Annual Computer Security Applications Conference (ACSAC) 2016

Full Program »

Inferring Browser Activity and Status Through Remote Monitoring of Storage Usage

Web applications use the local storage of a web browser to temporarily store static resources for caching and persistently store personalized data for stateful services. Since different web applications use the local storage differently in terms of size and time, attackers can infer a user’s browser activity and status if they can monitor storage usage: for example, which web site a user is viewing and whether a user has logged in to a certain web site. In this paper, we explore passive and active web attacks that exploit the Quota Management API to extract such information from a web browser, as the API allows us to continuously monitor the size of available storage space. We develop two web attacks: a cross-tab activity inference attack to passively monitor which web site a user is currently visiting and a browser status inference attack to actively identify the browser status such as browser history and login information. Our attacks are successful at stealing private information from Chrome running on various platforms with ∼90% accuracy. We further propose an effective solution against the attacks.

Author(s):

Hyungsub Kim    
Pohang University of Science and Technology & Agency for Defense Development
South Korea

Sangho Lee    
Georgia Institute of Technology
United States

Jong Kim    
Pohang University of Science and Technology
South Korea

 

Powered by OpenConf®
Copyright©2002-2016 Zakon Group LLC