Microsoft Windows Media Player Discloses Unique ID to Remote Users in the Default Configuration, Allowing Web Sites to Track Users
SecurityTracker Alert ID: 1003228|
SecurityTracker URL: http://securitytracker.com/id/1003228
(Links to External Site)
Updated: Jan 15 2002|
Original Entry Date: Jan 15 2002
Disclosure of system information|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes |
A demonstration exploit page is available at:
This exploit works with Internet Explorer and Netscape browsers and may work with additional browsers.
ID=WMP WIDTH=1 HEIGHT=1></OBJECT>
A remote user can obtain the GUID of another user's Windows Media Player.|
Newer versions of Windows Media Player provide the user with an option to not provide the GUID to other web sites. This option is accessible via the media player and not Internet Explorer.|
For users of version 6.4, a patch is available that will provide this option (note that the default is still to allow the GUID to be disclosed):
Windows Media Player 7.0 users should upgrade to 7.1 to obtain this feature.
Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)
Access control error|
|Underlying OS: Windows (Any)|
Source Message Contents
Subject: Internet Explorer SuperCookies bypass P3P and cookie controls|
There is a significant privacy problem with Internet Explorer
because of a design flaw in the Windows Media Player (WMP). Using
unique ID number of the Windows Media Player belonging
to a Web site visitor. This ID number can then be used just
like a cookie by Web sites to track a user's travels around
However this ID number becomes a SuperCookie because it can be used
by Web sites to bypass all of the new privacy and P3P protections
that Microsoft has added to Internet Explorer 6 (IE6). IE6 ships
today with all Windows XP systems. SuperCookies also work in all
previous versions of Internet Explorer with all older versions of
Some of the other features of SuperCookies include:
- There appears to be no method of blocking
SuperCookies from a Web site except to uninstall
- All Web sites get the same ID number so they
can easily exchange information about a user
much like third-party cookies are used today
by ad networks and Internet marketing companies.
- Even if someone is using a cookie blocker add-in,
SuperCookies will still work.
- If a user has deleted cookies from his or her computer
to stop tracking, a Web site can restore an
old cookie value from this ID number. Once the
cookie value has been restored, new tracking data
can be combined with tracking data that was
previously collected by the Web site.
I've set up a simple demo page that shows the
This demo stills works even if the WMP option "Allow
Internet sites to uniquely identify your player" is
turned off. This option controls when the WMP ID number
is given out to Web sites when downloading streaming audio
programs from getting this number.
When the Windows Media Player is installed on a computer, a
unique ID number in the form of a GUID is assigned to the player.
This ID number is stored in the Windows registry. The ActiveX
Program to retrieve the ID number using the property "ClientID".
easy it is to retrieve the ID number:
ID=WMP WIDTH=1 HEIGHT=1></OBJECT>
be sent back to a Web site either by appending it to the URL
of a Web bug or storing it in regular Web browser cookie.
Recommendations for Microsoft
I originally notified Microsoft of this problem in
One solution to this problem is for Microsoft to remove
the ClientID property from the WMP ActiveX control. For
to keep the property around, but always have it return a
GUID of all zeros for all users.
An even better idea might be to remove the WMP player
ID number altogether and have WMP instead use the standard
cookie mechanism of Internet Explorer.
Richard M. Smith
Delivery co-sponsored by VeriSign - The Internet Trust Company
FREE E-COMMERCE SECURITY INFRASTRUCTURE GUIDE
When building an e-commerce site, you want to start with a strong, secure
foundation. Learn how with VeriSign's FREE White Paper, "Building an
E-Commerce Trust Infrastructure." See how you can authenticate your site to
customers, use 128-Bit SSL encryption to secure your web servers, and accept
secure payments online. Click here: