New unblockable web trackers based on DNS aliasing

Discussion in 'privacy problems' started by sabazi, Dec 1, 2019.

  1. sabazi

    sabazi Registered Member

    Joined:
    Dec 1, 2019
    Posts:
    7
    Location:
    United States
    https://www.theregister.co.uk/2019/11/21/ublock_origin_firefox_unblockable_tracker/
     
  2. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    1,865
    This has already been discussed in the uBlock thread starting here.

    Btw, there are also other ways to block this stuff. For example, dnscrypt-proxy introduced this capability in v. 2.0.34.
     
  3. Stefan Froberg

    Stefan Froberg Registered Member

    Joined:
    Jul 30, 2014
    Posts:
    744
    Unblockable my ***
    This isn't exactly anything new.

    Good Ad blocker softwares have done subdomain blocking for ages.

    The only new thing is that instead of obvious ads.example.com or something like that, they use some random garbage subdomain name that in reality is just a CNAME record pointing to real target.

    Chrome might not be able to block it but any locally installed DNS server can (like unbound). And besides caching, DNSSEC, bypassing stupid DNS-level firewall restrictions and encryptions (DNS-TLS, Dnscrypt), it's also more effecient way of blocking anyway than browser extension because it's system wide.

    So now, for those not using uBlock origin and firefox DNS API, the only new extra step is "digging" those fishy looking subdomain names in the logs and see where they are really pointing to and then add into blocking lists as usual.

    dig +nocmd +noall +answer f7ds.liberation.fr

    Just one more extra step, nothing else changes.
     
  4. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    1,865
    FWIW, dnscrypt-proxy v. 2.0.35 improves its logging:
    Just tested it with one entry in Stefan's list:

    Code:
    dig 7mx.eidershop.com
    was blocked by dnscrypt-proxy and logged in /var/log/dnscrypt-proxy/blocked.log as

    Code:
    [2019-12-12 13:02:38]   127.0.0.1       eidershop.eulerian.net  *.eulerian.net (alias for [7mx.eidershop.com])
     
  5. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    8,577
    Location:
    U.S.A. (South)
    :thumb:
     
  6. 142395

    142395 Guest

    Came here from uBO thread to avoid OT. On my uBO, 189/189 of @Stefan Froberg 's ebis.ne.jp list and 590/590 of my a8.net list (local file, but now available on Stefan's site too) are in use even when added after updating all other filters, indicating none of these CNAME tracker is included in any of my filters, global or regional, including the Geoffrey's hosts file (BTW, don't you think "first-party tracker" is a misleading name?). I guess the same goes for probably all regions except for English (international) and French where most likely to be covered by Geoffrey, and thus wanna encourage others to do some searches for their local advertisers using CNAME tracker. Note in case of a8.net, they didn't use term CNAME, tho their explanation obviously suggested it. So maybe searching for "(advertiser's name or domains) AND cname" is not enough but similar search terms such as "dns" will also be required.
     
Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.