21
eBay (inadvertently) reveals secret code to detect cookie stuffers
Posted by k | Posted in Black Hat | Posted on 21-05-2009
Patrick, from Blogstorm posted about the recent filings in the eBay Inc. v. Digital Point Solutions, Inc. et al case whereby the plaintiff eBay Inc. alleged Defendants engaged in cookie stuffing to defraud Plaintiff. So far 80 documents have been filed in the case but the most interesting is number 68 which is the Second Amended Complaint against all defendants. Filed by eBay Inc.. (Eberhart, David) (Filed on 3/26/2009) (Entered: March 26, 2009).
Some quotes from this Second Amended Complaint which mentions Digital Point Coop Network are very interesting:
eBay placed a special “gif” image on the eBay.com home page. This special gif was served to any browser receiving an eBay cookie. eBay had observed that Defendants’ cookie stuffing schemes caused the user’s browser to be secretly redirected to eBay’s home page for only a short period of time—sufficient time for the cookie to be stuffed and little or no more.
The cumulative results of the investigation demonstrated that over 99% of the traffic directed by DPS and KFC during the time period of the investigation did not receive the gif image, and was therefore fraudulent cookie stuffing traffic.
This is very interesting for all you cookie stuffers out there: eBay has, in the past or still, used some code on his own page to detect fraudulent cookie stuffing.
What they reveal is the very common one pixel tracker method, but their tactics might have evolved since 2007.
So, forget about those fake image and similar stealth one time hit cookie stuffing scripts. On eBay you have to iframe load the whole page and preferably, do some random navigation.


Why doesn’t the image’s trick doesn’t work in that case?
It’s the equivalent of an iframe if you let enough time for the page to launch… right?
I actually never tried to test it with a stat tool, but I think both methods ‘print’ the tracking pixel
Awesome blog mate! regards from BlackhatGuide let me know if you want to partner up with my blog as well! =]