An Analysis of First-Party Cookie Exfiltration due to CNAME Redirections

Abstract

DNS CNAME redirections, which can "steer" browser requests towards a domain different than the one in the request's URI, are a simple and oftentimes effective means to obscure the source of a web object behind an alias. These redirections can be used to make third-party content appear as first-party content. The practice of evading browser security mechanisms through misuse of CNAMEs, referred to as CNAME cloaking, has been recently growing in popularity among advertisers/trackers to bypass blocklists and privacy policies.While CNAME cloaking has been reported in past measurement studies, its impact on browser cookie policies has not been analyzed. We close this gap by presenting an in-depth characterization of how CNAME redirections affect cookie propagation. Our analysis uses two distinct data collection samples (June and December 2020). Beyond confirming that CNAME cloaking continues to be popular, our analysis identifies a number of websites transmitting sensitive cookies to cloaked third-parties, thus breaking browser cookie policies. Manual review of such cases identifies exfiltration of authentication cookies to advertising/tracking domains, which raises serious security concerns.

Towards Understanding First-Party Cookie Tracking in the Field

“…Another option for a third party to set and access cookies in a first-party context is that the first party redirects requests on DNS level to another domain ("CNAME cloaking" -see Section 3.3). Previous work has shown the extend of CNAME based tracking in the wild [9,38,11]. In this work, we show that this technique is also present in the first-party cookie tracking ecosystems, and we replicate high level results of previous work to highlight the presence of this novel tracking technique.…”

“…Our results show that CNAME cloaking is commonly used but also abused to disguise trackers, which is in line with previous work [9,38,11]. To get a better understanding of who embeds trackers that use these techniques, we analyzed the sites' rank and category in our dataset which do so.…”

“…Dao et al also provide a first mitigation strategy for CNAME based cloaking, using machine learning [8]. Complementary to our work, Ren et al take a look at the effect of CNAME cloaking on browser cookie policies and how they propagate in the ecosystem [38]. They find that CNAME cloaking is often use to circumvent browser policies and that sensitive data is leaked by this bypass.…”

“…Previous work that analyzed the tracking ecosystem almost exclusively focused on third-party trackers from various perspectives (e.g., [1,14,13,16,15]). Other works focused on analyzed tracking attempts performed in the first party context using CNAME cloaking [9,11,38] (see Section 2). CNAME cloaking is one way to pace for a third party to place an identifier in the first-party context of a site (see Section 4.4).…”

Trackers Bounce Back: Measuring Evasion of Partitioned Storage in the Wild

“…This technique allows trackers to share their first party cookies, because the browser is fooled into attaching cookies from the original website's subdomain rather than the third party domain it redirects to [19]. Trackers can access session cookies, even those belonging to financial institutions, this way [8,43]. In this work, we focus on redirection-based circumvention only.…”