Invasive Browser Sniffing and Countermeasures Markus Jakobsson & Sid Stamm

The Scenario Grandma goes to evil site Gets sniffed Gets phishing Loses money

Summary Example phishing attacks Context-aware phishing attacks Browser-recon attack Other Solutions Our Solution

Context Aware Attacks Data about targets obtained Used to customize s Yields higher vulnerability rate

Context: Social Networks Mine site for relationships (Alice knows Bob) Spoof from victim’s friend People trust their friends (and that which spoofs them)

Context: Browser-Recon Phisher mines browsers –Browsing history –Cached data Attacker can discover affiliations Easy to pair browser history with address

Context: Cache Recon GET /index.html GET /pics/pic1.jpg GET /pics/pic2.jpg … Pic1.jpg is Not in Cache (pic1.jpg is not cached)

Context: Cache Recon GET /index.html … Pic1.jpg IS in Cache (pic1.jpg is cached)

Context: Cache Recon Phishing page forces 3 sequential loads: –Img1 on phisher’s server –Img2 on site in question (e.g. Bank) –Img3 on phisher’s server Load Time ~ Time(Img3) - Time(Img1) Short load time = cache hit (Felten & Schneider, “Timing Attacks on Web Privacy” 7th ACM Conference in Computer & Communication Security, 2000.)

Context: Cache Recon GET pic1.jpg GET pic2.jpg GET logout.jpg (Felten & Schneider, “Timing Attacks on Web Privacy” 7th ACM Conference in Computer & Communication Security, 2000.)

Context: History Recon Link 1 Link 2 Link 3 a { color: blue; } #id1:visited { color: red; } #id2:visited { color: red; } #id3:visited { color: red; } Link 1 Link 2 Link 3 What You See:The Code:

Context: History Recon Link 1 Link 3 a { color: blue; } #id1:visited { background: url(‘e.com/?id=1’); } #id2:visited { background: url(‘e.com/?id=2’); } … Link 1 Link 2 Link 3 What You See:The Code: Link 2

Context: History Recon a { color: blue; } #id1:visited { background: url(‘e.com/?id=1’); } #id2:visited { background: url(‘e.com/?id=2’); } … What You See:The Code:

History Recon + GET (lots of links) GET GET Phisher can now associate Alice with link 1 and 42 Auto-Fill Identity Extraction

“Chameleon” Attack

Solutions to Browser-recon Client-Side Solutions: –Jackson, Bortz, Boneh Mitchell, “Protecting browser state from web privacy attacks”, To appear in WWW06, –CSS limiting –“User-Paranoia” (regularly clear history, cache, keep no bookmarks) Server-Side Solution: –Make URLs impossible to guess

Solution Goals Requirements 1.Hard to guess any pages or resources served by SP 2.Search engines can still index and search SP

Formal Goal Specification

Solution Techniques Two techniques: 1.Customize URLs with pseudonyms 2.Pollute Client State (fill cache/history with related sites not visited by client) Hiding vs. obfuscating Internal (protected) URLs hidden Entry point (public) URLs obfuscated

Solution to Browser-recon S C GET /

Solution to Browser-recon SBSB C STST GET /?13fc021bGET / T Domain of S

Pseudonyms Establishing a pseudonym Using a pseudonym Pseudonym validity check –Via Cookies –Via HTTP-REFERER –Via Message Authentication Codes

Pseudonyms Robot Policies –Dealing with search engines –Robots.txt “standard” (no problem if cheating) Pollution Policy –Pollute entrance URLs –How to choose pollutants? What about links to offsite data? Bookmarks?

Example Bank.com C GET /page.html?83fa029GET /page.html

Example Go to G Log in Bank.com C hm

Example Go to G Log in Bank.com C hm

Example Go to G Log in Bank.com C hm

Example Go to G Log in Bank.com C hm

Example Go to G Log in Bank.com C T

Client’s Perception

Policies Offsite Redirection Policy Data Replacement Policy Client vs. Robot Distinction

Special Cases Cache pollution reciprocity Shared/Transfer Pseudonyms

Security Argument Perfect privacy of internal pages N-privacy of entrance pages Searchability

Prototype Details Java App simulating an HTTP server Pseudonyms: 64-bit random number –java.security.SecureRandom Experimental Client: –Shell script + CURL SBSB STST

Experimental Results

General Considerations Forwarding user-agent Translate Cookies Optimizations

Invasive Browser Sniffing and Countermeasures Markus Jakobsson & Sid Stamm ?