web security
play

Web Security [Privacy] Spring 2020 Earlence Fernandes - PowerPoint PPT Presentation

Jun 24, 2023 •511 likes •839 views

CS 642: Computer Security and Privacy Web Security [Privacy] Spring 2020 Earlence Fernandes earlence@cs.wisc.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John Manferdelli, John Mitchell, Franzi Roesner,

  1. CS 642: Computer Security and Privacy Web Security [Privacy] Spring 2020 Earlence Fernandes earlence@cs.wisc.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John Manferdelli, John Mitchell, Franzi Roesner, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials ...

  2. Ads That Follow You Advertisers (and others) track your browsing behaviors for the purposes of targeted ads, website analytics, and personalized content.

  3. Third-Party Web Tracking Browsing profile ile for or use ser 12 123: 3: cnn.com theonion.com political-site.com These ads allow crit riteo.c .com to link your visits between sites, even if you never click on the ads.

  4. Concerns About Privacy

  5. Outline 1. Understanding web tracking 2. Measuring web tracking 3. Defenses

  6. Recall: First and Third Parties • First-party cookie: belongs to top-level domain. • Third-party cookie: belongs to domain of embedded content (such as image, iframe). www.bar.com’s Bar’s Server st part (1 st coo ookie (1 party) www.bar.com www.foo.com’s www.foo.com Foo’s Server rd part coo ookie (3 (3 rd party)

  7. Anonymous Tracking Trackers included in other sites use third-party cookies containing unique identifiers to create browsing profiles. cookie: id=789 cr criteo.com use user 789 789: theonion.com, cnn.com, political- site.com, … cookie: id=789

  8. Basic Tracking Mechanisms • Tracking requires: (1) re-identifying a user. (2) communicating id + visited site back to tracker.

  9. Tracking Technologies • HTTP Cookies • Flash cookies • HTTP Auth • Silverlight storage • HTTP Etags • TLS session ID & resume • Content cache • Browsing history • IE userData • window.name • HTML5 protocol and • HTTP STS content handlers • DNS cache • HTML5 storage • “Zombie” cookies that respawn (http://samy.pl/evercookie)

  10. Fingerprinting Web Browsers • User agent • Installed fonts • HTTP ACCEPT headers • Cookies enabled? • Browser plug-ins • Browser add-ons • MIME support • Screen resolution • Clock skew • HTML5 canvas (differences in graphics SW/HW!)

  11. Your browser fingerprint appears to be unique among the 3,435,834 tested so far

  12. History Sniffing How can a webpage figure out which sites you visited previously? • Color of links – CSS :visited property – getComputedStyle() • Cached Web content timing • DNS timing

  13. Other Trackers? “Personal” Trackers

  14. Personal Tracking cookie: id=earlence cookie: id=earlence face acebook.com use user fr franzi. i.roesner: : theonion.com, cnn.com, political- site.com, … cookie: id=earlence • Tracking is not anonymous (linked to accounts). • Users directly visit tracker’s site → evades some defenses.

  15. Outline 1. Understanding web tracking 2. Measuring web tracking 3. Defenses

  16. [NSDI ‘12] Measurement Study • Questions: – How prevalent is tracking (of different types)? – How much of a user’s browsing history is captured? – How effective are defenses? • Approach: Build tool to automatically crawl web, detect and categorize trackers based on our taxonomy. Longitudinal studies since then: tracking has increased and become more complex.

  17. How prevalent is tracking? (2011) 524 unique trackers on Alexa top 500 websites (homepages + 4 links) 457 domains (91%) embed at least one tracker. (97% of those include at least one cross-site tracker.) 50% of domains embed between 4 and 5 trackers. One domain includes 43 trackers.

  18. Who/what are the top trackers? (2011)

  19. How are users affected? • Question: How much of a real user’s browsing history can top trackers capture? • Measurement challenges: - Privacy concerns. - Users may not browse realistically while monitored. • Insight: AOL search logs (released in 2006) represent real user behaviors.

  20. How are users affected? • Idea: Use AOL search logs to create 30 hypothetical browsing histories. - 300 unique queries per user → top search hits. • Trackers can capture a large fraction: - Doubleclick: Avg 39% (Max 66%) - Facebook: Avg 23% (Max 45%) - Google: Avg 21% (Max 61%)

  21. How are users affected? • Idea: Use AOL search logs to create hypothetical browsing histories. - 300 unique queries per user → top search See also: ADINT (2017) hits. • Trackers can capture a large fraction: - Doubleclick: Avg 39% (Max 66%) - Facebook: Avg 23% (Max 45%) - Google: Avg 21% (Max 61%)

  22. How has this changed over time? • The web has existed for a while now … - What about tracking before 2011? - What about tracking before 2009? • Solution: time travel! [USENIX Security ’16]

  23. The Wayback Machine to the Rescue Time travel for web tracking: http://trackingexcavator.cs.washington.edu

  24. 1996-2016: More & More Tracking • More trackers of more types

  25. 1996-2016: More & More Tracking • More trackers of more types, more per site

  26. 1996-2016: More & More Tracking • More trackers of more types, more per site, more coverage

  27. Outline 1. Understanding web tracking 2. Measuring web tracking 3. Defenses

  28. Defenses to Reduce Tracking • Do Not Track proposal? Do Not Track is not a technical defense: trackers must honor the request.

  29. Defenses to Reduce Tracking • Do Not Track proposal? • Private browsing mode? Private browsing mode protects against local, not network, attackers.

  30. Defenses to Reduce Tracking • Do Not Track proposal? • Private browsing mode? • Third-party cookie blocking? Bar’s Server www.bar.com’s st part (1 st coo ookie (1 party) www.bar.com www.foo.com’s www.foo.com Foo’s Server rd part (3 rd coo ookie (3 party)

  31. Quirks of 3 rd Party Cookie Blocking In some browsers, this option means third-party cookies cannot be set, but they CAN be sent. So if a third-party cookie is somehow set, it can be used. How to get a cookie set? One way: be a first party. etc.

  32. Defenses to Reduce Tracking • Do Not Track header? • Private browsing mode? • Third-party cookie blocking? • Browser add-ons? “uses algorithmic methods to decide what is and isn't tracking” Often rely on blacklists, which may be incomplete.

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security Specialists M. ANGELA SASSE, RUHR UNIVERSITY BOCHUM & UCL The problem MENSCHLICH WELTOFFEN LEISTUNGSSTARK 2 ENISA Report December 2018

362 views • 33 slides
Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Material and some slide content from: - Software Architecture: Foundations, Theory, and Practice - Krzysztof Czarnecki Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security: The protection a ff orded a

160 views • 4 slides
Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Defining Encryption (ctd.) Lecture 3 CPA/CCA security Computational Indistinguishability Pseudo-randomness, One-Way Functions Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too strong (though too

1.36k views • 113 slides
Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security policies Computer Security Basic concepts Peter Reiher Security policies for real systems January 13, 2005 Lecture 2 Lecture 2 Page 1

347 views • 9 slides
Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security risks. Attacks in a cloud environment, top threats. Security, a major concern for cloud users. Privacy. Trust. Operating systems

661 views • 38 slides
Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election Security = Physical Security + Cybersecurity Physical Security Security plans Secure storage of voting machines and electronic pollbooks

341 views • 13 slides
Computer Security environment, without compromising functionality or security? Three parts

Computer Security environment, without compromising functionality or security? Three parts

9/7/2013 Some topics Im working on Computing on encrypted data Information flow: Dynamic IFC in Haskell, web Sandboxing Untrusted JavaScript Third party web tracking and other web security stories Practical web security

572 views • 21 slides
Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon Transport Network Link Physical CSE 461 University of Washington 2 Security Threats Security is like performance Means many things

1.12k views • 92 slides

More recommend