Meddling Middlemen: Empirical Analysis of the Risks of Data-Saving Mobile Browsers

Abstract

Mobile browsers have become one of the main mediators of our online activities. However, as web pages continue to increase in size and streaming media on-the-go has become commonplace, mobile data plan constraints remain a significant concern for users. As a result, data-saving features can be a differentiating factor when selecting a mobile browser. In this paper, we present a comprehensive exploration of the security and privacy threat that data-saving functionality presents to users. We conduct the first analysis of Android's data-saving browser (DSB) ecosystem across multiple dimensions, including the characteristics of the various browsers' infrastructure, their application and protocol-level behavior, and their effect on users' browsing experience. Our research unequivocally demonstrates that enabling data-saving functionality in major browsers results in significant degradation of the user's security posture by introducing severe vulnerabilities that are not otherwise present in the browser during normal operation. In summary, our experiments show that enabling data savings exposes users to (i) proxy servers running outdated software, (ii) man-in-the-middle attacks due to problematic validation of TLS certificates, (iii) weakened TLS cipher suite selection, (iv) lack of support of security headers like HSTS, and (v) a higher likelihood of being labelled as bots. While the discovered issues can be addressed, we argue that data-saving functionality presents inherent risks in an increasingly-encrypted Web, and users should be alerted of the critical savings-vs-security trade-off that they implicitly accept every time they enable such functionality.

A Framework for Server Authentication using Communication Protocol Dialects

“…In the context confusion attack, the attack occurs because of shared TLS certificates; thereby, the adversary reroutes the request is bypassed to a flawed certificate-sharing server. Use of intermediate entities like malicious proxies [6], [26]- [30] or interception software's [26], [27], a form of MITM attacks, cause the origin confusion issues as the attacker can hijack the secure traffic between the client and server.…”

Awakening the Web's Sleeper Agents: Misusing Service Workers for Privacy Leakage

“…With web apps continuously introducing novel functionality to increase user engagement, browsers deploy new APIs and technologies to support such initiatives. As a result, modern web browsers often integrate new technologies and mechanisms that introduce novel attack vectors with significant security and privacy implications [35], [36], [47], [27]. As such, it is crucial that the security community conducts in-depth investigations of the risks introduced by emerging browser features.…”

Browselite: A Private Data Saving Solution for the Web

“…As a result, emphasis has been placed on changing Web browsing to consume less data [9,11,44,46,51]. While there has been some public confusion over the exact workings and reach of such data-saving methods [33], recent studies of their actual implementations [31,37,54] reveal a few key shortcomings.…”

“…First and foremost, these solutions impose various privacy concerns to their users when compared to regular Web browsing. Some are deployed as middlebox services which either transparently proxy the user's unencrypted traffic [11,51], or, apply URL redirection [23] or Man-in-the-Middle proxies [44,46,58] to also operate on encrypted traffic (HTTPS) [37,54]. Given the rise of HTTPS [28], the former sees limited use, while the latter breaks the end-to-end principles of TLS, exposing potentially private or personalized Web contents to third parties [37,54].…”

“…Further, the exact measures these systems take to actually save data are often cryptic [31,33,37,54]. As determining Web-compat issues, or the ability to quantify broken webpages, is an open problem that requires large amount of manual effort [41], it is hard to determine how and when these solutions actually break webpages; though when they do so there is usually public outcry [12].…”