Blocklist Babel: On the Transparency and Dynamics of Open Source Blocklisting

Feal, Álvaro; Vallina, Pelayo; Gamba, Julien; Pastrana, Sergio; Nappa, Antonio; Hohlfeld, Oliver; Vallina-Rodriguez, Narseo; Tapiador, Juan E.

doi:10.1109/tnsm.2021.3075552

Cited by 11 publications

(5 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We find that 376 browsers (89%) permit at least one request that should be blocked based on these lists. One possible explanation for this behavior is that browsers use different blocklists, unblock lists, or neither-again, consistent with prior work observing variations in blocking behavior [48,132]. Of the remaining 48 browsers, we look at browsers that load a majority of our test pages and make no requests on these lists and see that 17 browsers (4%) fit this criteria, including popular browsers like Firefox and Adblock Browser.…”

Section: Content Modificationsupporting

confidence: 66%

“…While we do not know exactly why these browsers block this content, we speculate that this could be an attempt to mitigate pervasive tracking from webpages. This also highlights the diversity in browsers' blocking behavior, indicating that different browsers use different anti-tracking and blocklist implementations [48,132]. Allowed requests.…”

Section: Content Modificationmentioning

confidence: 91%

See 1 more Smart Citation

Not Your Average App: A Large-scale Privacy Analysis of Android Browsers

Pradeep

Feal

Gamba

et al. 2023

PoPETs

View full text Add to dashboard Cite

The transparency and privacy behavior of mobile browsers has remained widely unexplored by the research community. In fact, as opposed to regular Android apps, mobile browsers may present contradicting privacy behaviors. On the one end, they can have access to (and can expose) a unique combination of sensitive user data, from users’ browsing history to permission-protected personally identifiable information (PII) such as unique identifiers and geolocation. However, on the other end, they also are in a unique position to protect users’ privacy by limiting data sharing with other parties by implementing ad-blocking features. In this paper, we perform a comparative and empirical analysis on how hundreds of Android web browsers protect or expose user data during browsing sessions. To this end, we collect the largest dataset of Android browsers to date, from the Google Play Store and four Chinese app stores. Then, we developed a novel analysis pipeline that combines static and dynamic analysis methods to find a wide range of privacy-enhancing (e.g., ad-blocking) and privacy-harming behaviors (e.g., sending browsing histories to third parties, not validating TLS certificates, and exposing PII---including non-resettable identifiers---to third parties) across browsers. We find that various popular apps on both Google Play and Chinese stores have these privacy-harming behaviors, including apps that claim to be privacy-enhancing in their descriptions. Overall, our study not only provides new insights into important yet overlooked considerations for browsers’ adoption and transparency, but also that automatic app analysis systems (e.g., sandboxes) need context-specific analysis to reveal such privacy behaviors.

show abstract

Section: Content Modificationsupporting

confidence: 66%

Section: Content Modificationmentioning

confidence: 91%

Not Your Average App: A Large-scale Privacy Analysis of Android Browsers

Pradeep

Feal

Gamba

et al. 2023

PoPETs

View full text Add to dashboard Cite

show abstract

“…Limitation on Ground truth It is often challenging to collect a large-scale URL ground truth [18]. Despite our best efforts to cover various types of attacks in ground truth, our dataset may still have some limitation.…”

Section: Discussionmentioning

confidence: 99%

“…Furthermore, the positive counts for malware URLs and phishing URLs should be treated differently, given the higher correlation in phishing URLs. Given a malicious URL, identifying if it is involved in a phishing or a malware attack is quite important in practice as, for example, these two attacks require different mitigation actions and malicious URLs are aggregated to threat specific feeds in practice [18]. As examined in Section 4, VT detailed labels are noisy since the scanners often do not agree on a single attack type label.…”

Section: Lead Lag Analysismentioning

confidence: 99%

“…For example, when a website is infected with malware, an initial remediation action is to check for the file integrity and malicious code injections whereas when a website is compromised with a phishing page, an initial task is to identify pages or folders that are created recently and contain login/payment forms. It is thus crucial to promptly and accurately determine the attack type of a malicious URL to build the corresponding ground truth [18]. The current practice is to rely on either blocklists or heuristics.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Large Scale Study and Classification of VirusTotal Reports on Phishing and Malware URLs

Choo¹,

Nabeel²,

Silva³

et al. 2022

Preprint

View full text Add to dashboard Cite

VirusTotal (VT) provides aggregated threat intelligence on various entities including URLs, IP addresses, and binaries. It is widely used by researchers and practitioners to collect ground truth and evaluate the maliciousness of entities. In this work, we provide a comprehensive analysis of VT URL scanning reports containing the results of 95 scanners for 1.577 Billion URLs over two years. Individual VT scanners are known to be noisy in terms of their detection and attack type classification. To obtain high quality ground truth of URLs and actively take proper actions to mitigate different types of attacks, there are two challenges: (1) how to decide whether a given URL is malicious given noisy reports and (2) how to determine attack types (e.g., phishing or malware hosting) that the URL is involved in, given conflicting attack labels from different scanners. In this work, we provide a systematic comparative study on the behavior of VT scanners for different attack types of URLs. A common practice to decide the maliciousness is to use a cut-off threshold of scanners that report the URL as malicious. However, in this work, we show that using a fixed threshold is suboptimal, due to several reasons: (1) correlations between scanners; (2) lead/lag behavior; (3) the specialty of scanners; (4) the quality and reliability of scanners. A common practice to determine an attack type is to use majority voting. However, we show that majority voting could not accurately classify the attack type of a URL due to the bias from correlated scanners. Instead, we propose a machine learning-based approach to assign an attack type to URLs given the VT reports.

show abstract