Building and Deploying a Watchdog Service for E-commerce · 2017. 10. 27. · User A User B...
31
Who is Fiddling with Prices? Building and Deploying a Watchdog Service for E-commerce $heriff_V2 Costas Iordanou Claudio Soriente Michael Sirivianos Nikolaos Laoutaris
Transcript of Building and Deploying a Watchdog Service for E-commerce · 2017. 10. 27. · User A User B...
Who is Fiddling with Prices? Building and Deploying a Watchdog
Service for E-commerce
$heriff_V2 Costas Iordanou Claudio Soriente
Michael Sirivianos Nikolaos Laoutaris
Walkingintoabrickandmortarstoreeveryoneseesthesameprice,beitforfreshvegetableorapairofjeans
2
UserA
UserB
Naviga=ngintoane-commercestorewhatUserAsees…isnotwhatUserBgets.
Evenmoreinteres=ngly,youhavenoeasywayofknowingthatothersseedifferentprices.Thereasonis… 3
Ane-commercestoreislikeStarTrek’sholodeck
eachonecanhaveadifferentworldpaintedaroundhim(+hecannotseeintoneighboringworlds) 4
EnterthePrice$heriff
Afirstsmallsteptowardslookingbehindandthroughthematrix
Afirst-of-its-kindtransparencysoMwarethatallowsonetoseethepricesasseenbyothers
5
WhatdoesSheriffdo?
HowdoesSheriffdoit?
Technicalchallenges
Findings
6
$heriffDemo
7
8
WhatdoesSheriffdo?
HowdoesSheriffdoit?
Technicalchallenges
Findings
9
Howdoes$heriffdoit?
Browseradd-on Measurementservers
Coordinatorserver
Databaseserver
Proxyclients
Peerproxybrowsers
Peerbrowserssignals
Components
Frond-endBack-end
Networkofproxies
10
Howdoes$heriffdoit?
Browseradd-on Measurementservers
Coordinatorserver
Databaseserver
Proxyclients
Peerproxybrowsers
1.Requestmeasurementserver
2.Sentrequest
Peerbrowserssignals
3.1RemotePagerequest
4.Storedata
5.Showresults
Servingrequests
11
Whyis$heriffinteres=ng?Hadtosolvesomedifficulttechnicalchallenges:
• BuildaP2Pproxynetwork• Preventuserprofilepollu=on(BrowserandServerside)• Protectuserprivacy• Performuniversalpriceextrac=on• Automatecurrencydetec=on
Gatheredlotsofinteres=ngmeasurements:• Morethan2000e-commercesites,• Includingthetop400accordingtoAlexa• Morethan6000products• Morethan1500realusersin55countries• Morethan0.7millionmeasurementpoints
12
WhatdoesSheriffdo?
HowdoesSheriffdoit?
Technicalchallenges
Findings
13
Measurementservers
Proxyclients
Peerproxybrowsers
3.1RemotePagerequest
3.2RemotePagerequest
Whyhybridnetworkofproxies?Infrastructureproxyclients+Diversepredefinedgeo-loca=ons+Easytosetupandcontrol+Norealusersinvolved
- Nopricevaria=onbasedonpersonaldatacanbeobserved
Peerproxybrowsers+Diverserealuserprofiles+Pricevaria=onsbasedonpersonaldata
-Unpredictableavailabilityandgeo-loca=on-Browsersideprofilepollu=on-Serversideprofilepollu=on
14
User1,France
France User1
User2,Germany
Germany User2
User3,Italy
Italy User3
User4,USA
USA User4
Peerproxybrowsers
Unpredictableavailabilityandgeo-loca=on
Coordinatorserver
User5,Italy
,User5
Customcommunica=onprotocoloverWebRTCdatachannel
X
Howwesolvedit…
…
.
.
.UserN,CountryN
CountryN UserN
User6,France
,User6
15
Browser-sideprofilepollu=on
Incomingremotepagerequest
to“e-shop.com/product_A”Measurementservers Peerproxy
browser
Howwesolvedit…
Problem(alteredstate) ChromeAPIsoluOon
Browsinghistory chrome.historyàremovetheentry
Browsercachedmemory chrome.browsingDataàcleancache
Cookies-responseheader chrome.webRequestàremovecookie
Dynamiccookies-JavaScript chrome.cookiesàdeleteinsertedcookies
BrowserextensionAPIs:hips://developer.chrome.com/extensions/api_index
Whendoesithappen?
every=mewesendaremoterequest
16
Iftheuserhasnevervisitedthedomain,wedeletethefollowing
Server-sideprofilepollu=onHowdoesithappen?
=1stpartycookies
Peerproxybrowser
1stpartyserver
Measurementserver
a.com/productX
b.com/productY
c.com/productZ
17
3rdparty13rdparty2
3rdparty33rdpartyN
=3rdpartycookies
Server-sideprofilepollu=onWhendoesithappen?
=1stpartycookies
Peerproxybrowser
1stpartyserver
Measurementserver
a.com/productX
b.com/productY
c.com/productZ
18
incaseswhentheuseralreadyvisitedadomain
3rdparty13rdparty2
3rdparty33rdpartyN
=3rdpartycookies
a.com
Server-sideprofilepollu=onWhendoesithappen?
Remotepagerequeststoe-storedomainsa,bandcpollutetheuserprofileatthe1stand3rdpartydomainserversrespec=vely.
=1stpartycookies
Peerproxybrowser
1stpartyserver
Measurementserver
a.com/productX
b.com/productY
c.com/productZ
19
incaseswhentheuseralreadyvisitedadomain
3rdparty13rdparty2
3rdparty33rdpartyN
=3rdpartycookies
b.com
c.com
Howwesolvedit…using“doppelgänger”profiles
Doppelgänger“aniden.calcopyofsomeone”,aghostinthegermanfolklore.
20
Server-sideprofilepollu=on
Howdowecreateadoppelgänger?
21
Server-sideprofilepollu=on
EncryptedDomainvectors
a.com:10b.com:9c.com:6…
sd4a5l6kj9dlkjsau9w7p4e6r7u0wMn4bvm4bmlvb…
a.com:8b.com:7c.com:5…
Peerproxybrowsers AggregatorServer
Encryptedk-Means
CoordinatorServer
Distances
NewCentroids
Howdowecreateadoppelgänger?
22
Server-sideprofilepollu=on
EncryptedDomainvectors
a.com:10b.com:9c.com:6…
sd4a5l6kj9dlkjsau9w7p4e6r7u0wMn4bvm4bmlvb…
a.com:8b.com:7c.com:5…
Encryptedk-Means
Use
Peerproxybrowsers AggregatorServer CoordinatorServer
…
Crawling
domain:a.comuserID:985631domain:b.comuserID:654852domain:c.comuserID:851236
DoppelgangersServer
Store
CoordinatorServer
Howdowecreateadoppelgänger?
23
Server-sideprofilepollu=on
EncryptedDomainvectors
a.com:10b.com:9c.com:6…
sd4a5l6kj9dlkjsau9w7p4e6r7u0wMn4bvm4bmlvb…
a.com:8b.com:7c.com:5…
Encryptedk-Mean
…
Use
Peerproxybrowsers AggregatorServer CoordinatorServer
Crawling
domain:a.comuserID:985631domain:b.comuserID:654852domain:c.comuserID:851236
DoppelgangersServer
Store
CoordinatorServer
Byreplacingtheoriginalcookiesofauserwiththoseofadoppelganger…
remotepagerequestswillpollutethe
doppelgangerprofile.
WhatdoesSheriffdo?
HowdoesSheriffdoit?
Technicalchallenges
Findings
24
Pricevaria=ons
Threetypesofresults:
Differentgeo-loca=on
Samegeo-loca=on
Temporalmonitoring
25
FindingsSummary
1. Pricevaria=onacrosscountries• 76domainsoutof1994• pricevaria=onupto600%
2. Pricevaria=onwithinthesamecountry• 7outof76domains(3repeatable)• pricevaria=onupto7%
3. Nopricediscrimina=onbasedonpersonaldatadetectedyet
26
PricesvarydependingonthecountrySystema=ccrawlingdataset
27
30%
Pricesalsovarywithinthesamecountry
28
Inthepaper
SandboxingDoppelgangerPrivacypreservingk-meansExtendedresultsImplementa=ondetails
29
1. $heriffisafirst-of-its-kindtransparencysoMware
2. Wecommunicatethechallengesinvolvedinthedevelopmentofsuchsystem
3. Ourarchitectureandimplementa=onchoicescanhelpothersbuildsimilarservices
Maintakeaways
30
$heriff_V2
email:[email protected]:hip://www.=d.es/research/researchers/costas-iordanou
hip://sheriff-v2.dynu.net
Availablefor:
31
