A privacy flaw in Microsoft's Windows Media Player (WMP) can allow a website to track the habits of a user of Internet Explorer 6 (IE6) and older versions of Netscape using the WMP plug-in. Using a simple block of code, a website operator can use a ClientID request to pull off of a machine a unique default serial number generated by WMP. The flaw occurs regardless of a Web browser's security settings. Since this number remains the same for each browser session opened, it can be sent back to the website where it can be used to track a user's habits.
According to Richard M. Smith, who posted news of the problem to BugTraq this week, the code to take advantage of this privacy flaw is very simple:
[OBJECT classid=”clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95″ ID=WMP WIDTH=1 HEIGHT=1]
The flaw, described by privacy advocate Smith as a “SuperCookie,” can only be fixed by disabling a setting that allows WMP to be uniquely identified, a feature only available in new versions of the player. Even modifying security settings to restrict cookies or using a cookie-blocker has no affect on these SuperCookies.
Websites can exploit a user's privacy in a number of ways. Since all websites get the same ID from each individual machine, they could theoretically swap information on that ID with other parties. If a user deletes a cookie from his or her machine, a site could possibly restore an old cookie that it has on file from the unique ID.
It's really amazing how simple this privacy flaw is to exploit. Any website out there could very easily take advantage of this to track people who have turned off or deleted cookies. What gets me is that I really can't think of any good reason why this unique ID should be publishable by default. A lot of what causes users to curse about their privacy on the Internet is a direct result of settings that are enabled by default on the software that we use.
When you install a browser or other Internet-connected software, should cookies or any other shareable information be initially disabled? Many Internet user probably don't even know the concept behind cookies or SuperCookies; however, when they access the Web they are sharing information about themselves and their habits, some perhaps unknowingly.
USER COMMENTS 37 comment(s)
|SMRT (12:39pm EST Fri Jan 18 2002)
And let's just display the code so that everybody with a web site can exploit the threat. It's nice to see that MS aren't the only people who don't get security – by On a rant
|Flaw? Really? (12:42pm EST Fri Jan 18 2002)
Indulge me for a moment with a bit of conspiracy theory. Is this really a flaw or is this something intentional from our friends in Redmond.
Let's think back for just a moment, remember the flap about serialized word documents? Or how about the serialized CPU that Intel was kind enough to give us?
Now we have WMP. Why is it even necessary for WMP to have a serial number? Not to mention that it is accesible through someones browser. No, I have trouble accepting that is is just more poor, accidental, security from Microsoft. I can't help but feel that this was very intentional.
– by Get a Grip
|Danger Will Robinson (12:45pm EST Fri Jan 18 2002)
Wow, some hacker can pull a serial number off my computer. What a threat to my privacy. I didn't want anybody to know my WMP unique ID was 123945aslkdg91023145-0815. Darn, now I guess I have to use Linux because Windows is crap for making such sensitive and critical data easy to access. – by – –
|hahaha (12:46pm EST Fri Jan 18 2002)
ahahahaah – by De@d St0p
|I read this 2 days ago (12:50pm EST Fri Jan 18 2002)
Get with it GEEK.COM! You're a day late any more! Why do I even come back here? – by Blah
|Unique windows identifier (1:03pm EST Fri Jan 18 2002)
I recall reading something somewhere back about a mangled version of the product key used to activate the various Windowses being accessible in some way through the browser. It was quite a while ago…
Also, why worry about WMP? The MAC address of your network card (for you always-on people) is an excellent full-time identifier. – by _D
|Blah (1:04pm EST Fri Jan 18 2002)
For the discussion? – by _D
|registry hack (1:11pm EST Fri Jan 18 2002)
For the daring you can change the registry setting for this so nothing gets sent out ever – even the auto-generated ID that the update will do. Leave the setting on but change the following registry key to blank :SoftwareMicrosoftWindows MediaWMSDKGeneralUniqueID
I've done this and haven't had any trouble using WMP yet but I advise you save off the original value just in case you need to set it back. No idea if it gets repopulated when WMP is updated. – by xx
|RE: Unique windows identifier (1:11pm EST Fri Jan 18 2002)
Question: Can the MAC address be accessed through your browser by a website? I assume not, but perhaps I'm wrong. I don't know.
– by Pond Scum
|Talk about privacy lapses (1:16pm EST Fri Jan 18 2002)
Look what the makers of Lindows did with your e-mail. Can you trust any Linux company – obviously not.
– by info4u
|of all the things (1:20pm EST Fri Jan 18 2002)
That can be scanned/recorded/analyzed about my activity on the net (sorry, I don't try to spoof my ip address to something different each time), the id of my media player is very low on my list of worries.
My guess is that it may have been a way to verify identity for the online music the record companies hope you “rent” (for single person use on one media player only!).
Just think what it will be like when ip6 takes over and every device has it's own ip address, we'll have to start swapping computers/phones/pagers to keep big brother confused…
|And on a related note… (1:32pm EST Fri Jan 18 2002)
Billy G sends a memo stating that MS is taking security very seriously. hehehe
And the MACaddr can't be used to track you since it is stripped at the first switch/router. – by Eyad
|The point!!! (1:34pm EST Fri Jan 18 2002)
This ignores security settings and any other privacy, measures. Do you want these people (M$) to have your creditcard info, and passwords??? What am i talking about?? You know M$ PassPort where if M$ gets its way you will have to have if you want to register your products. – by NOT ME!!
|It can't be turned off (2:12pm EST Fri Jan 18 2002)
What the update does is make it give random codes to anyone requesting it from the object. However, you have to enable this it's not enabled by default. – by Shade
|i'm scared (2:13pm EST Fri Jan 18 2002)
i will stop web browsing now because any site can track me… – by altrego
|Re: xx (2:15pm EST Fri Jan 18 2002)
Grab the following file. It'll change the UniqueID to another one. If enough of us change their ID to this, then it's not unique anymore. Btw, I made it put in a guid that ,when converted to ascii, is a nice little msg for MS.
– by Shade
|RE: Talk about privacy lapses (3:39pm EST Fri Jan 18 2002)
>> “Look what the makers of Lindows did with your e-mail. Can you trust any Linux company – obviously not.”
Huh?!? What are you talking about? The only thing that the article you linked to mentioned about e-mails is that Lindows is expected to release their contact database as part of the lawsuit. This was a demand made by Microsoft (and a ridiculous one at that), and as far as I know, Lindows has not yet complied with that demand — and likely won't. So who's the untrustworthy one there? Lindows, who has done nothing to release the database, or Microsoft, who's trying to use their lawyers to get private information off another company. Hmmm…..
|what? (3:41pm EST Fri Jan 18 2002)
How can this be a flaw? There's a setting to explicitly turn on/off if you want websites to grab your unique ID.
Hmm, sounds like it's doing exactly what it's supposed to do.
Privacy concern, definitely. Flaw, no way.
|attn jim (5:39pm EST Fri Jan 18 2002)
The point is that it's turned “on” by default.
Microsoft has explicitly enabled a “feature” that ellows malicious Webmasters to track your browsing habits across sites which are outside their domains, and in which they have no legitimate interest.
Privacy, like freedom, can die the “death of a thousand cuts.” No single attack is enough to eliminate your privacy, jsut as no single grain of sand can bury you – but when there are hundreds, thousands, or millions of breaches of privacy/grains of sand, you find you have no privacy left you are buried under a mountain fo sand.
Failure to oppose such breaches – the Intel unique CPU serial number, the WMP unique tracking code, etc. – is a quick way to ensure that your privacy erodes faster. – by Icesnake Frostfyre
|Can Be Turned off w/o Registry Hacks (6:08pm EST Fri Jan 18 2002)
The real purpose of this ID is to enable MS digital rights management scheme whereby they hope to create a market for so-called “secure digital content” where you can download and play music files, video, et. al. but only if you pay first. Kind of like an MP3 that only works if you've payed the artist, so to speak. In fact the Windows Audio format is intended to be a direct replacement for MP3s. Now, having said all that, who do you think wants a small cut per transaction in this new marketplace? That'd be MS…. It's all about the money, that why they have the ID. They don't care about tracking you in this case. (not that there haven't been other egregious privacy violations along this line)
And the best part, you can turn it off the options for Media Player. From the menu, “Tools”, then “Options”, look in the “Internet Settings” frame and uncheck the box which says “Allow Internet sites to uniquely identify your player”. This will not cause the above JS code to fail, it will still return a GUID, but the GUID will be new for every Windows session. So maybe it's a “Session Super Cookie”. Still better than allowing it to be persistent, which is the default and has people (rightly) bitching about that. The default should be off, just like the Intel CPU ID. I'm not sure I don't agree with the snake above that the thing is bad news in and of itself. Hmmm….. – by Casual Observer
|HA HA HA HA (1:47am EST Sat Jan 19 2002)
I thought MS was going to make security their priority. Gee, since every single frikken application they've ever written has the worst security and can be hacked by a blind one-armed script-kiddie, it will be a long long long time before I ever trust MS.
– by The Scavenger
|Man you guys don't know SHIT (3:48pm EST Sat Jan 19 2002)
Just go into WMP go to options and turn this off if you are that worried about this infringing on your privacy, in options it is labelled as “Allow internet sites to uniquely identify your player”. This is a feature for content management, this is not a flaw and if you are using this software you have accepted the license agreement which clearly states this. This is not news this has been around since Media Player 7 and has been. – by Endo
|whatever (6:03pm EST Sat Jan 19 2002)
ah fuck privacy what does anyone have to hide anyway you bad naughty people – by open world
| to: by NOT ME!! (1:58am EST Sun Jan 20 2002)
Passport is COOL! And good!
I do not like to type my credit card number in every Amazonian, at&tain, blablanian web store. Maybe I already have Trojan attached to my keyboard? Much better is to click button for payment. I save time too.
And Microsoft is big company it will stay around.
If one company have your data is better when 10.
Go ahead tell your secret to ten friends. It will become a public joke.
It is true for web.
I think, some specialized company or bank www Standard sounds better for Passport like service. Just it is not reality at least for now.
– by Typing is not ok.
|anybody read the license? (1:12pm EST Sun Jan 20 2002)
Just upgraded WMP yesterday and I took the trouble to read the license agreement. It clearly states that this is the behavior, the purpose of the ID, and tells you how to disable it. Seems this isn't a security flaw if you are informed of it. Of course most of us just assume that these licenses all pretty much say the same thing and skip them. Just like most of us never get an attachment with a virus and open them too. I don't love MS but don't find them at fault in this case. – by ironbutt
|Had to respond… (10:38pm EST Sun Jan 20 2002)
Thanks for publishing that code, it is unfortunate that some feel such things should be held in secret, when in fact administrators and even users deserve to know what weaknesses they are vulnerable too and should be given a good look at what fire power we are up against… Who knows… Perhaps someone that sees this will be inspired to solve the problem or take possible precautions, Knowlege is Power, and Should be Shared… – by WhiteHatTipping
|Why do people always as for things too be perfect? (12:09pm EST Wed Jan 23 2002)
Why do people always ask for things to be perfect? Microsoft puts a lot of money into their products and people still complain.
– by Journal Man
|MAC address tester (11:09pm EST Fri Feb 22 2002)
Go and test if your MAC address is exposed or not. – by besame mucho
|windows media file names (3:45pm EST Sun Mar 03 2002)
after viewing video files, I delete the file, but when in windows media, click file, and the file(s) appear at the bottom, how can I prevent other users in my household from reading where I have been downloading??????
could you email the solution to this problem.
would be very grateful you could and asap – by email@example.com
|Windows Media Update (9:29pm EST Sat Feb 22 2003)
Is there any way to stop WMP auto-update feature….Please let me know
I need this urgently.
|Windows Media Update (9:29pm EST Sat Feb 22 2003)
Is there any way to stop WMP auto-update feature….Please let me know
I need this urgently.
|Please mail me… (3:30pm EST Wed Apr 30 2003)
…my portable walrus-polishing kit! 4 super brushes to clean even the trickiest of sea-going mammals. Yes I am over 18, but my IQ isn't.
Ever heard of Google, you lazy bums? – by Shallimus
|Windows media player 9 (3:05pm EST Mon Sep 01 2003)
Will not shut of super cookies at all…….. – by BillQ71
|Progressive Download WMP9 allows file saving (3:22pm EST Thu Sep 25 2003)
Is there any way to avoid this?
Let's say, for instance, a producer puts his/her trailer up on their website and it's a Windows Media Player 9 file, is there a way to disable file downloading or file saving, the same way that QuickTime allows you to do this?
Is the only way to prevent file saving/downloading to computer while using a Progressive Download Windows Media Player 9 file to encode a STREAMING one and put it on a Windows Media Server?
Please help! – by BLURAVENA
|Got a virus or something!! GUID (12:02pm EST Wed May 05 2004)
For some strange reason I am unable to surf anymore using my Windows 2000 PC. It states that I have a download.Trojan virus, which I tried to delete but it was not allowing me to fully delete until I went to safe mode. I found that the virus is something to do with Media Player GUID. I tried uninstalling it but as we all know, if you uninstall something in Windows, it keeps it's directory and probably any offending files behind.
What can I do to get back to surfing without having to reformat my whole hard drive?
firstname.lastname@example.org – by Peter
|yg (4:20pm EST Fri Mar 11 2005)
h ygf yhjgv uhjbn uyg h guh uiygh uiyhg iuygu yg uyfg iug yu guy…………. – by hoggf
|I guess nobody understands Digital Rights Management (5:56pm EST Wed May 04 2005)
How can content owners protect their assets if users cannot be uniquely identified?
It is quite clear to me why this feature exists. And the feature can be turned off.
So what's the problem? Sounds like more whining by the anti-Microsoft crowd whose only alternatives for DRM are BitTorrent and Kazaa. – by Jim