1,350 research outputs found
PinMe: Tracking a Smartphone User around the World
With the pervasive use of smartphones that sense, collect, and process
valuable information about the environment, ensuring location privacy has
become one of the most important concerns in the modern age. A few recent
research studies discuss the feasibility of processing data gathered by a
smartphone to locate the phone's owner, even when the user does not intend to
share his location information, e.g., when the Global Positioning System (GPS)
is off. Previous research efforts rely on at least one of the two following
fundamental requirements, which significantly limit the ability of the
adversary: (i) the attacker must accurately know either the user's initial
location or the set of routes through which the user travels and/or (ii) the
attacker must measure a set of features, e.g., the device's acceleration, for
potential routes in advance and construct a training dataset. In this paper, we
demonstrate that neither of the above-mentioned requirements is essential for
compromising the user's location privacy. We describe PinMe, a novel
user-location mechanism that exploits non-sensory/sensory data stored on the
smartphone, e.g., the environment's air pressure, along with publicly-available
auxiliary information, e.g., elevation maps, to estimate the user's location
when all location services, e.g., GPS, are turned off.Comment: This is the preprint version: the paper has been published in IEEE
Trans. Multi-Scale Computing Systems, DOI: 0.1109/TMSCS.2017.275146
Web Tracking: Mechanisms, Implications, and Defenses
This articles surveys the existing literature on the methods currently used
by web services to track the user online as well as their purposes,
implications, and possible user's defenses. A significant majority of reviewed
articles and web resources are from years 2012-2014. Privacy seems to be the
Achilles' heel of today's web. Web services make continuous efforts to obtain
as much information as they can about the things we search, the sites we visit,
the people with who we contact, and the products we buy. Tracking is usually
performed for commercial purposes. We present 5 main groups of methods used for
user tracking, which are based on sessions, client storage, client cache,
fingerprinting, or yet other approaches. A special focus is placed on
mechanisms that use web caches, operational caches, and fingerprinting, as they
are usually very rich in terms of using various creative methodologies. We also
show how the users can be identified on the web and associated with their real
names, e-mail addresses, phone numbers, or even street addresses. We show why
tracking is being used and its possible implications for the users (price
discrimination, assessing financial credibility, determining insurance
coverage, government surveillance, and identity theft). For each of the
tracking methods, we present possible defenses. Apart from describing the
methods and tools used for keeping the personal data away from being tracked,
we also present several tools that were used for research purposes - their main
goal is to discover how and by which entity the users are being tracked on
their desktop computers or smartphones, provide this information to the users,
and visualize it in an accessible and easy to follow way. Finally, we present
the currently proposed future approaches to track the user and show that they
can potentially pose significant threats to the users' privacy.Comment: 29 pages, 212 reference
Mitigation of JavaScript-Based Fingerprinting Attacks Reliant on Client Data Generation
While fraud detection companies use fingerprinting methods as a secondary form of identification, attackers can exploit these fingerprinting methods due to the revealing nature of the software and hardware information collected. Attackers can use this sensitive information to target users with known vulnerabilities, monitor a user’s activity, and even reveal their identity without their knowledge or consent. Unfortunately, average users have limited options to opt out of or block fingerprinting attacks.
In this thesis, we propose a solution that enforces dynamic policies on web pages to prevent potential malicious device fingerprinting methods. We employed the Inline Reference Monitor (IRM) approach to supervising JavaScript operations on web pages, including method calls, object creation and access, and property access. When executed, the IRM will intercept these operations, providing runtime policy enforcement to mitigate JavaScript-based dynamic fingerprinting methods that generate unique data at runtime instead of collecting static attributes. In particular, our policy enforces a randomization method rather than normalization or domain- based blocking to constantly change a given device’s fingerprint overtime, making it increasingly difficult for malicious actors to track a device across the web. Our approach can protect user privacy while limiting major site breakage, a common issue with current anti-fingerprinting technologies.
We have performed intensive experiments to demonstrate the effectiveness of our approach. In particular, we replicated and revised an existing fingerprinting attack that collects network link- state information to construct unique fingerprints. We deployed this fingerprinting attack on the cloud and collected data from web users nationwide, which are used by a machine learning model to reveal users’ locations with high accuracy. We have implemented our mitigation method by extending a browser extension prototype. The prototype demonstrated that our proposed method could effectively prevent data collection from the fingerprinting attack
Advancing security information and event management frameworks in managed enterprises using geolocation
Includes bibliographical referencesSecurity Information and Event Management (SIEM) technology supports security threat detection and response through real-time and historical analysis of security events from a range of data sources. Through the retrieval of mass feedback from many components and security systems within a computing environment, SIEMs are able to correlate and analyse events with a view to incident detection. The hypothesis of this study is that existing Security Information and Event Management techniques and solutions can be complemented by location-based information provided by feeder systems. In addition, and associated with the introduction of location information, it is hypothesised that privacy-enforcing procedures on geolocation data in SIEMs and meta- systems alike are necessary and enforceable. The method for the study was to augment a SIEM, established for the collection of events in an enterprise service management environment, with geo-location data. Through introducing the location dimension, it was possible to expand the correlation rules of the SIEM with location attributes and to see how this improved security confidence. An important co-consideration is the effect on privacy, where location information of an individual or system is propagated to a SIEM. With a theoretical consideration of the current privacy directives and regulations (specifically as promulgated in the European Union), privacy supporting techniques are introduced to diminish the accuracy of the location information - while still enabling enhanced security analysis. In the context of a European Union FP7 project relating to next generation SIEMs, the results of this work have been implemented based on systems, data, techniques and resilient features of the MASSIF project. In particular, AlienVault has been used as a platform for augmentation of a SIEM and an event set of several million events, collected over a three month period, have formed the basis for the implementation and experimentation. A "brute-force attack" misuse case scenario was selected to highlight the benefits of geolocation information as an enhancement to SIEM detection (and false-positive prevention). With respect to privacy, a privacy model is introduced for SIEM frameworks. This model utilises existing privacy legislation, that is most stringent in terms of privacy, as a basis. An analysis of the implementation and testing is conducted, focusing equally on data security and privacy, that is, assessing location-based information in enhancing SIEM capability in advanced security detection, and, determining if privacy-enforcing procedures on geolocation in SIEMs and other meta-systems are achievable and enforceable. Opportunities for geolocation enhancing various security techniques are considered, specifically for solving misuse cases identified as existing problems in enterprise environments. In summary, the research shows that additional security confidence and insight can be achieved through the augmentation of SIEM event information with geo-location information. Through the use of spatial cloaking it is also possible to incorporate location information without com- promising individual privacy. Overall the research reveals that there are significant benefits for SIEMs to make use of geo-location in their analysis calculations, and that this can be effectively conducted in ways which are acceptable to privacy considerations when considered against prevailing privacy legislation and guidelines
Temporal and Spatial Classification of Active IPv6 Addresses
There is striking volume of World-Wide Web activity on IPv6 today. In early
2015, one large Content Distribution Network handles 50 billion IPv6 requests
per day from hundreds of millions of IPv6 client addresses; billions of unique
client addresses are observed per month. Address counts, however, obscure the
number of hosts with IPv6 connectivity to the global Internet. There are
numerous address assignment and subnetting options in use; privacy addresses
and dynamic subnet pools significantly inflate the number of active IPv6
addresses. As the IPv6 address space is vast, it is infeasible to
comprehensively probe every possible unicast IPv6 address. Thus, to survey the
characteristics of IPv6 addressing, we perform a year-long passive measurement
study, analyzing the IPv6 addresses gleaned from activity logs for all clients
accessing a global CDN.
The goal of our work is to develop flexible classification and measurement
methods for IPv6, motivated by the fact that its addresses are not merely more
numerous; they are different in kind. We introduce the notion of classifying
addresses and prefixes in two ways: (1) temporally, according to their
instances of activity to discern which addresses can be considered stable; (2)
spatially, according to the density or sparsity of aggregates in which active
addresses reside. We present measurement and classification results numerically
and visually that: provide details on IPv6 address use and structure in global
operation across the past year; establish the efficacy of our classification
methods; and demonstrate that such classification can clarify dimensions of the
Internet that otherwise appear quite blurred by current IPv6 addressing
practices
E-Mail Tracking: Status Quo and Novel Countermeasures
E-mail advertisement, as one instrument in the marketing mix, allows companies to collect fine-grained behavioural data about individual users’ e-mail reading habits realised through sophisticated tracking mechanisms. Such tracking can be harmful for user privacy and security. This problem is especially severe since e-mail tracking techniques gather data without user consent. Striving to increase privacy and security in e-mail communication, the paper makes three contributions. First, a large database of newsletter e-mails is developed. This data facilitates investigating the prevalence of e-mail tracking among 300 global enterprises from Germany, the United Kingdom and the United States. Second, countermeasures are developed for automatically identifying and blocking e-mail tracking mechanisms without impeding the user experience. The approach consists of identifying important tracking descriptors and creating a neural network-based detection model. Last, the effectiveness of the proposed approach is established by means of empirical experimentation. The results suggest a classification accuracy of 99.99%
TimeWeaver: Opportunistic One Way Delay Measurement via NTP
One-way delay (OWD) between end hosts has important implications for Internet
applications, protocols, and measurement-based analyses. We describe a new
approach for identifying OWDs via passive measurement of Network Time Protocol
(NTP) traffic. NTP traffic offers the opportunity to measure OWDs accurately
and continuously from hosts throughout the Internet. Based on detailed examina-
tion of NTP implementations and in-situ behavior, we develop an analysis tool
that we call TimeWeaver, which enables assessment of precision and accuracy of
OWD measurements from NTP. We apply TimeWeaver to a ~1TB corpus of NTP traffic
collected from 19 servers located in the US and report on the characteristics
of hosts and their associated OWDs, which we classify in a precision/accuracy
hierarchy. To demonstrate the utility of these measurements, we apply iterative
hard-threshold singular value decomposition to estimate OWDs between arbitrary
hosts from the high- est tier in the hierarchy. We show that this approach
results in highly accurate estimates of OWDs, with average error rates on the
order of less than 2%. Finally, we outline a number of applications---in
particular, IP geolocation, network operations and management---for hosts in
lower tiers of the precision hierarchy that can benefit from TimeWeaver,
offering directions for future work.Comment: 14 page
Exploring HTTP Header Manipulation in the Wild
Headers are a critical part of HTTP. It has been shown that they are increasingly subject to middlebox manipulation. Although this is well known, little is understood about the general regional and network trends that underpin these manipulations. In this paper, we collect data on thousands of networks to understand how they intercept HTTP headers in-the-wild. Our analysis reveals that 25% of measured ASes modify HTTP headers. Beyond this, we witness distinct trends amongst different regions and AS types; for example, we observe high numbers of cache headers in poorly connected regions. Finally, we perform an in-depth analysis of types of manipulations to characterise how they differ across continents
- …