It turns out that Meta was tracking users' behavior in the same way as Russia's Yandex, embedding 'code that communicates with smartphone apps' on millions of websites, so deleting browser history is useless



Meta, the company that operates Facebook and Instagram, provides website managers with a tool called

the Meta Pixel to measure the effectiveness of their advertising. The Meta Pixel is used by millions of websites. It has been revealed that the Meta Pixel contains 'code that communicates with Meta apps installed on smartphones' and secretly tracks users' website browsing behavior. It has also been revealed that Yandex, a major Russian search engine, has been tracking users using a similar method.

Covert Web-to-App Tracking via Localhost on Android
https://localmess.github.io/



The Meta Pixel is a tool used by over 6 million websites to measure the effectiveness of Meta's web advertising. The Meta Pixel contained 'code that communicates with Meta apps installed on smartphones, such as Facebook and Instagram.'

Below is an image explaining Meta's tracking method. Meta pixels send 'page URLs' and 'website and browser metadata' to Meta's servers, and at the same time, data including account information was sent from Meta apps installed on smartphones to Meta's servers. This allowed Meta to track what web pages each user was accessing. This method allows users to track their behavior without using third-party cookies , so it can avoid tracking measures such as disabling the use of third-party cookies or regularly deleting browser history.



Yandex also deployed a similar tracking technique using its website analytics tool, Yandex Metrica.



According to the research team who discovered the tracking method, the tracking in question has been confirmed to be performed on Android, but has not been confirmed on iOS so far. The research team has reported the problem to web browser developers, and 'Chrome', 'Firefox', 'DuckDuckGo' and 'Brave' are working on addressing it. The research team also points out that 'to fully address the issue, it is necessary to strengthen the security of the OS's local host.'

After the research team published the tracking method on the Internet, Meta removed the tracking-related code.

in Mobile,   Web Service,   Security, Posted by log1o_hf