I recently started seeing data in my Google Analytics from two pages that aren’t mine, which is something that usually happens when someone copies your HTML source code without paying much attention. The traffic data assumes that the root URL of all page hits is yours and therefore hides it, but searching for the relative path on Google quickly uncovered the perpetrator.

To my surprise, it was the Turkish website of LG Electronics that was using my Google Analytics tracking code. On top of that, they were also hotlinking to one of my locally hosted copies of prefixfree.js, which I’m not even sure they’re getting any use of. One would think that a big company such as LG would have web developers that knew better.
So, seeing that they’re hotlinking to one of my script files, I decided to have some fun with cross-site scripting. To not get into any trouble, I figured I should stay away from trying to break the site, although there would have been lots of fun things that I could have done (like inserting and playing around with fool.js). But what if I could at least use the injected script to prevent the Google Analytics code from sending data to my account?







