  Online tracking is a whack-a-mole game between trackers who build and
monetize behavioral user profiles through intrusive data collection, and
anti-tracking mechanisms, deployed as a browser extension, built-in to the
browser, or as a DNS resolver. As a response to pervasive and opaque online
tracking, more and more users adopt anti-tracking tools to preserve their
privacy. Consequently, as the information that trackers can gather on users is
being curbed, some trackers are looking for ways to evade these tracking
countermeasures. In this paper we report on a large-scale longitudinal
evaluation of an anti-tracking evasion scheme that leverages CNAME records to
include tracker resources in a same-site context, effectively bypassing
anti-tracking measures that use fixed hostname-based block lists. Using
historical HTTP Archive data we find that this tracking scheme is rapidly
gaining traction, especially among high-traffic websites. Furthermore, we
report on several privacy and security issues inherent to the technical setup
of CNAME-based tracking that we detected through a combination of automated and
manual analyses. We find that some trackers are using the technique against the
Safari browser, which is known to include strict anti-tracking configurations.
Our findings show that websites using CNAME trackers must take extra
precautions to avoid leaking sensitive information to third parties.
