Django and Mindspark

Question

I have a Django based website that collects data using forms. All users have to login to access the forms.

Today I saw a strange error where a user submitted a form with a combination of form values that could not be generated from the form webpage. In fact the POST data was so bizarre, it caused the code to crash and gave me a stack trace.

Most of the stack trace looked pretty normal, except the cookies:

COOKIES:{'csrftoken': 'VZJsrl3MsZzNOttdmmeS2AshrH3Wsk3Y',
 'mindspark_extension_api_features_223931006': 'TOOLBAR_CLEANER',
 'mindspark_extension_api_features_233005932': 'TOOLBAR_CLEANER',
 'mindsparktb_223931006': 'true',
 'mindsparktb_233005932': 'true',
 'mindsparktbsupport_223931006': 'true',
 'mindsparktbsupport_233005932': 'true',
 'sessionid': 'removed by me'},

I have never seen the mindspark entries. I believe the cookie is Django specific, so I am not sure why these mindspark entries are showing up. I know the user is not sophisticated enough to manually generate the POST. Nor does the user have any incentive.

Any ideas on how to figure out how this POST is generated?

Answer 1

MindSpark is a "Potentially Unwanted Program" flagged by several anti-malware/spyware tools. It is installed with many unwanted browser toolbars, and serves largely as a way of boosting advertising revenue and improving user tracking. I believe the cookies are injected across sessions including private/incognito browsing to allow websites to identify a user, even if they are taking the regular precautions to avoid it.

The browser sends it to all domains; websites that can benefit from MindSpark users, use this cookie to generate other actions from the user's machine, that are likely used to boost revenues.

The user is not intentionally generating POSTs that cause failures in your web server. It's just that his/her browser has a PUP toolbar that he/she likely installed by not paying close attention to it. You may want to inform this end user.

References:

1. Kotzias, Platon, Leyla Bilge, and Juan Caballero. "Measuring PUP prevalence and PUP distribution through Pay-Per-Install services." Proceedings of the USENIX Security Symposium. 2016.
2. Malwarebytes blog post