Publications about tracking and spying technologies

From JonDonym Wiki
(Difference between revisions)
Jump to: navigation, search
(Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning)
Line 7: Line 7:
 
Investigations by ''Max-Planck-Instituts (MPI) für ausländisches und internationales Strafrecht'' (Institute for criminal law) about effect of preventive data retention. The conclusion is that there is no significant benefit (reduced occurrence of crime or improved investigation success rate) of data retention.
 
Investigations by ''Max-Planck-Instituts (MPI) für ausländisches und internationales Strafrecht'' (Institute for criminal law) about effect of preventive data retention. The conclusion is that there is no significant benefit (reduced occurrence of crime or improved investigation success rate) of data retention.
  
Download: [http://vds.brauchts.net/MPI_VDS_Studie.pdf Gutachten des MPI] ([https://anonymous-proxy-servers.net/paper/MPI_VDS_Studie.pdf local copy]) 2.4 MiB, 292 pages, German only, released 2011-July
+
Download: [http://vds.brauchts.net/MPI_VDS_Studie.pdf Gutachten des MPI] ([https://anonymous-proxy-servers.net/paper/MPI_VDS_Studie.pdf local cache]) 2.4 MiB, 292 pages, German only, released 2011-July
  
 
=== Defending Privacy at the U.S. Border: A Guide for Travelers Carrying Digital Devices ===
 
=== Defending Privacy at the U.S. Border: A Guide for Travelers Carrying Digital Devices ===
Line 13: Line 13:
 
''Abstract:'' Anytime you travel internationally, especially into the USA, you risk a broad, invasive search of your laptop, phone, and other digital devices – including the copying of your data and seizing of your property for an indefinite time. To help travelers protect themselves and their private information during the busy holiday travel period, the Electronic Frontier Foundation (EFF) released a report with important guidance for safeguarding your personal data at the U.S border. Use a second mobile phone without any personal data inside, and remove any sensitive data from your laptop. Encryption is not a good and sufficient idea, as it usually results in pasword request, and theft of the device if you refuse to reveal the password.
 
''Abstract:'' Anytime you travel internationally, especially into the USA, you risk a broad, invasive search of your laptop, phone, and other digital devices – including the copying of your data and seizing of your property for an indefinite time. To help travelers protect themselves and their private information during the busy holiday travel period, the Electronic Frontier Foundation (EFF) released a report with important guidance for safeguarding your personal data at the U.S border. Use a second mobile phone without any personal data inside, and remove any sensitive data from your laptop. Encryption is not a good and sufficient idea, as it usually results in pasword request, and theft of the device if you refuse to reveal the password.
  
Download: [https://www.eff.org/sites/default/files/EFF-border-search_0.pdf  EFF.org] ([https://anonymous-proxy-servers.net/paper/EFF-border-search_0.pdf local copy]) 1/2 MiB PDF, 24 pages, English, released 2011-December
+
Download: [https://www.eff.org/sites/default/files/EFF-border-search_0.pdf  EFF.org] ([https://anonymous-proxy-servers.net/paper/EFF-border-search_0.pdf local cache]) 1/2 MiB PDF, 24 pages, English, released 2011-December
  
 
=== Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning ===
 
=== Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning ===
Line 25: Line 25:
 
''Abstract:'' This paper takes a first principled look at measurement methodologies for ad networks. It proposes new metrics that are robust to the high levels of noise inherent in ad distribution, identifies measurement pitfalls and artifacts, and provides mitigation strategies. It also presents an analysis of how three different classes of advertising - search, contextual, and social networks, use user profile information today. (gay users outed to advertisers)
 
''Abstract:'' This paper takes a first principled look at measurement methodologies for ad networks. It proposes new metrics that are robust to the high levels of noise inherent in ad distribution, identifies measurement pitfalls and artifacts, and provides mitigation strategies. It also presents an analysis of how three different classes of advertising - search, contextual, and social networks, use user profile information today. (gay users outed to advertisers)
  
Download: [http://saikat.guha.cc/pub/imc10-ads.pdf Saikat Guha] ([https://anonymous-proxy-servers.net/paper/imc10-ads.pdf local copy]), 240kB, 7 pages, English, released 2010-November
+
Download: [http://saikat.guha.cc/pub/imc10-ads.pdf Saikat Guha] ([https://anonymous-proxy-servers.net/paper/imc10-ads.pdf local cache]), 240kB, 7 pages, English, released 2010-November
  
 
=== Privacy-Violating Information Flows in JavaScript Web Applications ===
 
=== Privacy-Violating Information Flows in JavaScript Web Applications ===
Line 32: Line 32:
 
privacy-violating flows to exfiltrate information about users’ browsing behavior: cookie stealing, location hijacking, history sniffing, and behavior tracking.
 
privacy-violating flows to exfiltrate information about users’ browsing behavior: cookie stealing, location hijacking, history sniffing, and behavior tracking.
  
Download: [http://cseweb.ucsd.edu/users/lerner/papers/ccs10-jsc.pdf University of California, San Diego] ([https://anonymous-proxy-servers.net/paper/ccs10-jsc.pdf local copy]), 440kB, 14 pages, English, released 2010-October
+
Download: [http://cseweb.ucsd.edu/users/lerner/papers/ccs10-jsc.pdf University of California, San Diego] ([https://anonymous-proxy-servers.net/paper/ccs10-jsc.pdf local cache]), 440kB, 14 pages, English, released 2010-October
 
                          
 
                          
 
=== Certified Lies - Detecting and Defeating Government Interception Attacks against SSL ===
 
=== Certified Lies - Detecting and Defeating Government Interception Attacks against SSL ===
Line 38: Line 38:
 
''Abstract:'' C. Soghoian and S. Stamm introduced a new attack, the compelled certificate creation attack, in which  government agencies compel a certificate authority to issue false SSL certificates that are then used by intelligence agencies to covertly intercept and hijack individuals’ secure Web-based communications. They reveal alarming evidence that suggests that this attack is in active use.
 
''Abstract:'' C. Soghoian and S. Stamm introduced a new attack, the compelled certificate creation attack, in which  government agencies compel a certificate authority to issue false SSL certificates that are then used by intelligence agencies to covertly intercept and hijack individuals’ secure Web-based communications. They reveal alarming evidence that suggests that this attack is in active use.
  
Download: [https://www.eff.org/deeplinks/2010/03/researchers-reveal-likelihood-governments-fake-ssl EFF.org] ([https://anonymous-proxy-servers.net/paper/ssl-mitm.pdf local copy]) 630 kB, 19 pages,  English, released 2010-April
+
Download: [https://www.eff.org/deeplinks/2010/03/researchers-reveal-likelihood-governments-fake-ssl EFF.org] ([https://anonymous-proxy-servers.net/paper/ssl-mitm.pdf local cache]) 630 kB, 19 pages,  English, released 2010-April
  
 
=== A Practical Attack to De-Anonymize Social Network Users ===
 
=== A Practical Attack to De-Anonymize Social Network Users ===
Line 44: Line 44:
 
''Abstract:'' Deanonymisation in the Social network ''Xing''.
 
''Abstract:'' Deanonymisation in the Social network ''Xing''.
  
Download: [http://www.iseclab.org/papers/sonda-TR.pdf Isec Forschungslabor für IT-Sicherheit] ([https://anonymous-proxy-servers.net/paper/sonda-tr.pdf local Copy]) 550 kB, 15 pages, English, released 2010-January
+
Download: [http://www.iseclab.org/papers/sonda-TR.pdf Isec Forschungslabor für IT-Sicherheit] ([https://anonymous-proxy-servers.net/paper/sonda-tr.pdf local cache]) 550 kB, 15 pages, English, released 2010-January
  
 
=== Remote physical device fingerprinting by TCP timestamps ===
 
=== Remote physical device fingerprinting by TCP timestamps ===
Line 50: Line 50:
 
''Abstract:'' The paper introduce the area of remote physical device fingerprinting, or fingerprinting a physical device, as opposed to an operating system or class of devices, remotely, and without the fingerprinted device's known cooperation. Example applications include: computer forensics, tracking (with some probability), counting the number of devices behind a NAT even when the devices use constant or random IP IDs and unanonymizing anonymized network traces.
 
''Abstract:'' The paper introduce the area of remote physical device fingerprinting, or fingerprinting a physical device, as opposed to an operating system or class of devices, remotely, and without the fingerprinted device's known cooperation. Example applications include: computer forensics, tracking (with some probability), counting the number of devices behind a NAT even when the devices use constant or random IP IDs and unanonymizing anonymized network traces.
  
Download: [http://www.cs.washington.edu/homes/yoshi/papers/PDF/ CAIDE, UC San Diego] ([https://anonymous-proxy-servers.net/paper/fingerprinting-by-tcp-timestamps.pdf local copy]) 700 KB, 15 pages  English, released 2005
+
Download: [http://www.cs.washington.edu/homes/yoshi/papers/PDF/ CAIDE, UC San Diego] ([https://anonymous-proxy-servers.net/paper/fingerprinting-by-tcp-timestamps.pdf local cache]) 700 KB, 15 pages  English, released 2005
  
 
== See also ==
 
== See also ==
  
 
[[Publications_about_JonDonym]]
 
[[Publications_about_JonDonym]]

Revision as of 22:20, 6 February 2012

En2.png De2.png  Main Page (en)

Contents

Publications about tracking and spying technologies

Schutzlücken durch Wegfall der Vorratsdatenspeicherung? Data retention in Germany

Investigations by Max-Planck-Instituts (MPI) für ausländisches und internationales Strafrecht (Institute for criminal law) about effect of preventive data retention. The conclusion is that there is no significant benefit (reduced occurrence of crime or improved investigation success rate) of data retention.

Download: Gutachten des MPI (local cache) 2.4 MiB, 292 pages, German only, released 2011-July

Defending Privacy at the U.S. Border: A Guide for Travelers Carrying Digital Devices

Abstract: Anytime you travel internationally, especially into the USA, you risk a broad, invasive search of your laptop, phone, and other digital devices – including the copying of your data and seizing of your property for an indefinite time. To help travelers protect themselves and their private information during the busy holiday travel period, the Electronic Frontier Foundation (EFF) released a report with important guidance for safeguarding your personal data at the U.S border. Use a second mobile phone without any personal data inside, and remove any sensitive data from your laptop. Encryption is not a good and sufficient idea, as it usually results in pasword request, and theft of the device if you refuse to reveal the password.

Download: EFF.org (local cache) 1/2 MiB PDF, 24 pages, English, released 2011-December

Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning

Abstract: In this followup study, we reassess the Flash cookies landscape and examine a new tracking vector, HTML5 local storage and Cache-Cookies via ETags. We found over 5,600 standard HTTP cookies on popular sites, over 4,900 were from third parties. Google-controlled cookies were present on 97 of the top 100 sites, including popular government websites. Seventeen sites were using HTML5, and seven of those sites had HTML5 local storage and HTTP cookies with matching values. Flash cookies were present on 37 of the top 100 sites. We found two sites that were respawning cookies, including one site – hulu.com – where both Flash and cache cookies were employed to make identifiers more persistent. The cache cookie method used ETags, and is capable of unique tracking even where all cookies are blocked by the user and “Private Browsing Mode” is enabled.

Download: Social Science Research Network (local cache) 1.7 MiB PDF, released 2011

Challenges in Measuring Online Advertising Systems

Abstract: This paper takes a first principled look at measurement methodologies for ad networks. It proposes new metrics that are robust to the high levels of noise inherent in ad distribution, identifies measurement pitfalls and artifacts, and provides mitigation strategies. It also presents an analysis of how three different classes of advertising - search, contextual, and social networks, use user profile information today. (gay users outed to advertisers)

Download: Saikat Guha (local cache), 240kB, 7 pages, English, released 2010-November

Privacy-Violating Information Flows in JavaScript Web Applications

Abstract: The dynamic nature of JavaScript web applications has given rise to the possibility of privacy violating information flows. We present an empirical study of the prevalence of such flows on a large number of popular websites. Our survey shows that several popular sites, including Alexa global top-100 sites, use privacy-violating flows to exfiltrate information about users’ browsing behavior: cookie stealing, location hijacking, history sniffing, and behavior tracking.

Download: University of California, San Diego (local cache), 440kB, 14 pages, English, released 2010-October

Certified Lies - Detecting and Defeating Government Interception Attacks against SSL

Abstract: C. Soghoian and S. Stamm introduced a new attack, the compelled certificate creation attack, in which government agencies compel a certificate authority to issue false SSL certificates that are then used by intelligence agencies to covertly intercept and hijack individuals’ secure Web-based communications. They reveal alarming evidence that suggests that this attack is in active use.

Download: EFF.org (local cache) 630 kB, 19 pages, English, released 2010-April

A Practical Attack to De-Anonymize Social Network Users

Abstract: Deanonymisation in the Social network Xing.

Download: Isec Forschungslabor für IT-Sicherheit (local cache) 550 kB, 15 pages, English, released 2010-January

Remote physical device fingerprinting by TCP timestamps

Abstract: The paper introduce the area of remote physical device fingerprinting, or fingerprinting a physical device, as opposed to an operating system or class of devices, remotely, and without the fingerprinted device's known cooperation. Example applications include: computer forensics, tracking (with some probability), counting the number of devices behind a NAT even when the devices use constant or random IP IDs and unanonymizing anonymized network traces.

Download: CAIDE, UC San Diego (local cache) 700 KB, 15 pages English, released 2005

See also

Publications_about_JonDonym

Personal tools