Detecção de Canvas Fingerprinting em Páginas Web baseada no Modelo Vetorial

• Pablo A. da P. Elleres
• Adria M. de Oliveira
• Eduardo L. Feitosa

DOI: https://doi.org/10.5753/sbseg.2017.19519

Abstract

This paper presents a method for evaluating Canvas Fingerpriting scripts in Web pages. The method consists in calculating the similarity between a database with 100 queries related to Canvas Fingerpriting and databases with pages considered as benign and malignant. The results show high levels of similarities with a canvas base (99%), a base of phishing pages (92%), a base with pages from the DMOZ directory (91%), and a base with pages of Alexa.com (97%).

References

Acar, G., Eubank, C., Englehardt, S., Juarez, M., Narayanan, A., and Diaz, C. (2014). The Web Never Forgets: Persistent Tracking Mechanisms in the Wild. Proceedings of the 2014 ACM SIGSAC CCS, pages 674–689.

Baeza-Yates, R. &. R.-N. (2013). Recuperação de Informação. Bookman.

Bursztein, E., Malyshev, A., Pietraszek, T., and Thomas, K. (2016). Picasso: Lightweight Device Class Fingerprinting for Web Clients. Proceedings of the 6th Workshop on Security and Privacy in Smartphones and Mobile Devices, pages 93–102.

Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., Morris, J., Hansen, M., and Smith, R. (2013). Privacy Considerations for Internet Protocols. RFC 6973 (Informational). http://www.ietf.org/rfc/rfc6973.txt.

Eckersley, P. (2010). How unique is your web browser? In Proceedings of the 10th International Conference on Privacy Enhancing Technologies, PETS’10, pages 1–18, Berlin, Heidelberg. Springer-Verlag.

Englehardt, S. and Narayanan, A. (2016). Online Tracking: A 1-million-site Measurement and Analysis. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security - CCS’16, (1):1388–1401.

ISO (2008). ISO/IEC 27005: Information technology-Security techniques -Information security risk management. ISO.

Laperdrix, P., Rudametkin, W., and Baudry, B. (2016). Beauty and the Beast: Diverting Modern Web Browsers to Build Unique Browser Fingerprints. Proceedings - 2016 IEEE Symposium on Security and Privacy, SP 2016, pages 878–894.

Mayer, J. R. (2009). Internet Anonymity in the Age of Web 2.0. Thesis, pages 1–103.

Mowery, K. and Shacham, H. (2012). Pixel Perfect : Fingerprinting Canvas in HTML5. Web 2.0 Security & Privacy 20 (W2SP), pages 1–12.

Nakibly, G., Shelef, G., and Yudilevich, S. (2015). Hardware Fingerprinting Using HTML5. Computing Research Repository (CoRR), abs/1503.0.

Nikiforakis, N., Kapravelos, a., Joosen, W., Kruegel, C., Piessens, F., and Vigna, G. (2013). Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting. 2013 IEEE Symposium on Security and Privacy, pages 541–555.

Ramiro, T. B., Oliveira, E., Azevedo, L. L., Monteiro, V., and Teixeira, S. (2005). Atribuindo títulos de assuntos na categorização automática de documento. Congresso Brasileiro de Biblioteconomia, Documentação e Ciência da Informação.

Saraiva, A. R., de Oliveira, A. M., and Feitosa, E. L. (2016). Determinando o Risco de Fingerprinting em Páginas Web. Anais do XVI Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais - SBSeg 2016, pages 254–267.

Saraiva, A. R., Elleres, P. A. d. P., Carneiro, G. d. B., and Feitosa, E. L. (2014). Device Fingerprinting: Conceitos e Técnicas, Exemplos e Contramedidas. Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais - SBSeg 2014, pages 50–97.

Satopää, V., Albrecht, J., Irwin, D., and Raghavan, B. (2011). Finding a ”kneedle”in a haystack: Detecting knee points in system behavior. Proceedings - International Conference on Distributed Computing Systems, pages 166–171.

W3C (2015). Html canvas 2d context. https://www.w3.org/TR/2dcontext/.

Ximenes, P., Correia, M., Mello, P., Carvalho, F., Franklin, M., and Andrade, R. (2016). TARP Fingerprinting: Um Mecanismo de Browser Fingerprinting Baseado em HTML5 Resistente a Contramedidas. Anais do XVI Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais, pages 100–113.