Escaping the Confines of Time: Continuous Browser Extension Fingerprinting Through Ephemeral Modifications
Escaping the Confines of Time: Continuous Browser Extension Fingerprinting Through Ephemeral Modifications
复制标题
逃离时间的限制：通过短暂修改进行连续浏览器扩展指纹识别
DOI：
10.1145/3548606.3560576
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Polakis, Jason
中科院分区：
文献类型：
--
作者：
Solomos, Konstantinos;Ilia, Panagiotis;Nikiforakis, Nick;Polakis, Jason
浏览器指纹识别继续在网络上扩散。关键的是，流行的指纹识别库已经开始整合扩展指纹识别功能，从而加剧了它们可能导致的隐私丢失。在本文中，我们提出了连续指纹识别，这是一种新的扩展指纹识别技术，它捕获了扩展功能的一个关键维度，使它们能够避开所有先前基于行为的技术。具体来说，我们发现短暂的修改在扩展生态系统中很普遍，有效地使这些扩展对先前的方法不可见，这些方法仅限于分析捕获单个时刻的快照。因此，我们开发了Chronos，这是一个捕捉扩展生命周期中发生的修改的系统，使它能够识别那些在执行结束时没有留下可见痕迹的短暂修改的扩展。具体来说，我们的系统创建了行为签名，这些行为签名捕获添加到DOM或从DOM中删除的节点，以及对节点属性所做的更改。我们广泛的实验评估强调了先前基于快照的方法的固有局限性，因为Chronos能够识别11,219个独特的扩展，比目前的技术水平增加了66.9%的覆盖率。此外，我们发现我们的系统为94%的扩展捕获了唯一的修改事件（即突变），同时还能够解决97%的跨扩展的签名冲突，这些冲突会影响现有的基于快照的方法。我们的研究更准确地抓住了扩展指纹所带来的隐私威胁的程度，这值得隐私导向的浏览器供应商更多的关注，到目前为止，他们一直专注于部署对抗其他浏览器指纹向量的对策。
Browser fingerprinting continues to proliferate across the web. Critically, popular fingerprinting libraries have started incorporating extension-fingerprinting capabilities, thus exacerbating the privacy loss they can induce. In this paper we propose continuous fingerprinting, a novel extension fingerprinting technique that captures a critical dimension of extensions' functionality that allowed them to elude all prior behavior-based techniques. Specifically, we find that ephemeral modifications are prevalent in the extension ecosystem, effectively rendering such extensions invisible to prior approaches that are confined to analyzing snapshots that capture a single moment in time. Accordingly, we develop Chronos, a system that captures the modifications that occur throughout an extension's life cycle, enabling it to fingerprint extensions that make transient modifications that leave no visible traces at the end of execution. Specifically, our system creates behavioral signatures that capture nodes being added to or removed from the DOM, as well as changes being made to node attributes. Our extensive experimental evaluation highlights the inherent limits of prior snapshot-based approaches, as Chronos is able to identify 11,219 unique extensions, increasing coverage by 66.9% over the state of the art. Additionally, we find that our system captures a unique modification event (i.e., mutation) for 94% of the extensions, while also being able to resolve 97% of the signature collisions across extensions that affect existing snapshot-based approaches. Our study more accurately captures the extent of the privacy threat presented by extension fingerprinting, which warrants more attention by privacy-oriented browser vendors that, up to this point, have focused on deploying countermeasures against other browser fingerprinting vectors.
登录
查看更多内容
人为接触的危险：通过用户操作对浏览器扩展进行指纹识别
DOI：
--
发表时间：
2022
期刊：
USENIX Security Symposium
影响因子：
--
作者：
Solomos, K.;Ilia, P.;Karami, S.;Nikiforakis, N.;Polakis, J.
通讯作者：
Polakis, J.
DOI：
10.1109/sp40001.2021.00017
发表时间：
2020-08
期刊：
2021 IEEE Symposium on Security and Privacy (SP)
影响因子：
--
作者：
Umar Iqbal;Steven Englehardt;Zubair Shafiq
通讯作者：
Umar Iqbal;Steven Englehardt;Zubair Shafiq
通过代码挖掘和机器学习揭开野外网络指纹的面纱
影响因子：
--
作者：
V. Rizzo;S. Traverso;M. Mellia
通讯作者：
M. Mellia
Fp-Scanner：浏览器指纹不一致的隐私影响
DOI：
--
发表时间：
2018
期刊：
USENIX Security Symposium
影响因子：
--
作者：
Antoine Vastel;Pierre Laperdrix;Walter Rudametkin;Romain Rouvoy
通讯作者：
Romain Rouvoy
不必要的可识别：量化由于膨胀而导致的浏览器扩展的指纹识别能力
DOI：
--
发表时间：
2019
期刊：
Proceedings of the Web Conference (WWW
影响因子：
--
作者：
Starov, Oleksii;Laperdrix, Pierre;Kapravelos, Alexandros;Nikiforakis, Nick
通讯作者：
Nikiforakis, Nick