No boundaries: data exfiltration by third parties embedded on web pages

Abstract

We investigate data exfiltration by third-party scripts directly embedded on web pages. Specifically, we study three attacks: misuse of browsers’ internal login managers, social data exfiltration, and whole-DOM exfiltration. Although the possibility of these attacks was well known, we provide the first empirical evidence based on measurements of 300,000 distinct web pages from 50,000 sites. We extend OpenWPM’s instrumentation to detect and precisely attribute these attacks to specific third-party scripts. Our analysis reveals invasive practices such as inserting invisible login forms to trigger autofilling of the saved user credentials, and reading and exfiltrating social network data when the user logs in via Facebook login. Further, we uncovered password, credit card, and health data leaks to third parties due to wholesale collection of the DOM. We discuss the lessons learned from the responses to the initial disclosure of our findings and fixes that were deployed by the websites, browser vendors, third-party libraries and privacy protection tools.

Website Data Transparency in the Browser

“…For the web OpenWPM provided a measurement infrastructure to detect, quantify, and characterize emerging online tracking behaviors, such as browser fingerprinting [27]. OpenWPM was extended to invisible login forms triggering autofilling of saved user credentials, exfiltrating social network data, and other privacy-invasive practices [2]. In addition to OpenWPM, OmniCrawl, a similar infrastructure, was used to find that the third party advertising and tracking ecosystem on mobile browsers is similar to that of desktop browsers [12].…”

“…As a proof of concept we implement our interfaces in a Firefox browser extension, Privacy Pioneer. 2 In addition to pattern-based detection, we use a machine learning model to classify unstructured data, in our case location data, for which the web traffic context plays a significant role. By doing so, we show the potential improvements obtainable from machine learning models while still accounting for the constrained browser environment.…”

“…Both are used interchangeably. 2 Privacy Pioneer is available at https://github.com/privacy-tech-lab/privacy-pioneer.…”

“…We supplement our model with deterministic methods to detect trackers, collection of personal data, and other monetization techniques. ( §3) (2) In a usability study with 100 participants we evaluate the comprehensibility and utility of Privacy Pioneer's privacy interfaces -a privacy popup, privacy history, and watchlist notifications -to help people understand the data collection practices of the sites they visit, including third parties. Overall, 82% of the participants found Privacy Pioneer easy to understand and 90% found it useful indicating the value of privacy interfaces directly integrated in the browser.…”

Privacy Preference Signals: Past, Present and Future

“…Researchers consistently demonstrate privacy eroding techniques deployed in the wild [15][16][17][18][19] motivated by online advertising business models [32]. Personal data is leaked via social networks [33], third-party web scripts [34], apps [35], software development kits [36], and organizational breaches [37]. The scale of tracking motivate re-designing systems to provide privacy guarantees.…”