Exploiting Data-Usage Statistics for Website Fingerprinting Attacks on Android

Raphael Spreitzer, Simone Griesmayr, Thomas Korak, Stefan Mangard

Research output: Chapter in Book/Report/Conference proceedingConference paperpeer-review

Abstract

The browsing behavior of a user allows to infer personal details, such as health status, political interests, sexual orientation, etc. In order to protect this sensitive information and to cope with possible privacy threats, defense mechanisms like SSH tunnels and anonymity networks (e.g., Tor) have been established. A known shortcoming of these defenses is that website fingerprinting attacks allow to infer a user's browsing behavior based on traffic analysis techniques. However, website fingerprinting typically assumes access to the client's network or to a router near the client, which restricts the applicability of these attacks.

In this work, we show that this rather strong assumption is not required for website fingerprinting attacks. Our client-side attack overcomes several limitations and assumptions of network-based fingerprinting attacks, e.g., network conditions and traffic noise, disabled browser caches, expensive training phases, etc. Thereby, we eliminate assumptions used for academic purposes and present a practical attack that can be implemented easily and deployed on a large scale. Eventually, we show that an unprivileged application can infer the browsing behavior by exploiting the unprotected access to the Android data-usage statistics. More specifically, we are able to infer 97% of 2500 page visits out of a set of 500 monitored pages correctly. Even if the traffic is routed through Tor by using the Orbot proxy in combination with the Orweb browser, we can infer 95% of 500 page visits out of a set of 100 monitored pages correctly. Thus, the READ_HISTORY_BOOKMARKS permission, which is supposed to protect the browsing behavior, does not provide protection.
Original languageEnglish
Title of host publication9th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2016), Darmstadt, Germany
PublisherAssociation of Computing Machinery
DOIs
Publication statusPublished - 18 Jul 2016
EventACM Conference on Security and Privacy in Wireless and Mobile Networks - Darmstadt, Darmstadt, Germany
Duration: 18 Jul 201620 Jul 2016

Conference

ConferenceACM Conference on Security and Privacy in Wireless and Mobile Networks
Country/TerritoryGermany
CityDarmstadt
Period18/07/1620/07/16

Fields of Expertise

  • Information, Communication & Computing

Treatment code (Nähere Zuordnung)

  • Application
  • Theoretical

Fingerprint

Dive into the research topics of 'Exploiting Data-Usage Statistics for Website Fingerprinting Attacks on Android'. Together they form a unique fingerprint.

Cite this