CSE 599B: Technology-Enabled Misinformation Franziska (Franzi) - PowerPoint PPT Presentation

CSE 599B: Technology-Enabled Misinformation Franziska (Franzi) Roesner franzi@cs.washington.edu Fall 2018

Third-Party Tracking Trackers included in other sites use third-party cookies containing unique identifiers to create browsing profiles. cookie: id=789 criteo.com user 789: theonion.com, cnn.com, adult-site.com, … cookie: id=789 10/2/2018 Franziska Roesner 2

https://panopticlick.eff.org/ Browser Fingerprinting Techniques Fall 2018 CSE 599B 3

Tracking and Targeted Advertising The Onion Ad Exchange (e.g., Doubleclick) Advertiser Advertiser Advertiser (e.g., Criteo) ConPro 2018 Franziska Roesner 4

Tracking and Targeted Advertising CNN Ad Exchange (e.g., Doubleclick) Advertiser Advertiser Advertiser (e.g., Criteo) ConPro 2018 Franziska Roesner 5

Lerner et al., USENIX Security 2016 The Web of the Past Time travel for web tracking: http://trackingexcavator.cs.washington.edu

Lerner et al., USENIX Security 2016 1996-2016: More & More Tracking More trackers of more types

Lerner et al., USENIX Security 2016 1996-2016: More & More Tracking More trackers of more types, more per site

Lerner et al., USENIX Security 2016 1996-2016: More & More Tracking More trackers of more types, more per site, more coverage

Lecuyer et al., USENIX Security 2014 XRay: Inferring Behavior-Ad Correlations Fall 2018 CSE 599B 10

Fall 2018 CSE 599B 11

Fall 2018 CSE 599B 12

Targeted Advertising Ecosystem The Onion Ad Purchaser Ad Exchange (e.g., Doubleclick) Advertiser Advertiser Advertiser (e.g., Criteo) ConPro 2018 Franziska Roesner 13

Vines et al., WPES 2017 Ad Targeting as an Oracle How old is alice@gmail.com? Target these ads: Email=alice@gmail.com AND Age=18 … Email=alice@gmail.com AND Age=35 Email=alice@gmail.com AND Age=36 … Which one was served? ConPro 2018 Franziska Roesner 14

Vines et al., WPES 2017 Case Study with Mobile Ads Survey of demand-side providers (DSP), chose one for case study Case study threat model: • Target • Uses a mobile app to which the DSP serves ads • Adversary: • Access to DSP ($1000) • Knows target’s Mobile Advertising ID (MAID) • E.g., by sniffing network traffic, target clicked on ad in the past, or via exploit ConPro 2018 Franziska Roesner 15

Vines et al., WPES 2017 Sample Attack #1: Location Tracking Goal: Track user, determine frequently visited or sensitive locations Method: Create grid of location ads • Observe which are served and when • ConPro 2018 Franziska Roesner 16

Vines et al., WPES 2017 Sample Attack #2: Apps of Interest Goal: Identify use of specific apps Sensitive apps: Dating • Torrenting • Health • Religion • ConPro 2018 Franziska Roesner 17

Fall 2018 CSE 599B 18

Fall 2018 CSE 599B 19

Fall 2018 CSE 599B 20

Fall 2018 CSE 599B 21