Tracking the Trackers: Fast and Scalable Dynamic Analysis of Web Content for Privacy Violations

1. Mozilla: Same origin policy for javascript, https://developer.mozilla.org/En/Same_origin_policy_for_JavaScript

2. Krishnamurthy, B., Wills, C.: Privacy Leakage in Mobile Online Social Networks. In: Workshop on Online Social Networks (2010)

   Google Scholar 

3. Krishnamurthy, B., Naryshkin, K., Wills, C.: Privacy Leakage Vs. Protection Measures: The Growing Disconnect. In: Web 2.0 Security and Privacy (2011)

   Google Scholar 

4. Jang, D., Jhala, R., Lerner, S., Shacham, H.: An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications. In: 17th ACM Conference on Computer and Communications Security (2010)

   Google Scholar 

5. Vogt, P., Nentwich, F., Jovanovic, N., Kirda, E., Kruegel, C., Vigna, G.: Cross-Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. In: Network and Distributed System Security Symposium (2007)

   Google Scholar 

6. Dhawan, M., Ganapathy, V.: Analyzing Information Flow in JavaScript-based Browser Extensions. In: ACSAC 2009: Proceedings of the 25th Annual Computer Security Applications Conference (2009)

   Google Scholar 

7. Wang, Y.M., Beck, D., Jiang, X., Roussev, R., Verbowski, C., Chen, S., King, S.: Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities. In: Network and Distributed System Security Symposium (2006)

   Google Scholar 

8. Webkit: SunSpider JavaScript Benchmark, http://www.webkit.org/perf/sunspider/sunspider.html

9. The Wall Street Journal: The Web’s New Gold Mine: Your Secrets, http://online.wsj.com/article/SB10001424052748703940904575395073512989404.html

10. The Center for Internet and Society: Tracking the Trackers: Microsoft Advertising, http://cyberlaw.stanford.edu/node/6715

11. Electronic Frontier Foundation: Panopticlick, http://panopticlick.eff.org/

12. Eckersley, P.: How Unique Is Your Web Browser? In: Atallah, M.J., Hopper, N.J. (eds.) PETS 2010. LNCS, vol. 6205, pp. 1–18. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

13. Heritrix: Heritrix, https://webarchive.jira.com/wiki/display/Heritrix/Heritrix

14. The Wall Street Journal: What They Know About You, http://online.wsj.com/article/SB10001424052748703999304575399041849931612.html

15. Cooke, L.: Is the Mouse a ’Poor Man’s Eye Tracker?’. In: Society for Technical Communication Conference (2006)

    Google Scholar 

16. Forbes: Class Action Lawsuit Filed Over YouPorn History Sniffing, http://www.forbes.com/sites/kashmirhill/2010/12/06/class-action-lawsuit-filed-over-youporn-history-sniffing/

17. Forbes: McDonald’s, CBS, Mazda, and Microsoft Sued for ’History Sniffing’, http://www.forbes.com/sites/kashmirhill/2011/01/03/mcdonalds-cbs-mazda-and-microsoft-sued-for-history-sniffing/

18. Curtsinger, C., Livshits, B., Zorn, B., Seifert, C.: Zozzle: Low-overhead Mostly Static JavaScript Malware Detection. In: 20th USENIX Security (2011)

    Google Scholar 

19. Ratanaworabhan, P., Livshits, B., Zorn, B.: Nozzle: A Defense Against Heap-Spraying Code Injection Attacks. In: 18th USENIX Security (2009)

    Google Scholar 

20. Canali, D., Cova, M., Kruegel, C., Vigna, G.: Prophiler: A Fast Filter for the Large-Scale Detection of Malicious Web Pages. In: Proceedings of the World Wide Web Conference, WWW (2011)

    Google Scholar 

21. Cova, M., Kruegel, C., Vigna, G.: Detection and Analysis of Drive-by-Download Attacks and Malicious JavaScript Code. In: Proceedings of the World Wide Web Conference, WWW (2010)

    Google Scholar 

22. Provos, N., Mavrommatis, P., Rajab, M.A., Monrose, F.: All Your iFRAMEs Point to Us. In: 17th USENIX Security (2008)

    Google Scholar 

23. Seifert, C., Komisarczuk, P., Welch, I.: Identification Of Malicious Web Pages With Static Heuristics. In: Australasian Telecommunication Networks and Applications Conference (2008)

    Google Scholar 

24. Spoor, R.J., Kijewski, P., Overes, C.: The HoneySpider Network: Fighting Client-side Threats. In: FIRST (2008)

    Google Scholar 

25. Reis, C., Dunagan, J., Wang, H.J., Dubrovsky, O., Esmeir, S.: BrowserShield: Vulnerability-driven Filtering of Dynamic HTML. In: Proceedings of the Symposium on Operating Systems Design and Implementation (2006)

    Google Scholar 

26. Louw, M., Venkatakrishnan, V.: Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers. In: Proceedings of the IEEE Symposium on Security and Privacy (2009)

    Google Scholar 

27. Meyerovich, L., Livshits, B.: ConScript: Specifying and Enforcing Fine-Grained Security Policies for JavaScript in the Browser. In: Proceedings of the IEEE Symposium on Security and Privacy (2010)

    Google Scholar 

28. Nadji, Y., Saxena, P., Song, D.: Document Structure Integrity: A Robust Basis for Cross-site Scripting Defense. In: Network and Distributed System Security Symposium (2009)

    Google Scholar 

29. Clover, A.: CSS Visited Pages Disclosure. BUGTRAQ Mailing List Posting, http://seclists.org/bugtraq/2002/Feb/271

30. Baron, L.D.: Preventing Attacks on a User’s History Through CSS: visited Selectors, http://dbaron.org/mozilla/visited-privacy

31. Weinberg, Z., Chen, E., Jayaraman, P.R., Jackson, C.: I Still Know What You Visited Last Summer: Leaking Browsing History Via User Interaction and Side Channel Attacks. In: 31st IEEE Symposium on Security and Privacy (May 2011)

    Google Scholar 

32. Politz, J.G., Eliopoulos, S.A., Guha, A., Krishnamurthi, S.: ADsafety: Type-Based Verification of JavaScript Sandboxing. In: 20th USENIX Security (2011)

    Google Scholar 

33. Taly, A., Erlingsson, U., Mitchell, J.C., Miller, M.S., Nagra, J.: Automated Analysis of Security-Critical JavaScript APIs. In: Proceedings of the IEEE Symposium on Security and Privacy (2011)

    Google Scholar 

Download references