An Analysis of Private Browsing Modes in Modern Browsers
description
Transcript of An Analysis of Private Browsing Modes in Modern Browsers
![Page 1: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/1.jpg)
1
Gaurav Aggarwal and Elie Bursztein, Collin Jackson, Dan Boneh, USENIX (Aug.,2010)
AN ANALYSIS OF PRIVATE BROWSING MODES IN MODERN BROWSERS
![Page 2: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/2.jpg)
2 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 3: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/3.jpg)
3 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 4: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/4.jpg)
4 INTRODUCTION
The four major browsers (IE, Firefox, Chrome and Safari) recently added private browsing modes to their user interfaces
- Sites visited while browsing in private mode should leave no trace on the user’s computer
- Users may want to hide their identity from web sites they visit by
![Page 5: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/5.jpg)
5 INTRODUCTION
While all major browsers support private browsing, there is a great deal of inconsistency in the type of privacy provided by the different browsers
Even within a single browser there are inconsistencies
![Page 6: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/6.jpg)
6 INTRODUCTION
Even if a browser adequately implements private browsing, an extension or plug-ins can completely undermine its privacy guarantees
![Page 7: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/7.jpg)
7 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 8: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/8.jpg)
8
PRIVATE BROWSING: GOAL AND THREAT MODEL
Defined two types of attackers:
1. An attacker who controls the user’s machine (a local attacker)
2. An attacker who controls web sites that the user visits (a web attacker)
![Page 9: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/9.jpg)
9 LOCAL ATTACKER
Security against a local attacker means that an attacker who takes control of the machine after the user exits private browsing can learn nothing about the user’s actions while in private browsing
Limitation: local attacker has no access to the user’s machine before the user exits private browsing
![Page 10: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/10.jpg)
10 LOCAL ATTACKER
We need adequately erase persistent state changes during a private browsing session
1. Changes initiated by a web site without any user interaction 2. Changes initiated by a web site, but requiring user interaction 3. Changes initiated by the user. 4. Non-user-specific state changes
![Page 11: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/11.jpg)
11LOCAL ATTACKER:SECURITY MODEL
Attacker’s capabilities
1. The attacker does nothing until the user leaves private browsing mode 2. While active, the attacker cannot communicate with network elements that contain information
about the user’s activities while in private mode
![Page 12: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/12.jpg)
12LOCAL ATTACKER:SECURITY MODEL
Attacker’s goal
- For a set S of HTTP requests of the attacker’s choosing, determine if the browser issued any of those requests while in private browsing mode
![Page 13: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/13.jpg)
13LOCAL ATTACKER:SECURITY MODEL
Challenge
- The browser will need to ensure that all DNS queries while in private mode do not affect the system’s DNS cache: no entries should be added or removed
- Operating system can swap memory pages to the
swap partition on disk which can leave traces of the user’s activity.
![Page 14: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/14.jpg)
14LOCAL ATTACKER:SECURITY MODEL
Solution?
- VMM(Virtual Machine Monitor)
- User profile backup
- Not recording certain date in private mode
![Page 15: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/15.jpg)
15 WEB ATTACKER
Goal
1. A web site cannot link a user visiting in private mode to the same user visiting in public mode
2. A web site cannot link a user in one private session to the same user in another private session
3. A web site should not be able to determine whether the browser is currently in private browsing mode
![Page 16: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/16.jpg)
16 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 17: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/17.jpg)
17
SURVEY OF PRIVATE BROWSING IN MODERN BROWSERS
User Interface
![Page 18: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/18.jpg)
18
SURVEY OF PRIVATE BROWSING IN MODERN BROWSERS
User Interface
![Page 19: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/19.jpg)
19
SURVEY OF PRIVATE BROWSING IN MODERN BROWSERS
Internal behavior
![Page 20: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/20.jpg)
20
SURVEY OF PRIVATE BROWSING IN MODERN BROWSERS
Internal behavior
![Page 21: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/21.jpg)
21
SURVEY OF PRIVATE BROWSING IN MODERN BROWSERS
Internal behavior
![Page 22: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/22.jpg)
22
SURVEY OF PRIVATE BROWSING IN MODERN BROWSERS
Initial privacy violation examples
1. Custom Handler Protocol - Custom protocol handlers(CPH)
2. Client Certificate - SSL client certification
![Page 23: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/23.jpg)
23 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 24: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/24.jpg)
24USAGE MEASUREMENT:DESIGN
Ad network- Ran two simultaneous one-day campaigns: targeted adult sites, gift shopping sites and news sites
![Page 25: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/25.jpg)
25USAGE MEASUREMENT:RESULT
Private browsing was more popular at adult web sites than at gift shopping sites and news sites
Private browsing was more commonly used in browsers that displayed subtle private browsing indicators
![Page 26: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/26.jpg)
26 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 27: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/27.jpg)
27WEAKNESSES IN CURRENT IMPLEMENTATIONS
Manual code review
- Firefox keeps all the state related to the user’s browsing activity including preferences, history, cookies, text entered in forms fields, search queries, etc. in a Profile folder on disk
![Page 28: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/28.jpg)
28WEAKNESSES IN CURRENT IMPLEMENTATIONS
Manual code review
1. nsIFile - A cross-platform representation of a location in the file system used to read or write to files
2. Storage - A SQLite database API that can be used by other Firefox components and extensions to manipulate SQLite database files
![Page 29: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/29.jpg)
29WEAKNESSES IN CURRENT IMPLEMENTATIONS
Security certificate settings(stored in file cert8.db)
- Stores all security certificate settings and any SSL
![Page 30: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/30.jpg)
30WEAKNESSES IN CURRENT IMPLEMENTATIONS
Site-specific preferences (stored in file permissions.sqlite)
- Stores many of Firefox permissions that are decided on a per-site basis.
![Page 31: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/31.jpg)
31WEAKNESSES IN CURRENT IMPLEMENTATIONS
Download actions (stored in file mimeTypes.rdf)
- Stores the user’s preferences with respect to what Firefox does when it comes across known file types like pdf or avi.
![Page 32: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/32.jpg)
32WEAKNESSES IN CURRENT IMPLEMENTATIONS
An automated private browsing test using unit tests
- All major browsers have a collection of unit tests for testing browser features before a release
- MozMill, a Fire fox user-interface test automation tool
![Page 33: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/33.jpg)
33WEAKNESSES IN CURRENT IMPLEMENTATIONS
Use fs usage to output the name of the system call used to access the filesystem and the file descriptor being acted upon
Also use the “last modified time” for files in the profile directory to identity those files that are changed during the test.
![Page 34: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/34.jpg)
34WEAKNESSES IN CURRENT IMPLEMENTATIONS
Search Plugins (stored in search.sqlite and search.json)
![Page 35: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/35.jpg)
35 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 36: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/36.jpg)
36 BROWSER ADDONS
Browser addons (extensions and plug-ins) pose a privacy risk to private browsing because they can persist state to disk about a user’s behavior in private mode
![Page 37: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/37.jpg)
37 BROWSER ADDONS
Internet Explorer
- Default set extensions disabled, but plugins are still functional.
Firefox
- Both are enable in private mode
Google Chrome
- Disables most extension functionality in private mode, but plugins are enabled
Safari
- Does not have a supported extension API
![Page 38: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/38.jpg)
38 BROWSER ADDONS
URL whitelist/blocklist/queues
URL Mappings
Timestamp
![Page 39: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/39.jpg)
39 BROWSER ADDONS
Manual check- Extensions that opt-in to running in private browsing mode
Disallow writes - Prevent extensions from changing any local state while in private browsing mode
Override option- Discard changes made by extensions to local state while in private browsing mode, unless the extension explicitly indicates that the write should persist beyond private browsing mode
![Page 40: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/40.jpg)
40 BROWSER ADDONS
ExtensionBlocker in JavaScript
- Disable all extensions that are not safe for private mode.
![Page 41: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/41.jpg)
41 OUTLINE
Introduction
Private browsing: goal and threat model
A survey of private browsing in modern browsers
Usage measurement
Weaknesses in current implementations
Browser addons
Conclusions
![Page 42: An Analysis of Private Browsing Modes in Modern Browsers](https://reader035.fdocuments.in/reader035/viewer/2022062411/56816683550346895dda29b2/html5/thumbnails/42.jpg)
42 CONCLUSION
Manual review and automated testing tool pointed out several weaknesses in existing implementations
Performed the first measurement study of private browsing usage in different browsers and on different sites
Keeping browser extensions and plug-ins from undoing the goals of private browsing