Cookie stuffing or cookie dropping is a Blackhat technique used to generate fraudulent affiliate sales. It involves placing an affiliate tracking cookie on a website visitor's computer without their knowledge, which will then generate revenue for the person doing the cookie stuffing. Income is generated when the affected user visits the target affiliate site and either creates an account or makes a purchase, depending on the terms of the affiliate agreement. This not only generates fraudulent affiliate sales, but also has the potential to overwrite legitimate affiliates' cookies, essentially stealing their legitimately earned commissions.
Operators of websites that allow user-generated content, such as forums that allow users to post, should be aware of this technique in order to protect their visitors from this attack. Cookie stuffing can be accomplished with as little as including an image in a forum post.
People can use your boards for this illegitimate practice if you don't protect yourself
There are several techniques for cookie stuffing, one of which works on most vBulletin forums. I'll put the following in code tags so only licensed vB owners can read it.
Code:
A user can add an [img] bbcode in a post and put an
affiliate page as the URL. That's all it takes to plant a
cookie with their affiliate tracking code on the computers
of everyone who views that post.
If you don't want people doing this, read on.
What this mod does
Code:
This modification inserts some Javascript on each
thread page when a moderator or admin is viewing
the thread. This Javascript counts how many [IMG]
tags are in each post, and then tries to check if a
given image is a valid image. If there is a mismatch,
it will display a warning message at the top of the
post alerting the mod/admin to the fact. There is the
possibility of false positives if an image takes an
inordinate amount of time to load. If you want to
check for that possibility, there is a "recheck" link in
the message, whereby you can recheck the images
in that post.
Installation
Import the product XML file in your Product Manager, then visit the Options group "Cookie Stuffing Detector Options".
After installation, you can check if this is working by creating a post and ....
Code:
including an image with an invalid URL, such as:
[img]http://example.com/adslkdfaslkjdsfkjldfsakjlsdfakj/[/img]
which should show up as a cookie stuffing attempt.
Future development
I am planning to expand this mod to:
Scan all posts in the database for possible cookie stuffing attempts.
Check posts when the user submits them for cookie stuffing attempts, and reject the post.
Known issues / Caveats
Broken images will cause false positives
This is marked as a 3.7.x mod, because that is what I developed it on and what I use it on. It has a good chance of working on 3.6.x as well, but I haven't tested that.
All admins and mods (even when viewing a forum they are not a mod in) will see the message in a post if it is a possible cookie stuffing attempt. This is by design.
Tested in... (on Windows XP)
Firefox 3
Internet Explorer 7
Opera 9.5
Safari 3
Google Chrome?!
Show Your Support
This modification may not be copied, reproduced or published elsewhere without author's permission.
@CareyCrew and FiMeTi: So you're getting the message at the very bottom of the page
Quote:
x of x posts on this page checked for cookie stuffing.
But none of the posts on the page are displaying the "Possible cookie stuffing!" warning? Try posting the following code in a post and then reload the thread.
Code:
[img]https://vborg.vbsupport.ru/[/img]
I just re-tested in Opera 5.52, Firefox 3.0.1, Safari 3.1.2, and Internet Explorer 7, and the post containing the above code was correctly marked with the "Possible cookie stuffing!" warning.
There is the possibility that you have other mods installed that is conflicting with the Javascript in this modification. Also, depending on how modified your style is, there could be conflicts displaying the warning message.
Please try viewing the thread using the default vBulletin style to see if the message shows up. You can create one by creating a new style and selecting no parent.
Like the idea but no matter what I do I get no error message. Tried a unmodded style, different browsers... I do get the message on the bottom.
On last thing to try would be with all other modifications disabled. Failing that, if you want to give me a user/pass (with mod permissions) for your boards, I could try to debug this.
Wouldnt this slow down the loading of a thread if the thread was 15 pages of images? Say there were 10 posts on every page, wouldn't it slow it down if that thread happened to be all images posted?
@CareyCrew and FiMeTi: So you're getting the message at the very bottom of the page But none of the posts on the page are displaying the "Possible cookie stuffing!" warning? Try posting the following code in a post and then reload the thread.
Code:
[IMG]http://example.com/non-existent-file/[/IMG]
I just re-tested in Opera 5.52, Firefox 3.0.1, Safari 3.1.2, and Internet Explorer 7, and the post containing the above code was correctly marked with the "Possible cookie stuffing!" warning.
There is the possibility that you have other mods installed that is conflicting with the Javascript in this modification. Also, depending on how modified your style is, there could be conflicts displaying the warning message.
Please try viewing the thread using the default vBulletin style to see if the message shows up. You can create one by creating a new style and selecting no parent.
Nope, turned off all mods but this one,went to a new default style ,added your image code to a test post and el zippo,no "stuffing attempt" message anywhere, just the "checked" message.
Cookie Stuffing Detector [Inside- What is Cookie Stuffing and Why you Should Care] Details »»
About Developer
Uses Plugins 
Is in Beta Stage 
09-08-2008, 04:07 PM
