Technische Universität Berlin Institut für Softwaretechnik und Theoretische Informatik Security in Telecommunications

2025-05-06 0 0 1.44MB 120 页 10玖币

侵权投诉

Technische Universität Berlin

Institut für Softwaretechnik und Theoretische Informatik

Security in Telecommunications

Fakultät IV

Ernst-Reuter-Platz 7

10587 Berlin

www.isti.tu-berlin.de

Master Thesis

Uncovering Fingerprinting Networks.

An Analysis of In-Browser Tracking using a

Behavior-based Approach

Sebastian Neef

Matriculation Number: 350692

s.neef@campus.tu-berlin.de

29.03.2021

Supervised by

Prof. Dr. Jean-Pierre Seifert

Second Supervisor

Prof. Dr. Florian Tschorsch

Assistant Supervisor

M.Sc. Julian Fietkau

arXiv:2210.11300v1 [cs.CR] 15 Aug 2022

Declaration

I hereby declare that the thesis submitted is my own, unaided work, completed

without any unpermitted external help. Only the sources and resources listed were

used.

The independent and unaided completion of the thesis is aﬃrmed by aﬃdavit:

Berlin, the 29th of March, 2021

Sebastian Neef

Due to the collaboration with SecT’s research assistant Julian Fietkau and master’s

degree candidate Felix Kybranz on the paper The Elephant in the Background. A

Quantitative Approach to Empower Users Against Web Browser Fingerprinting [38]

prior to the thesis, this work references their goals, methods and tools. Therefore,

it is closely related to the paper and Kybranz’s thesis [38, 66], but comprises the

essential ideas, implementation, and results of Sebastian Neef’s work.

III

Acknowledgements

My profound gratitude goes to the whole SecT department for making me feel

at home. Foremost to Prof. Seifert for supervising my thesis and Julian Fietkau

for assisting with insightful ideas, productive discussions, and helpful guidance.

Furthermore, I sincerely appreciate countless tips and constructive feedback from

all members of AG Rechnersicherheit. Finally, I must thank my whole family and

friends for always motivating and supporting me throughout my life. Thank you

all!

Abstract

Throughout recent years, the importance of internet-privacy has continuously risen.

The General Data Protection Regulation by the European Union fundamentally

changed digital data processing by requiring explicit consent for processing person-

ally identiﬁable information. In combination with the cookie law, users can opt-out

of being proﬁled by advertisers or other entities. Browser ﬁngerprinting is a tech-

nique that does not require cookies or persistent identiﬁers. It derives a suﬃciently

unique identiﬁer from the various browser or device properties. Academic work

has covered oﬀensive and defensive ﬁngerprinting methods for almost a decade,

observing a rise in popularity.

This thesis explores the current state of browser ﬁngerprinting on the internet.

For that, we implement FPNET - a scalable & reliable tool based on FPMON, to

identify ﬁngerprinting scripts on large sets of websites by observing their behavior.

By scanning the Alexa Top 10,000 websites, we spot several hundred networks of

equally behaving scripts. For each network, we determine the actor behind it. We

track down companies like Google, Yandex, Maxmind, Sift, or FingerprintJS, to

name a few.

In three complementary studies, we further investigate the uncovered networks

with regards to I) randomization of ﬁlenames or domains, II) behavior changes,

III) security. Two consecutive scans reveal that only less than 12.5% of the pages

do not change script ﬁles. With our behavior-based approach, we successfully re-

identify almost 9,000 scripts whose ﬁlename or domain changed, and over 86%

of the scripts without URL changes. The security analysis shows an adoption of

TLS/SSL to over 98% and speciﬁc web security headers set for over 30% of the

scripts.

Finally, we voice concerns about the unavoidability of modern ﬁngerprinting and

its implications for internet users’ privacy since we believe that many users are

unaware of being ﬁngerprinted or have insuﬃcient possibilities to protect against

it.

文档加载中……请稍候！
如果长时间未打开，您也可以点击刷新试试。

下载文档到电脑，查找使用更方便

10 玖币 0人已下载

立即下载

摘要：

TechnischeUniversitätBerlinInstitutfürSoftwaretechnikundTheoretischeInformatikSecurityinTelecommunicationsFakultätIVErnst-Reuter-Platz710587Berlinwww.isti.tu-berlin.deMasterThesisUncoveringFingerprintingNetworks.AnAnalysisofIn-BrowserTrackingusingaBehavior-basedApproachSebastianNeefMatriculationNumb...

展开>> 收起<<

Technische Universität Berlin Institut für Softwaretechnik und Theoretische Informatik Security in Telecommunications.pdf

共120页,预览5页

还剩页未读，继续阅读

声明：本站为文档C2C交易模式，即用户上传的文档直接被用户下载，本站只是中间服务平台，本站所有文档下载所得的收益归上传人(含作者)所有。玖贝云文库仅提供信息存储空间，仅对用户上传内容的表现方式做保护处理，对上载内容本身不做任何修改或编辑。若文档所含内容侵犯了您的版权或隐私，请立即通知玖贝云文库，我们立即给予删除！

Technische Universität Berlin Institut für Softwaretechnik und Theoretische Informatik Security in Telecommunications

相关推荐

开通VIP享超值会员特权

作者详情

相关内容

热门标签

举报选择: