|
Tuesday
- September 5, 2000
Web Bugs Create Privacy Concerns
Readers of email document attachments beware:
the author of a computer file may be able to track the path
of the file
to your computer and others through the use of "Web
bugs," the Privacy Foundation reported today.
The finding could have broad implications for
businesses, public agencies and other entities, which may
seek to use this tracking ability -- and for individuals,
who are unlikely to know that the file they are reading is
communicating back to the author through the Internet.
"We are not aware of Web bugs being used
in this way," said Richard M. Smith, chief technology
officer of the Privacy Foundation. "But the possibility
is troubling given the trend of using the Internet and monitoring
software to track individual behavior."
The tracking potential occurs when a file sent
through the Internet, typically as an email attachment, contains
an image file located on a remote Web server. This can happen
through a range of popular Microsoft programs, including
Word, Excel and PowerPoint. (The Privacy Foundation continues
to investigate this issue with regard to other software programs.)
If the document contains an invisible marker
called a Web bug, then when the request for the image is
made and acted upon within the displaying program, a signal
will be sent back to the document author. This signal, obtained
through server logs, will contain the IP number, from which
a host name of the computer can usually be obtained.
In addition, if the bugged document is forwarded
to any another computers and opened, it can send back the
IP number and host name of those computers to the document
author. In some cases, by using cookies in Internet Explorer,
an author could match up the computer viewers of a document
to their visits to the author's Web site.
The Privacy Foundation findings were presented
to Microsoft Corp. earlier this month for review. The company
acknowledged the potential use of Web bugs to track Word
documents, but said that there is no evidence that such activities
are occurring.
The Privacy Advisory, authored by Smith, notes
a myriad of potential uses for document Web bugs: tracking
the path of confidential files, detecting copyright infringement,
and surreptitious market research. In most cases, it is unlikely
that the person who opens such a document on a computer would
know that the Web bug exists.
"The potential use of Web bugs in Word
points to a more general problem," said Smith. "Any
file format that supports automatic linking to Web pages
or images can lead to the same problem. Software engineers
should take this privacy issue into consideration when designing
new file formats."
Smith noted, for instance, that Web bugs could
be used within text material that accompanies downloaded
MP3 music files to track how many times a song is played
and on which computer.
--
Return to September
2000 News Archive
|
