[Full-Disclosure] Privacy leak in VeriSign's SiteFinder service
Richard M. Smith
rms at computerbytesman.com
Tue Sep 23 22:03:45 BST 2003
I just discovered that VeriSign's SiteFinder Web site is leaking data
submitted in Web forms to its marketing analysis partner, Omniture.
Forms can easily contain personal information such as an email address.
For the problem to occur, a Web form must use the GET method.
This data spill problem occurs if a Web page anywhere on the Internet
submits a Web form to an action URL with a misspelled or expired domain
name. Because of VeriSign's recent controversial changes to the DNS
system, this form data is submitted to the SiteFinder Web site.
SiteFinder in turn passes the form data along to Omniture in the URL of
a Web bug. The Web bug is constructed on the fly by about 50 lines of
This data spill problem raises legal questions because of possible
Communications Privacy Act (ECPA).
As a point of comparison, it appears that Microsoft went out of their
way to not receive form data with their Smart Search feature. In my
experiments, Smart Search is not enabled for Web form action URLs with
misspelled or expired domain names. Instead, Internet Explorer gives a
generic 404 error page.
Here's an example form that illustrates the problem:
<input type=hidden name=list value=horsebreeding>
<input type=text name=email>
<input type=submit value="Subscribe">
And here's what the URL of Omniture Web bug looks like with an email
address from the form in it:
Some relevant links are:
Data spills in banner ads
Omniture company overview
Electronic Communications Privacy Act
Court draws a line for online privacy
Richard M. Smith
Full-Disclosure is hosted and sponsored by Secunia.