Mariano Di Martino
ABSTRACT
In webpage fingerprinting (WPF), an adversary attempts to identify webpages in encrypted network traffic. Identifying social media webpages however is a challenging task, due to the similarity and dynamic nature of such pages. Existing webpage fingerprinting attacks often have unrealistic assumptions regarding the capability of government agencies or knowledge of the criminal's environment, which renders these attacks ineffective when applied to social media platforms. In this paper, we unravel the current concerns in state of the art WPF attacks in a social network context for forensic analysis. To resolve the issues presented, we propose an enhanced version of the WPF attack 'IUPTIS' and introduce an intelligent observer that significantly improves upon previous works. Furthermore, our improvements are compared to related WPF attacks by conducting extensive experiments on two social platforms: Twitter and Instagram. Our examination shows that the improved IUPTIS attack defeats previous works in terms of realistic obstacles such as HTTP/2, caching and performance costs, thus making it feasible to identify social media webpages with minimal resources.
- Giuseppe Aceto and Antonio Pescapé. 2015. Internet censorship detection: A survey. Computer Networks 83 (2015), 381--421. Google Scholar
Digital Library
- Khaled Al-Naami, Swarup Chandra, Ahmad Mustafa, Latifur Khan, Zhiqiang Lin, Kevin Hamlen, and Bhavani Thuraisingham. 2016. Adaptive Encrypted Traffic Fingerprinting with Bi-directional Dependence. In Proceedings of the 32Nd Annual Conference on Computer Security Applications (ACSAC '16). ACM, New York, NY, USA, 177--188. Google ScholarDigital Library
- M. Belshe, R. Peon, and M. Thomson. 2015. Hypertext Transfer Protocol Version 2 (HTTP/2). RFC 7540. RFC Editor. http://www.rfc-editor.org/rfc/rfc7540.txt.Google Scholar
- Sanjit Bhat, David Lu, Albert Kwon, and Srinivas Devadas. 2018. Var-CNN and DynaFlow: Improved Attacks and Defenses for Website Fingerprinting. (02 2018).Google Scholar
- Tom Brant. {n. d.}. Government Requests for Facebook Data Still Rising. ({n. d.}). https://www.entrepreneur.com/article/293550, Last accessed on May 6th 2019.Google Scholar
- Xiang Cai, Rishab Nithyanand, and Rob Johnson. 2014. CS-BuFLO: A Congestion Sensitive Website Fingerprinting Defense. In Proceedings of the 13th Workshop on Privacy in the Electronic Society (WPES '14). ACM, New York, NY, USA, 121--130. Google ScholarDigital Library
- Xiang Cai, Xin Cheng Zhang, Brijesh Joshi, and Rob Johnson. 2012. Touching from a Distance: Website Fingerprinting Attacks and Defenses. In Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS '12). ACM, New York, NY, USA, 605--616. Google ScholarDigital Library
- Heyning Cheng and Ron Avnur. 2000. Traffic Analysis of SSL Encrypted Web Browsing. (11 2000).Google Scholar
- Giovanni Cherubin, Jamie Hayes, and Marc Juarez. 2017. Website Fingerprinting Defenses at the Application Layer. Proceedings on Privacy Enhancing Technologies 2017, 2 (2017), 186--203.Google ScholarCross Ref
- George Danezis. {n. d.}. Traffic Analysis of the HTTP protocol over TLS.Google Scholar
- Alexis Deveria. {n. d.}. Can I Use. ({n. d.}). https://caniuse.com/#search=http2, Last accessed on December 18th 2018.Google Scholar
- K.P. Dyer, S.E. Coull, T Ristenpart, and T Shrimpton. 2012. Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail. Proceedings of the 2012 IEEE Symposium on Security and Privacy (01 2012), 332--346. Google ScholarDigital Library
- Jenks George. 1967. The Data Model Concept in Statistical Mapping. International Yearbook of Cartography 7 (1967).Google Scholar
- Jamie Hayes and George Danezis. 2016. K-fingerprinting: A Robust Scalable Website Fingerprinting Technique. In Proceedings of the 25th USENIX Conference on Security Symposium (SEC'16). USENIX Association, Berkeley, CA, USA, 1187--1203. http://dl.acm.org/citation.cfm?id=3241094.3241186 Google ScholarDigital Library
- Dominik Herrmann, Rolf Wendolsky, and Hannes Federrath. 2009. Website Fingerprinting: Attacking Popular Privacy Enhancing Technologies with the Multinomial NaïVe-bayes Classifier. In Proceedings of the 2009 ACM Workshop on Cloud Computing Security (CCSW '09). ACM, New York, NY, USA, 31--42. Google ScholarDigital Library
- Mohsen Imani, Mohammad Saidur Rahman, and Matthew Wright. 2018. Adversarial Traces for Website Fingerprinting Defense. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS '18). ACM, New York, NY, USA, 2225--2227. Google ScholarDigital Library
- Marc Juarez, Sadia Afroz, Gunes Acar, Claudia Diaz, and Rachel Greenstadt. 2014. A Critical Evaluation of Website Fingerprinting Attacks. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (CCS '14). ACM, New York, NY, USA, 263--274. Google ScholarDigital Library
- Marc Juarez, Mohsen Imani, Mike Perry, Claudia Diaz, and Matthew Wright. 2016. Toward an Efficient Website Fingerprinting Defense. In ESORICS, Vol. 9878. 27--46.Google Scholar
- Arash Molavi Kakhki, Fangfan Li, David Choffnes, Ethan Katz-Bassett, and Alan Mislove. 2016. BingeOn Under the Microscope: Understanding T-Mobiles Zero-Rating Implementation. In Proceedings of the 2016 Workshop on QoE-based Analysis and Management of Data Communication Networks (Internet-QoE '16). ACM, New York, NY, USA, 43--48. https://doi.org/2940136.2940140 Google ScholarCross Ref
- Marc Liberatore and Brian Neil Levine. 2006. Inferring the Source of Encrypted HTTP Connections. In Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS '06). ACM, New York, NY, USA, 255--263. Google ScholarDigital Library
- Liming Lu, Ee-Chien Chang, and Mun Choon Chan. 2010. Website Fingerprinting and Identification Using Ordered Feature Sequences. In Computer Security -- ESORICS 2010, Dimitris Gritzalis, Bart Preneel, and Marianthi Theoharidou (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 199--214. Google ScholarDigital Library
- Xiapu Luo, Peng Zhou, Edmond W. W. Chan, Wenke Lee, Rocky K. C. Chang, and Roberto Perdisci. 2011. HTTPOS: Sealing information leaks with browserside obfuscation of encrypted flows. In In Proc. Network and Distributed Systems Symposium (NDSS). The Internet Society.Google Scholar
- Mariano Di Martino, Pieter Robyns, Peter Quax, and Wim Lamotte. 2018. IUPTIS: A Practical, Cache-resistant Fingerprinting Technique for Dynamic Webpages. In Proceedings of the 14th International Conference on Web Information Systems and Technologies - Volume 1: WEBIST. INSTICC, SciTePress, 102--112.Google ScholarCross Ref
- Briant Merchant. 2015. Your Porn is Watching You. (2015). https://motherboard.vice.com/en_us/article/539485/your-porn-is-watching-you, Last accessed on December 22th 2018.Google Scholar
- Brad Miller, Ling Huang, A. D. Joseph, and J. D. Tygar. 2014. I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis. In Privacy Enhancing Technologies, Emiliano De Cristofaro and Steven J. Murdoch (Eds.). Springer International Publishing, Cham, 143--163.Google Scholar
- Ricardo Morla. 2017. Effect of Pipelining and Multiplexing in Estimating HTTP/2.0 Web Object Size. (2017). https://arxiv.org/abs/1707.00641.Google Scholar
- Mark Nottingham. 2017. The State of Browser Caching, Revisited. (03 2017). https://www.mnot.net/blog/2017/03/16/browser-caching, Last accessed on December 18th 2018.Google Scholar
- CSO Online. 2018. Mobile carriers sell users' personal information to third parties. (2018). https://www.csoonline.com/article/3233211/security/mobile-carriers-sell-users-personal-information-to-third-parties.html, Last accessed on December 22th 2018.Google Scholar
- Andriy Panchenko, Fabian Lanze, Jan Pennekamp, Thomas Engel, Andreas Zinnen, Martin Henze, and Klaus Wehrle. 2016. Website Fingerprinting at Internet Scale. In 23rd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, California, USA, February 21-24, 2016.Google ScholarCross Ref
- Andriy Panchenko, Lukas Niessen, Andreas Zinnen, and Thomas Engel. 2011. Website fingerprinting in onion routing based anonymization networks. In Proceedings of the 10th annual ACM workshop on Privacy in the electronic society, WPES 2011, Chicago, IL, USA, October 17, 2011. 103--114. Google ScholarDigital Library
- Kevin Peachey. 2018. Why banks will share your financial secrets. (2018). https://www.bbc.com/news/business-42253051, Last accessed on December 22th 2018.Google Scholar
- Alfredo Pironti, Pierre-Yves Strub, and Karthikeyan Bhargavan. 2012. Identifying website users by TLS traffic analysis: New attacks and effective countermeasures. Ph.D. Dissertation. INRIA.Google Scholar
- The Tor Project. 2013. A Critique of Website Traffic Fingerprinting Attacks. (2013). https://blog.torproject.org/critique-website-traffic-fingerprinting-attacks.Google Scholar
- The Tor Project. 2015. Audit HTTP/2 and SPDY if needed. (2015). https://trac.torproject.org/projects/tor/ticket/14952.Google Scholar
- The Tor Project. 2018. The Design and Implementation of the Tor Browser. (2018). https://www.torproject.org/projects/torbrowser/design/.Google Scholar
- Vera Rimmer, Davy Preuveneers, Marc Juarez, Tom Van Goethem, and Wouter Joosen. 2018. Automated Website Fingerprinting through Deep Learning. In NDSS.Google Scholar
- Roberto Gonzalez Sanchez, Claudio Soriente, and Nikolaos Laoutaris. 2017. Method for performing user profiling from encrypted network traffic flows. US Patent App. 15/486,318.Google Scholar
- Payap Sirinam, Mohsen Imani, Marc Juarez, and Matthew Wright. 2018. Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS '18). ACM, New York, NY, USA, 1928--1943. Google ScholarDigital Library
- We Are Social. 2018. Global Digital Report 2018. (2018). https://wearesocial.com/uk/blog/2018/01/global-digital-report-2018.Google Scholar
- Social WIFI Sp. {n. d.}. Social Wifi. ({n. d.}). https://socialwifi.com/, Last accessed on December 18th 2018.Google Scholar
- Qixiang Sun, Daniel R. Simon, Yi-Min Wang, Wilf Russell, Venkata N. Padmanabhan, and Lili Qiu. 2002. Statistical Identification of Encrypted Web Browsing Traffic. In Proceedings of the 2002 IEEE Symposium on Security and Privacy (SP '02). IEEE Computer Society, Washington, DC, USA, 19--. http://dl.acm.org/citation.cfm?id=829514.830535. Google ScholarDigital Library
- W3Techs. {n. d.}. Usage of HTTP/2 for websites. ({n. d.}). https://w3techs.com/technologies/details/ce-http2/all/all, Last accessed on January 9th 2019.Google Scholar
- Tao Wang, Xiang Cai, Rishab Nithyanand, Rob Johnson, and Ian Goldberg. 2014. Effective Attacks and Provable Defenses for Website Fingerprinting. In Proceedings of the 23rd USENIX Conference on Security Symposium (SEC'14). USENIX Association, Berkeley, CA, USA, 143--157. Google ScholarDigital Library
- Tao Wang and Ian Goldberg. 2013. Improved Website Fingerprinting on Tor. In Proceedings of the 12th ACM Workshop on Workshop on Privacy in the Electronic Society (WPES '13). ACM, New York, NY, USA, 201--212. Google ScholarDigital Library
- Tao Wang and Ian Goldberg. 2016. On realistically attacking Tor with website fingerprinting. Proceedings on Privacy Enhancing Technologies 2016, 4 (2016), 21--36.Google ScholarCross Ref
- Tao Wang and Ian Goldberg. 2017. Walkie-Talkie: An Efficient Defense Against Passive Website Fingerprinting Attacks. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, 1375--1390. Google ScholarDigital Library
- Junhua Yan and Jasleen Kaur. 2018. Feature Selection for Website Fingerprinting. Proceedings on Privacy Enhancing Technologies 2018, 4 (2018). https://content.sciendo.com/view/journals/popets/2018/4/article-p200.xml.Google ScholarCross Ref
Index Terms
- Realistically Fingerprinting Social Media Webpages in HTTPS Traffic
Recommendations
Uses and gratifications of social networking sites for bridging and bonding social capital
Applying uses and gratifications theory (UGT) and social capital theory, our study examined users of four social networking sites (SNSs) (Facebook, Twitter, Instagram, and Snapchat), and their influence on online bridging and bonding social capital. ...
Social capital, social media, and TV ratings
Motivated by the increasing role of social media in relating to economic outcomes, this paper examines the relationship between social networking sites SNS and television ratings drawing from the social capital theoretical framework of bonding and ...
College students social media use and communication network heterogeneity
This study examined whether and how the usage of social media can influence college students' level of network heterogeneity and how network heterogeneity is associated with levels of bridging/bonding social capital and subjective well-being. In ...
Comments