Exploiting Data-Usage Statistics for Website Fingerprinting Attacks on Android

Raphael Spreitzer, Simone Griesmayr, Thomas Korak, Stefan Mangard

Publikation: Beitrag in Buch/Bericht/KonferenzbandBeitrag in einem Konferenzband

Abstract

The browsing behavior of a user allows to infer personal details, such as health status, political interests, sexual orientation, etc. In order to protect this sensitive information and to cope with possible privacy threats, defense mechanisms like SSH tunnels and anonymity networks (e.g., Tor) have been established. A known shortcoming of these defenses is that website fingerprinting attacks allow to infer a user's browsing behavior based on traffic analysis techniques. However, website fingerprinting typically assumes access to the client's network or to a router near the client, which restricts the applicability of these attacks.

In this work, we show that this rather strong assumption is not required for website fingerprinting attacks. Our client-side attack overcomes several limitations and assumptions of network-based fingerprinting attacks, e.g., network conditions and traffic noise, disabled browser caches, expensive training phases, etc. Thereby, we eliminate assumptions used for academic purposes and present a practical attack that can be implemented easily and deployed on a large scale. Eventually, we show that an unprivileged application can infer the browsing behavior by exploiting the unprotected access to the Android data-usage statistics. More specifically, we are able to infer 97% of 2500 page visits out of a set of 500 monitored pages correctly. Even if the traffic is routed through Tor by using the Orbot proxy in combination with the Orweb browser, we can infer 95% of 500 page visits out of a set of 100 monitored pages correctly. Thus, the READ_HISTORY_BOOKMARKS permission, which is supposed to protect the browsing behavior, does not provide protection.
Originalspracheenglisch
Titel9th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2016), Darmstadt, Germany
Herausgeber (Verlag)Association of Computing Machinery
DOIs
PublikationsstatusVeröffentlicht - 18 Jul 2016
VeranstaltungACM Conference on Security and Privacy in Wireless and Mobile Networks - Darmstadt, Darmstadt, Deutschland
Dauer: 18 Jul 201620 Jul 2016

Konferenz

KonferenzACM Conference on Security and Privacy in Wireless and Mobile Networks
LandDeutschland
OrtDarmstadt
Zeitraum18/07/1620/07/16

Fields of Expertise

  • Information, Communication & Computing

Treatment code (Nähere Zuordnung)

  • Application
  • Theoretical

Fingerprint

Untersuchen Sie die Forschungsthemen von „Exploiting Data-Usage Statistics for Website Fingerprinting Attacks on Android“. Zusammen bilden sie einen einzigartigen Fingerprint.

Dieses zitieren