Analysing and strengthening OpenWPM's reliability

Abstract

Automated browsers are widely used to study the web at scale. Their premise is that they measure what regular browsers would encounter on the web. In practice, deviations due to detection of automation have been found. To what extent automated browsers can be improved to reduce such deviations has so far not been investigated in detail. In this paper, we investigate this for a specific web automation framework: OpenWPM, a popular research framework specifically designed to study web privacy. We analyse (1) detectability of OpenWPM, (2) prevalence of OpenWPM detection, and (3) integrity of OpenWPM's data recording.Our analysis reveals OpenWPM is easily detectable. We measure to what extent fingerprint-based detection is already leveraged against OpenWPM clients on 100,000 sites and observe that it is commonly detected (∼14% of front pages). Moreover, we discover integrated routines in scripts to specifically detect OpenWPM clients. Our investigation of Open-WPM's data recording integrity identifies novel evasion techniques and previously unknown attacks against OpenWPM's instrumentation. We investigate and develop mitigations to address the identified issues. In conclusion, we find that reliability of automation frameworks should not be taken for granted. Identifiability of such frameworks should be studied, and mitigations deployed, to improve reliability.

Tracking the Web Tracking: Methods, Countermeasures, and Future Directions

“…Several studies, including Krumnow and Gossen et al [34,43] have improved OpenWPM's capabilities for crawling sites. However, if a site has a tracking script, it may detect the crawler and hinder its normal detection abilities, particularly for phishing sites.…”

“…Krummov et al [43] analyzed the reliability of OpenWPM and found that scripts detecting the presence of display and wrapper functions can detect Bot Detection on OpenWPM, and at least 16.7% of sites on Tranco Top 100k recognized Selenium and OpenWPM. Vastel et al [67] suggested that crawler detection can use fingerprinting.…”