[2102.09301] The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion

Skip to main content

Search arXiv

Press Enter to search · Advanced search

-->

Computer Science > Cryptography and Security

arXiv:2102.09301 (cs)

[Submitted on 18 Feb 2021 (v1), last revised 5 Mar 2021 (this version, v3)]

Title:The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion

Authors:Yana Dimova, Gunes Acar, Lukasz Olejnik, Wouter Joosen, Tom Van Goethem<br>View a PDF of the paper titled The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion, by Yana Dimova and 4 other authors

View PDF<br>HTML (experimental)

Abstract:Online tracking is a whack-a-mole game between trackers who build and monetize behavioral user profiles through intrusive data collection, and anti-tracking mechanisms, deployed as a browser extension, built-in to the browser, or as a DNS resolver. As a response to pervasive and opaque online tracking, more and more users adopt anti-tracking tools to preserve their privacy. Consequently, as the information that trackers can gather on users is being curbed, some trackers are looking for ways to evade these tracking countermeasures. In this paper we report on a large-scale longitudinal evaluation of an anti-tracking evasion scheme that leverages CNAME records to include tracker resources in a same-site context, effectively bypassing anti-tracking measures that use fixed hostname-based block lists. Using historical HTTP Archive data we find that this tracking scheme is rapidly gaining traction, especially among high-traffic websites. Furthermore, we report on several privacy and security issues inherent to the technical setup of CNAME-based tracking that we detected through a combination of automated and manual analyses. We find that some trackers are using the technique against the Safari browser, which is known to include strict anti-tracking configurations. Our findings show that websites using CNAME trackers must take extra precautions to avoid leaking sensitive information to third parties.

Comments:<br>To be published in PETS 2021. 21 pages, 7 figures

Subjects:

Cryptography and Security (cs.CR)

Cite as:<br>arXiv:2102.09301 [cs.CR]

(or<br>arXiv:2102.09301v3 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2102.09301

Focus to learn more

arXiv-issued DOI via DataCite

Submission history<br>From: Yana Dimova [view email]<br>[v1]<br>Thu, 18 Feb 2021 12:20:23 UTC (1,200 KB)

[v2]<br>Tue, 23 Feb 2021 13:46:05 UTC (924 KB)

[v3]<br>Fri, 5 Mar 2021 13:30:43 UTC (1,099 KB)

Full-text links:<br>Access Paper:

View a PDF of the paper titled The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion, by Yana Dimova and 4 other authors<br>View PDF<br>HTML (experimental)<br>TeX Source

view license

Current browse context:

cs.CR

next >

new<br>recent<br>| 2021-02

Change to browse by:

cs

References & Citations

NASA ADS<br>Google Scholar

Semantic Scholar

DBLP - CS Bibliography

listing | bibtex

Gunes Acar<br>Wouter Joosen<br>Tom van Goethem

export BibTeX citation<br>Loading...

BibTeX formatted citation

&times;

loading...

Data provided by:

Bookmark

Bibliographic Tools

Bibliographic and Citation Tools

Bibliographic Explorer Toggle

Bibliographic Explorer (What is the Explorer?)

Connected Papers Toggle

Connected Papers (What is Connected Papers?)

Litmaps Toggle

Litmaps (What is Litmaps?)

scite.ai Toggle

scite Smart Citations (What are Smart Citations?)

Code, Data, Media

Code, Data and Media Associated with this Article

alphaXiv Toggle

alphaXiv (What is alphaXiv?)

Links to Code Toggle

CatalyzeX Code Finder for Papers (What is CatalyzeX?)

DagsHub Toggle

DagsHub (What is DagsHub?)

GotitPub Toggle

Gotit.pub (What is GotitPub?)

Huggingface Toggle

Hugging Face (What is Huggingface?)

ScienceCast Toggle

ScienceCast (What is ScienceCast?)

Demos

Demos

Replicate Toggle

Replicate (What is Replicate?)

Spaces Toggle

Hugging Face Spaces (What is Spaces?)

Spaces Toggle

TXYZ.AI (What is TXYZ.AI?)

Related Papers

Recommenders and Search Tools

Link to Influence Flower

Influence Flower (What are Influence Flowers?)

Core recommender toggle

CORE Recommender (What is CORE?)

Author

Venue

Institution

Topic

About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs .

Which authors of this paper are endorsers? |<br>Disable MathJax (What is MathJax?)

Major funding support from