I still know what you visited last summer: Leaking browsing history via user interaction and side channel attacks

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2011, Pages 147-161

  Weinberg, Zachary ^a   Chen, Eric Y ^a   Jayaraman, Pavithra Ramesh ^a   Jackson, Collin ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

NETWORK SECURITY;

'CURRENT; BROWSING HISTORY; INTERACTION CHANNEL; INTERACTIVE TECHNIQUES; LEARN+; SIDE-CHANNEL ATTACKS; USER INTERACTION; USER STUDY; WEB-SITES;

SIDE CHANNEL ATTACK;

EID: 80051955689     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2011.23     Document Type: Conference Paper

References (65)

1. A. Clover. (2002) CSS visited pages disclosure. BUGTRAQ mailing list posting. http://seclists.org/bugtraq/2002/Feb/271
2. L. D. Baron. (2002): visited support allows queries into global history. Mozilla bug 147777. https://bugzilla.mozilla.org/show-bug.cgi?id=147777
3. -. (2010) Preventing attacks on a user's history through CSS: visited selectors. Web page. http://dbaron.org/mozilla/visited-privacy
4. D. Jang, R. Jhala, S. Lerner, and H. Shacham, "An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications," in ACM Conference on Computer and Communications Security (CCS), 2010. http://cseweb.ucsd.edu/~d1jang/papers/ccs10.pdf
5. T. Berners-Lee. (1990) WorldWideWeb: Proposal for a HyperText Project. Email message. http://www.w3.org/Proposal.html
6. J. Nielsen, Multimedia and hypertext: the internet and beyond. Academic Press, 1995.
7. J. Ruderman. (2008) JavaScript Security: Same Origin. Mozilla Developer Center article. https://developer.mozilla.org/En/Same-origin-policy-for- JavaScript
8. K. Singh, A. Moshchuk, H. J. Wang, and W. Lee, "On the Incoherencies in Web Browser Access Control Policies," in IEEE Symposium on Security and Privacy (Oakland), 2010. http://research.microsoft.com/en-us/um/people/helenw/ papers/incoherencyAndWebAnalyzer.pdf
9. C. Jackson, A. Bortz, D. Boneh, and J. C. Mitchell, "Protecting Browser State from Web Privacy Attacks," in International World Wide Web Conference (WWW), 2006. http://crypto.stanford.edu/sameorigin/sameorigin.pdf
10. N. Kennedy. (2008) Sniff browser history for improved user experience. Blog entry. http://www.niallkennedy.com/blog/2008/02/browser-history-sniff.html
11. M. Jakobsson and S. Stamm, "Invasive Browser Sniffing and Countermeasures," in International World Wide Web Conference (WWW), 2006. http://research.sidstamm.com/papers/invasivesniff05.pdf
12. A. Juels, M. Jakobsson, and T. N. Jagatic, "Cache Cookies for Browser Authentication," in IEEE Symposium on Security and Privacy (Oakland), 2006. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.137. 8258&rep=rep1&type=pdf
13. L. Shepard. (2009) Making OpenID more useful: let's detect logged-in state. Blog entry. http://www.sociallipstick.com/?p=167
14. P. Dixon. (2004) Consumer Tips: How to Opt-Out of Cookies That Track You. Web page. http://www.worldprivacyforum.org/cookieoptout.html
15. A. Janc and Ł. Olejnik, "Web Browser History Detection as a Real-World Privacy Threat," in European Symposium on Research in Computer Security (ESORICS), 2010. http://cdsweb.cern.ch/record/1293097/files/LHCb-PROC- 2010-036.pdf
16. G. Wondracek, T. Holz, E. Kirda, and C. Kruegel, "A Practical Attack to De-anonymize Social Network Users," in IEEE Symposium on Security and Privacy (Oakland), 2010. http://www.iseclab.org/papers/sonda-tr.pdf
17. E. Goffman, The Presentation of Self in Everyday Life. Anchor Books, 1959.
18. E. W. Felten, D. Balfanz, D. Dean, and D. S. Wallach, "Web Spoofing: An Internet Con Game," in National Information Systems Security Conference, 1997. http://www.csl.sri.com/users/ddean/papers/spoofing.pdf
19. R. Dhamija, J. D. Tygar, and M. Hearst, "Why phishing works," in SIGCHI Conference on Human Factors in Computing Systems (CHI), 2006. http://www.deas.harvard.edu/~rachna/papers/why-phishing-works.pdf
20. V. Apparao, S. Byrne, M. Champion, S. Isaacs, A. L. Hors, G. Nicol, J. Robie, P. Sharpe, B. Smith, J. Sorensen, R. Sutor, R. Whitmer, and C. Wilson, Document Object Model (DOM) Level 1 Specification, W3C Recommendation, 1998. http://www.w3.org/TR/1998/REC-DOM-Level-1-19981001/
21. V. D. Gligor et al., A Guide to Understanding Covert Channel Analysis of Trusted Systems, ser. NSA/NCSC Rainbow Series. Fort Meade, MD: National Computer Security Center, 1993, no. NCSC-TG-030. http://www.fas.org/irp/nsa/rainbow/ tg030.htm
22. T. Atkins Jr. (2009) Re: [css3-selectors] No way to select preceding sibling element. Mailing list post. http://lists.w3.org/Archives/Public/www- style/2009Jul/0041.html
23. Z. Weinberg. (2010) CSS timing attack on global history still possible with MozAfterPaint. Mozilla bug 600025. https://bugzilla.mozilla.org/show-bug. cgi?id=600025
24. Amazon. (2005) Amazon Mechanical Turk: Artificial Artificial Intelligence. Web site. https://www.mturk.com/
25. L. von Ahn, M. Blum, N. Hopper, and J. Langford, "CAPTCHA: Using Hard AI Problems for Security," in Advances in Cryptology - EUROCRYPT 2003, 2003. http://dx.doi.org/10.1007/3-540-39200-9-18
26. J. Daggett, CSS Fonts Module Level 3, W3C Working Draft, 2009. http://www.w3.org/TR/css3-fonts/
27. J. Schiller. (2010) SVG Support. Web page. http://www.codedread.com/svg- support.php
28. Alexa. Top Sites. Data set. http://www.alexa.com/topsites
29. R. L. Hershman and W. A. Hillix, "Data Processing in Typing: Typing Rate as a Function of Kind of Material and Amount Exposed," Human Factors, vol. 7, pp. 483-492, 1965. http://www.ingentaconnect.com/content/hfes/hf/1965/ 00000007/00000005/art00007
30. H. A. Landsberger, Hawthorne Revisited: Management and the Worker, Its Critics, and Developments in Human Relations in Industry. Ithaca, New York: School of Industrial and Labor Relations, Cornell University, 1958.
31. C. Henry. (2009) CAPTCHAs' Effect on Conversion Rates. Blog entry. http://www.seomoz.org/blog/captchas-affect-on-conversion-rates
32. A. Smith, "Home Broadband 2010," Pew Internet & American Life Project, Report, 2010. http://pewinternet.org/Reports/2010/Home-Broadband- 2010.aspx
33. P. G. Ipeirotis, "Demographics of Mechanical Turk," Center for Digital Economy Research, NYU Stern School of Business, Working paper, 2010. http://hdl.handle.net/2451/29585
34. J. Ross, L. Irani, M. S. Silberman, A. Zaldivar, and B. Tomlinson, "Who are the Crowdworkers? Shifting Demographics in Mechanical Turk," in alt.CHI, 2010. http://www.ics.uci.edu/~jwross/pubs/RossEtAl- WhoAreTheCrowdworkers-altCHI2010.pdf
35. G. Aggarwal, E. Burzstein, D. Boneh, and C. Jackson, "An Analysis of Private Browsing Modes in Modern Browsers," in USENIX Security Symposium, 2010. http://crypto.stanford.edu/~dabo/pubs/papers/privatebrowsing.pdf
36. R. Hansen and J. Grossman. (2008) Clickjacking. Web page. http://www.sectheory.com/clickjacking.htm
37. Adobe. (2008) Flash Player workaround available for " Clickjacking" issue. Security advisory. http://www.adobe.com/support/ security/advisories/apsa08-08.html
38. W. Chisholm, G. Vanderheiden, and I. Jacobs, Web Content Accessibility Guidelines 1.0, W3C Recommendation, 1999. http://www.w3.org/TR/WCAG10/
39. A. Ternovskiy et al. (2009) Chatroulette. Web site. http://www. chatroulette.com/
40. I. Hickson, HTML: The device element, WHATWG Living Standard, 2011. http://www.whatwg.org/specs/web-apps/current-work/multipage/commands. html#devices
41. C. Marrin, WebGL Specification, Khronos Working Draft, 2011. http://www.khronos.org/registry/webgl/specs/latest
42. A. Wolman, G. Voelker, N. Sharma, N. Cardwell, M. Brown, T. Landray, D. Pinnel, A. Karlin, and H. Levy, "Organization-Based Analysis of Web-Object Sharing and Caching," in USENIX Symposium on Internet Technologies and Systems, 1999. http://www.cs.washington.edu/research/networking/websys/pubs/ usits99.ps
43. E. W. Felten and M. A. Schneider, "Timing Attacks on Web Privacy," in ACM Conference on Computer and Communications Security (CCS), 2000. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.32.6864&rep= rep1&type=pdf
44. S. Krishnan and F. Monrose, "DNS prefetching and its privacy implications: when good things go bad," in USENIX Conference on Large-Scale Exploits and Emergent Threats (LEET), 2010. http://www.usenix.org/event/leet10/ tech/full-papers/Krishnan.pdf
45. L. Grangeia, "DNS Cache Snooping, or Snooping the Cache for Fun and Profit," SideStep Segurança Digital, Tech. Rep., 2004. http://www.rootsecure.net/content/downloads/pdf/dns-cache-snooping.pdf
46. T. Theurer. (2007) Performance Research, Part 2: Browser Cache Usage - Exposed! Blog entry. http://www.yuiblog.com/blog/2007/01/04/performance- research-part-2/
47. S. Souders. (2010) Call to improve browser caching. Blog entry. http://www.stevesouders.com/blog/2010/04/26/call-to-improve-browser-caching/
48. K. Brewster. (2008) Patching Privacy Leaks. Blog entry. http://kentbrewster.com/patching-privacy-leaks/
49. ThinkerMade. (2008) How to Tell if a User is Signed in to Facebook and Other Services. Blog entry. http://replay.waybackmachine.org/20081020072934/ http://www.thinkermade.com/blog/2008/07/how-to-tell-if-a-user-is-signed-in-to- facebook-and-other-services/
50. D. M. Kristol and L. Montulli, HTTP State Management Mechanism (RFC 2965), IETF Proposed Standard, 2000. https://datatracker.ietf.org/doc/rfc2965/
51. A. Barth, HTTP State Management Mechanism, IETF Internet-Draft, 2010. https://datatracker.ietf.org/doc/draft-ietf-httpstate-cookie/
52. Adobe. (2006) What are local shared objects? Web page. http://www.adobe.com/products/flashplayer/articles/lso/
53. I. Hickson, Web Storage, W3C Working Draft, 2011. http://www.w3.org/TR/ webstorage/
54. S. Kamkar, Evercookie - Never Forget, 2010. http://samy.pl/evercookie/
55. L. Cranor, M. Langheinrich, M. Marchiori, M. Presler-Marshall, and J. Reagle, The Platform for Privacy Preferences 1.0 Specification, W3C Recommendation, 2002. http://www.w3.org/TR/P3P/
56. P. Leon, L. Cranor, A. McDonald, and R. McGuire, "Token Attempt: The Misrepresentation of Website Privacy Policies through the Misuse of P3P Compact Policy Tokens," in Workshop on Privacy in the Electronic Society, 2010. http://www.cylab.cmu.edu/files/pdfs/tech-reports/CMUCyLab10014.pdf
57. J. R. Mayer, "Any person⋯ a pamphleteer: Internet Anonymity in the Age of Web 2.0," Undergraduate Senior Thesis, Princeton University, 2009. http://stanford.edu/~jmayer/papers/thesis09.pdf
58. P. Eckersley, "How Unique Is Your Browser?" in Privacy Enhancing Technologies Symposium (PETS), 2010. http://www.defcon.org/images/ defcon-18/dc-18-presentations/Eckersley/DEFCON-18-Eckersley-Panopticlick.pdf
59. M. Perry and S. Squires. (2007) Torbutton. Software. https://www. torproject.org/torbutton/
60. W. Palant et al. (2006) Adblock Plus. Software. http://adblockplus.org/
61. J. Mayer and A. Narayanan. (2010) Do Not Track: Universal Web Tracking Opt-Out. Web site. http://donottrack.us/
62. R. O'Callahan. (2011) Distinguishing "Embeddable" Versus "Readable" Web Resources Considered Harmful. Blog entry. http://weblogs.mozillazine.org/roc/archives/2011/02/distinguishing.html
63. A. van Kesteren. (2011) Breaking Web Platform Consistency Considered Harmful. Blog entry. http://annevankesteren.nl/2011/02/web-platform-consistency
64. R Development Core Team, R: A Language and Environment for Statistical Computing, R Foundation for Statistical Computing, Vienna, Austria, 2010. http://www.r-project.org
65. H. Wickham, ggplot2: elegant graphics for data analysis. Springer New York, 2009. http://had.co.nz/ggplot2/book