Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis...
Transcript of Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis...
![Page 1: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/1.jpg)
Online TrackingA 1-million-site Measurement and Analysis
Steven Englehardt@s_englehardt
Arvind Narayanan@random_walker
This research was supported by NSF award CNS 1526353, a grant from the Data Transparency Lab, and an Amazon AWS Credits Research Grant.
1
![Page 2: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/2.jpg)
Visiting 2 websites results in 84 third parties contacted
2
![Page 3: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/3.jpg)
Visiting 2 websites results in 84 third parties contacted
3
Proliferation of tracking in the absence of transparency
![Page 4: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/4.jpg)
Proliferation of tracking in the absence of transparency
...but measurement can fix that
Visiting 2 websites results in 84 third parties contacted
4
![Page 5: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/5.jpg)
Measurement forces companies to fix problems
May 2012
Canvas FingerprintingIntroduced
Mowery and Shacham (W2SP 2012)
5
![Page 6: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/6.jpg)
Mowery and Shacham (W2SP 2012)
May 2012
Canvas FingerprintingIntroduced
Measurement forces companies to fix problems
Canvas fingerprinting adoptedover 2 years
6
![Page 7: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/7.jpg)
Mowery and Shacham (W2SP 2012)
May 2012
Measurement Results
Released
Canvas FingerprintingIntroduced
July 21st 2014
NewsCoverage
The Web Never Forgets: Persistent Tracking Mechanisms in the Wild (CCS 2014)
Measurement forces companies to fix problems
Canvas fingerprinting adoptedover 2 years
7
![Page 8: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/8.jpg)
Mowery and Shacham (W2SP 2012)
May 2012
Measurement Results
Released
Canvas FingerprintingIntroduced
July 21st 2014
NewsCoverage
The Web Never Forgets: Persistent Tracking Mechanisms in the Wild (CCS 2014)
Measurement forces companies to fix problems
Canvas fingerprinting adoptedover 2 years
LargestFingerprintersStopped
July 23rd 2014
8
![Page 9: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/9.jpg)
Measurement is effective because most actors are not malicious
1. Bulk of trackers respond to pressure from publishers, users, and regulators
2. Few instances of trying to avoid detection
3. High risk for malicious actions
9
![Page 10: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/10.jpg)
Google settlement for subverting cookie blocking
10
![Page 11: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/11.jpg)
Flash Cookies and Privacy (2009) Soltani, et al.Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning (2011) Ayenson, et al.
Multiple settlements for subverting cookie clearing
11
![Page 12: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/12.jpg)
Automated, large-scale measurement returns control to users and publishers
12
![Page 13: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/13.jpg)
1. Our measurement platform
2. Insights from our 1-million-site measurement
3. Next steps
13
![Page 14: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/14.jpg)
14
![Page 15: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/15.jpg)
A need for a common platform
● Re-engineering of similar measurement tools● Methodological differences between platforms
○ PhantomJS vs Firefox vs Chrome● High cost to reproduce or re-measure
○ Studies are only run once● Can build upon other open measurement tools
15
FourthParty -- Third-party web tracking: Policy and technology -- Mayer et al. 2012
FPDetective -- FPDetective: dusting the web for fingerprinters -- Acar et al. 2013
Chameleon -- https://github.com/ghostwords/chameleon
![Page 16: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/16.jpg)
https://github.com/citp/OpenWPM
Our Web Privacy Measurement (WPM) Platform
16
![Page 17: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/17.jpg)
Study using OpenWPM Conf. Year
The Web Never Forgets: Persistent Tracking Mechanisms in the Wild
CCS 2014
Cognitive disconnect:Understanding Facebook Connect login permissions
OSN 2014
Cookies that give you away: The surveillance implications of web tracking
WWW 2015
Upgrading HTTPS in midair: HSTS and key pinning in practice NDSS 2015
Web Privacy Census Tech Science 2015
Variations in Tracking in Relation to Geographic Location W2SP 2015
No Honor Among Thieves: A Large-Scale Analysis of Malicious Web Shells
WWW 2016
Online Tracking: A 1-million-site Measurement and Analysis CCS 2016
Dial One for Scam: Analyzing and Detecting Technical Support Scams
[Working Paper] 2016
17
![Page 18: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/18.jpg)
Study using OpenWPM Conf. Year
The Web Never Forgets: Persistent Tracking Mechanisms in the Wild
CCS 2014
Cognitive disconnect:Understanding Facebook Connect login permissions
OSN 2014
Cookies that give you away: The surveillance implications of web tracking
WWW 2015
Upgrading HTTPS in midair: HSTS and key pinning in practice NDSS 2015
Web Privacy Census Tech Science 2015
Variations in Tracking in Relation to Geographic Location W2SP 2015
No Honor Among Thieves: A Large-Scale Analysis of Malicious Web Shells
WWW 2016
Online Tracking: A 1-million-site Measurement and Analysis CCS 2016
Dial One for Scam: Analyzing and Detecting Technical Support Scams
[Working Paper] 2016
18
![Page 19: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/19.jpg)
1. Our measurement platform
2. Insights from our 1-million-site measurement
3. Next steps
19
![Page 20: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/20.jpg)
Insights from our 1-million-site measurement
1. There is a long but thin talk of tracker presence on the top sites.
2. Develop a metric to rank tracker popularity.
3. Show that third-parties (and trackers) impede HTTPS adoption and cause mixed content warnings
4. Evaluate differences in tracking across categories (e.g. news sites >>> adult)
5. Examine how common cookie syncing is
6. Measure the use of the HTML Canvas for fingerprinting
7. Measure several HTML5 fingerprinting techniques
8. Examine how well tracking protection detects trackers
20Full Paper: senglehardt.com/papers/ccs16_online_tracking.pdf
![Page 21: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/21.jpg)
Insights from our 1-million-site measurement
1. There is a long but thin talk of tracker presence on the top sites.
2. Develop a metric to rank tracker popularity.
3. Show that third-parties (and trackers) impede HTTPS adoption and cause mixed content warnings
4. Evaluate differences in tracking across categories (e.g. news sites >>> adult)
5. Examine how common cookie syncing is
6. Measure the use of the HTML Canvas for fingerprinting
7. Measure several HTML5 fingerprinting techniques
8. Examine how well tracking protection detects trackers
21Full Paper: senglehardt.com/papers/ccs16_online_tracking.pdf
![Page 22: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/22.jpg)
Almost all top third parties cookie sync
22
![Page 23: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/23.jpg)
45 of top 50 third parties sync cookies (85% chance any two share an ID)
85 of the top 100 (66% chance any two share an ID)
Almost all top third parties cookie sync
23
![Page 24: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/24.jpg)
Several HTML5 Features Used for Fingerprinting
24
![Page 25: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/25.jpg)
Detecting Fingerprinting
25
![Page 26: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/26.jpg)
Detecting Fingerprinting
26
![Page 27: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/27.jpg)
Detecting Fingerprinting
(SCRIPT_URL, “getContext”, “2d”)(SCRIPT_URL, “fillText”, “hello world”, 2, 15)(SCRIPT_URL, “fillStyle”, “#f60”)(SCRIPT_URL, “fillRect”, 125, 1, 62, 20)(SCRIPT_URL, “toDataURL”, “data: …” )
Measurement Logs
27
![Page 28: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/28.jpg)
Detecting Fingerprinting
1. Examine API use for fingerprinting2. Check for tampering / instrumentation inspection
28
(SCRIPT_URL, “getContext”, “2d”)(SCRIPT_URL, “fillText”, “hello world”, 2, 15)(SCRIPT_URL, “fillStyle”, “#f60”)(SCRIPT_URL, “fillRect”, 125, 1, 62, 20)(SCRIPT_URL, “toDataURL”, “data: …” )
Measurement Logs
Post-measurement Analysis
![Page 29: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/29.jpg)
Browser
Canvas Audio WebRTC …
fingerprintingScript.js
fp = Third Party Server
1. Observe a sequence of API calls2. Techniques clustered together3. Results of calls combined and sent to server4. Limited API use beyond that for fingerprinting
Detecting Fingerprinting
29
![Page 30: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/30.jpg)
Abusing WebRTC candidate generation for tracking
Source: http://www.html5rocks.com/en/tutorials/webrtc/basics/
STUNPeer
NAT NAT
PeerSTUN
Relay
30
![Page 31: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/31.jpg)
Without user intervention, a tracking script can:
1. Reveal the user’s real IP address when behind a VPN
2. Reveal the user’s local IP address for each local interface.
WebRTC dataChannel requires no permissions
31
![Page 32: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/32.jpg)
Without user intervention, a tracking script can:
1. Reveal the user’s real IP address when behind a VPN
2. Reveal the user’s local IP address for each local interface.
More identifying for corporate and university users.
WebRTC dataChannel requires no permissions
32
![Page 33: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/33.jpg)
Measuring the use of WebRTC for tracking
Measurement Code:
33
![Page 34: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/34.jpg)
Measuring the use of WebRTC for tracking
Measurement Code:
~90% of unsolicited dataChannel use on homepages is for tracking
57 scripts on 625 sites.34
![Page 35: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/35.jpg)
Using AudioContext for fingerprinting
Used by: cdn-net.com script
35
![Page 36: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/36.jpg)
Using AudioContext for fingerprinting
Used by: cdn-net.com script
Used by: pxi.pub and ad-score.com scripts
36
![Page 37: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/37.jpg)
Using AudioContext for fingerprinting
Live test page: https://audiofingerprint.openwpm.com/37
![Page 38: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/38.jpg)
Implications for Tor Browser271 samples from the Tor Browsers
● 7 distinct fingerprints (2 fingerprints account for 80% of samples)● Overlap with fingerprints from Firefox shows these largely reveal OS of device
38
![Page 39: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/39.jpg)
Using Battery Status to Track
The Leaking Battery, Olejnik et. al. (2015) 39
![Page 40: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/40.jpg)
Using Battery Status to Track
Battery Status:level: 0.11dischargeTime: 12867
The Leaking Battery, Olejnik et. al. (2015) 40
![Page 41: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/41.jpg)
Using Battery Status to Track
Battery Status:level: 0.11dischargeTime: 12867
The Leaking Battery, Olejnik et. al. (2015) 41
![Page 42: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/42.jpg)
Using Battery Status to Track
Battery Status:level: 0.11dischargeTime: 12867
The Leaking Battery, Olejnik et. al. (2015) 42
![Page 43: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/43.jpg)
Using Battery Status to Track
Battery Status:level: 0.11dischargeTime: 12867
The Leaking Battery, Olejnik et. al. (2015)
Battery Status:level: 0.11dischargeTime: 12867
43
![Page 44: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/44.jpg)
Using Battery Status to Track
Battery Status:level: 0.11dischargeTime: 12867
The Leaking Battery, Olejnik et. al. (2015)
Battery Status:level: 0.11dischargeTime: 12867
44
Discovered manually in 2 scripts on about 22 sites
(full measurement is future work)
![Page 45: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/45.jpg)
Do Privacy Tools Help?
45
![Page 46: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/46.jpg)
Privacy tools effectively block stateful tracking
● Third-party cookie blocking○ 32 out of 50,000 sites work around blocking by redirecting the top-level domain○ Average number of third-parties per site reduced from ~18 to ~13
● Ghostery○ Average number of third-parties per site reduced from ~18 to ~3○ Very few third-party cookies are set
46
![Page 47: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/47.jpg)
● Third-party cookie blocking○ 32 out of 50,000 sites work around blocking by redirecting the top-level domain○ Average number of third-parties per site reduced from ~18 to ~13
● Ghostery○ Average number of third-parties per site reduced from ~18 to ~3○ Very few third-party cookies are set
47
Privacy tools effectively block stateful tracking
![Page 48: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/48.jpg)
Crowdsourced lists miss fingerprinters
Technique
EasyList + EasyPrivacy
Percentage of Scripts Percentage of Sites
48
![Page 49: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/49.jpg)
Technique
EasyList + EasyPrivacy
Percentage of Scripts Percentage of Sites
Canvas 25% 88%
Crowdsourced lists miss fingerprinters
49
![Page 50: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/50.jpg)
Technique
EasyList + EasyPrivacy
Percentage of Scripts Percentage of Sites
Canvas
Canvas Font
25%
10%
88%
91%
Crowdsourced lists miss fingerprinters
50
![Page 51: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/51.jpg)
Technique
EasyList + EasyPrivacy
Percentage of Scripts Percentage of Sites
Canvas
Canvas Font
WebRTC
25%
10%
5%
88%
91%
6%
Crowdsourced lists miss fingerprinters
51
![Page 52: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/52.jpg)
Technique
EasyList + EasyPrivacy
Percentage of Scripts Percentage of Sites
Canvas
Canvas Font
WebRTC
AudioContext
25%
10%
5%
6%
88%
91%
6%
2%
Crowdsourced lists miss fingerprinters
52
![Page 53: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/53.jpg)
1. Our measurement platform
2. Insights from our 1-million-site measurement
3. Next steps
53
![Page 54: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/54.jpg)
Repeated measurements are needed
Use of canvas fingerprinting over time: May 2014: 5% of the top 100k sites
Aug 2014: ~0.1% of the top 100k sites
Jan 2016: 2.6% of the top 100k sites
54
![Page 55: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/55.jpg)
Machine learning to detect fingerprinters
Master’s Thesis: Using Machine Learning for Online Tracking Protection and Ad Blocking by Shivam Agarwal
● Monthly, 1-million-site view of the web
● Benefit from extensive instrumentation of OpenWPM
55
![Page 56: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/56.jpg)
Takeaways
1. Trackers are employing an increasingly diverse set of techniques
2. Measurement heavily influences and controls the adoption of new techniques and tracking norms.
3. Crowdsourced tracking protection misses less popular trackers/techniques
4. Frequent measurement and automated detection provide a path forward
56
![Page 57: Online Tracking - Steven Englehardt · Online Tracking: A 1-million-site Measurement and Analysis CCS 2016 Dial One for Scam: Analyzing and Detecting Technical Support Scams ... Using](https://reader035.fdocuments.us/reader035/viewer/2022081404/5f05fe6b7e708231d415c25b/html5/thumbnails/57.jpg)
Takeaways
1. Trackers are employing an increasingly diverse set of techniques
2. Measurement heavily influences and controls the adoption of new techniques and tracking norms.
3. Crowdsourced tracking protection misses less popular trackers/techniques
4. Frequent measurement and automated detection provide a path forward
57Image Assets from the Noun Project:Database by Creative Stall; programmer by Hadi Davodpour
Email: [email protected] Twitter: @s_englehardt Web: senglehardt.com
Thanks for listening!
Full Paper: senglehardt.com/papers/ccs16_online_tracking.pdf