No boundaries: data exfiltration by third parties embedded on web pages

The study is a collaboration between Gunes Acar (KU Leuven), Steven Englehardt (Mozilla), and Arvind Narayanan (Princeton University)

We discovered three broad classes of vulnerabilities during our 2017 measurements: the misuse of browser login managers by trackers, data exfiltration from social login APIs, and the leaking of personal data to trackers due to whole-DOM exfiltration. All three classes are explored in depth in our paper. As an example, we provide a brief summary of login manager misuse below.

We found two tracking scripts misusing browser login managers to collect email addresses. These scripts were present on 1,100 of the Alexa top 1M sites in September 2017.

The mechanism

First, a user fills out a login form on the page and asks the browser to save the login credentials. The third-party script does not need to be present on the login page. Then, the user visits another page on the same website which includes the third-party script. The script inserts an invisible login form, which is automatically filled in by the browser's login manager. The third-party script retrieves the user's email address by reading the populated form and sends the email hashes to third-party servers.

The publication of our findings resulted in several privacy fixes and improvements to browsers, websites, third parties and privacy protection tools. The table below provides an overview. A full description of the responses is available in Section 7.1 of our paper.

The code for our modified version of the OpenWPM web privacy measurement tool can be found on GitHub.

The data from our 2017 measurements is available for download in bzip2 archives:

• Spoofed Facebook Login Crawl (31.1 GB)—Used to detect Social API misuse.
• Chunk Injection Crawl 1 - with injection (25.6 GB)—Used to detect Whole-DOM Scraping.
• Chunk Injection Crawl 2 - no injection (13.8 GB)—Used to detect Whole-DOM Scraping.
• Identity Injection Crawl (31.8 GB)—Used to detect Login Manager misuse and Whole-DOM Scraping.

We thank our shepherd Oleksii Starov for his valuable feedback, Mihir Kshirsagar for his help with questions related to regulations, Dimitar Bounov and Sorin Lerner for bringing Gradescope leaks to our attention. This study is supported by an NSF grant (CNS 1526353). Some of our measurements were funded by an Amazon AWS Cloud Credits for Research grant. Gunes Acar holds a Postdoctoral fellowship from the Research Foundation Flanders (FWO). This work was supported by CyberSecurity Research Flanders with reference number VR20192203.

Reference: Gunes Acar, Steven Englehardt, Arvind Narayanan. No boundaries: data exfiltration by third parties embedded on web pages. In Proceedings of the 20th Privacy Enhancing Technologies Symposium (PETS), July 13–16, 2020.

BibTeX: Copy to clipboard

@inproceedings{acar2020noboundaries,
  author    = {Gunes Acar and Steven Englehardt and Arvind Narayanan},
  title     = {No boundaries: data exfiltration by third parties embedded on web pages},
  booktitle = {Proceedings of the 20th Privacy Enhancing Technologies Symposium (PETS)},
  year      = 2020,
  month     = jul,
  publisher = {Sciendo},
  doi       = {10.2478/popets-2020-0070},
  url       = {https://petsymposium.org/2020/files/papers/issue4/popets-2020-0068.pdf}
}