NeTS-ANET: SSL Misuse, Web Bugs, and Open Redirects: Prevalence, Implications, and Defense

从以用户为中心的角度来看，很少有研究了解强大的web功能对用户的风险。这个项目试图通过研究三类已知的（紧急的）威胁来填补这一空白，通过创建一个框架来理解这一问题：安全套接字层（SSL）的滥用、网络漏洞（一种监视网页用户的技术）和开放重定向（一种将用户转移到另一个网页的技术，可能没有被检测到）。这些都是代价高昂且紧迫的当前威胁；初步研究的结果在USENIX 2008进攻性技术研讨会上发表，并在2008年7月16日的《华盛顿邮报》上发表了一篇文章。该项目设想的三个具体问题代表了用户网络风险的三个主要类别，从而导致以用户为中心的安全框架。广泛的研究活动包括：1。测量：通过主动网络抓取和被动观察相结合，研究量化了这三种威胁的性质和程度，并在此过程中开发了准确识别它们发生的技术。2. 以用户为中心的相关性研究：当多个网站订阅同一网络漏洞托管公司时，该（恶意）公司可以跟踪多个网站的用户行为。这是相关性威胁的一个例子。该项目还研究了对用户安全和隐私的相关威胁。该项目的更广泛影响包括：1。Web上的用户安全和隐私：该项目推进了以用户为中心的Web安全和隐私视图。这是当前迫切的社会需求。该研究小组已经开发了几个用户端工具来帮助防止或至少揭示问题，并将继续开发和发布这些工具到公共领域。2. 对数据的开放访问：在Web上爬行需要大量的资源，而且很少有数据源公开提供这些数据。该组织将其数据提供给研究界。

Very little research exists in understanding the risks to users of powerful web features, as seen from a user-centric point of view. This project seeks to fill this void by creating a framework for this understanding by studying three classes of known (and urgent) threat: misuses of secure socket layer (SSL), web bugs (a technique for spying on the user of web page), and open redirects (a technique for transferring the user to a different web page perhaps without detection). These are costly and urgent current threats; results of preliminary research were presented at the USENIX 2008 Workshop on Offensive Technologies and an article in the Washington Post on July 16, 2008 reported on this paper. The project envisions the three specific problems as representing three major classes of the users' web risks and thus leading to a user-centric security framework. The broad research activities include: 1. Measurement: through a combination of active Web crawling and passive observation, the research is quantifying the nature and extent of the three threats, and in the process developing techniques for accurately identifying their occurrences. 2. User-centric correlation studies: When multiple web sites subscribe to the same web bug hosting company, that (malicious) company can track user behavior across multiple sites. This is one example of a correlation threat. The project also studies the correlated threats to user security and privacy. The broader impacts of the project include:1. User security and privacy on the Web: The project advances a user-centric view of security and privacy on the Web. This is a current and urgent social need. The research group has already developed several user-side tools that help prevent or at least reveal problem, and it will continue to develop and publish these to the public domain. 2. Open access to data: crawling the Web is very resource intensive and few sources make this data publicly available. The group makes its data available to the research community.