Web bugs: hack or solution?
Saturday, June 24, 2006
What is it?
A Web bug is an object that is embedded in a Web page or e-mail and is usually invisible to the user but allows checking that a user has viewed the page or e-mail. Alternative names are Web beacon, tracking bug, pixel tag, and clear gif.
Typically, a Web bug is a small (usually 1×1 pixels) transparent GIF image (or an image of the same color of the background) that is embedded in an HTML page, usually a page on the Web or the content of an e-mail. Whenever the user opens the page with a graphical browser or e-mail reader, the image is downloaded. This download requires the browser to request the image from the server storing it, allowing the server to take notice of the download. As a result, the organization running the server is informed of when the HTML page has been viewed.
Anything other than image is used as a web bug?
Yes. Also uses a trick involving IFRAMEs for tracking the user information’s.
What information is sent to a server when a Web Bug is viewed?
These are the major information’s that send to the server,
- The IP address of the computer that fetched the Web Bug
- The URL of the page that the Web Bug is located on
- The URL of the Web Bug image
- The time the Web Bug was viewed
- The type of browser that fetched the Web Bug image
- A previously set cookie value
How can I see a Web Bug on a page?
A Web Bug can be found by viewing the HTML source code of a Web page and searching for IMG tags. A Web Bug will typically have its HEIGHT and WIDTH parameters in the IMG tag set to 1. Also for the tag to be a bug, the image should be loaded from a different server then the rest of the Web page.
What kinds of uses does a Web Bug have in an Email message?
- A Web Bug can be used to find out if a particular Email message has been read by someone and if so, when the message was read.
- A Web Bug can provide the IP address of the recipient if the recipient is attempt to remain anonymous.
- Within an organization, A Web Bug can give an idea how often a message is being forwarded and read.
What do Web Bugs in Email messages look lile?
Email Web Bugs are represented as 1-by-1 pixel IMG tags just like Web Bugs for Web pages. However, because the sender of the message already knows your Email address, they also include the Email address in the Web Bug URL. The Email address can be in plain text or encrypted. For example, here are two Web Bugs sent to me in junk Email messages:
Want to see a bugged page?
Yes. For a demonstration of a bugged Yahoo profile, see:
http://profiles.yahoo.com/webbug2000 This profile contains a visible Web Bug image that is being loaded from a server other than Yahoo. The Web Bug provides a log of everyone who has visited the profile page.
Finally, Is there any method of removing Web Bugs from HTML pages?
Not really. The technical problem is that there is no method of distinguishing Web Bugs from spacer GIFs which are used on Web pages for alignment purposes. Your best defense against Web Bugs is to turn off cookies.
Also you can prevent the email tracking by turning of the remote image loading. Almost all the standard mail clients like yahoo, gmail etc. are supporting this.
The IFRAME trick cannot be disabled by the standard countermeasure of turning off remote image loading. There may not be an easy way to disable it in today’s email software, short of turning off HTML email entirely
DiggIt! |
Del.icio.us