Web Bug image
  6. A previously set cookie value

I understand how (1), (3), (4), (5) can be fetched. Even (2) could be arranged by making sure that the pages that you want to track (which have the tracking pixels in them), have a one to one web bug url.

But what I clearly don't get is how would you get (6)? If you have a web bug on trackee.com/page that makes a request to tracker.com/pixel.gif, how can tracker.com identify a cookie stored under the domain of trackee.com? Is there something I am missing here?

share|improve this question

1 Answer 1

The URL of the Web page where the bug is located is obtained with the Referer HTTP header: when the browser downloads the "bug" picture, it simply says to the server "I found this link in that page". There is no need for a one-to-one mapping, although it could certainly be done.

For the point (6), it is not about a cookie from the host server (the one which contains the Web page which links to the bug) but a cookie from the bug server itself. In your notation, a cookie which was sent from the tracker.com server, and is sent back by the browser to the tracker.com server. Fortunately, obtaining the cookie values attached to trackee.com is not that easy ! Otherwise, plundering cookies would be trivial for any site which allows users to include links to external resources (e.g. all the StackExchange sites).

This cookie management is still a worry because it allows the bug administrator to reliably track people. Namely, the first time a given browser downloads a bug, the bug server sends back a unique cookie value (e.g. randomly generated). Every subsequent download of any bug from any page pointing to the same tracker.com server will contain that cookie value, so the tracker.com can easily see that it is the same browser as previously.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.