User Blocking Considered Harmful? An Attacker-Controllable Side Channel to Identify Social Accounts

Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, Keito Sasaoka, Takeshi Yagi, Tatsuya Mori

研究成果

7 被引用数 (Scopus)

抄録

This paper presents a practical side-channel attack that identifies the social web service account of a visitor to an attacker's website. Our attack leverages the widely adopted user-blocking mechanism, abusing its inherent property that certain pages return different web content depending on whether a user is blocked from another user. Our key insight is that an account prepared by an attacker can hold an attackercontrollable binary state of blocking/non-blocking with respect to an arbitrary user on the same service; provided that the user is logged in to the service, this state can be retrieved as one-bit data through the conventional cross-site timing attack when a user visits the attacker's website. We generalize and refer to such a property as visibility control, which we consider as the fundamental assumption of our attack. Building on this primitive, we show that an attacker with a set of controlled accounts can gain a complete and flexible control over the data leaked through the side channel. Using this mechanism, we show that it is possible to design and implement a robust, largescale user identification attack on a wide variety of social web services. To verify the feasibility of our attack, we perform an extensive empirical study using 16 popular social web services and demonstrate that at least 12 of these are vulnerable to our attack. Vulnerable services include not only popular social networking sites such as Twitter and Facebook, but also other types of web services that provide social features, e.g., eBay and Xbox Live. We also demonstrate that the attack can achieve nearly 100% accuracy and can finish within a sufficiently short time in a practical setting. We discuss the fundamental principles, practical aspects, and limitations of the attack as well as possible defenses.

本文言語English
ホスト出版物のタイトルProceedings - 3rd IEEE European Symposium on Security and Privacy, EURO S and P 2018
出版社Institute of Electrical and Electronics Engineers Inc.
ページ323-337
ページ数15
ISBN(電子版)9781538642276
DOI
出版ステータスPublished - 2018 7 6
イベント3rd IEEE European Symposium on Security and Privacy, EURO S and P 2018 - London, United Kingdom
継続期間: 2018 4 242018 4 26

出版物シリーズ

名前Proceedings - 3rd IEEE European Symposium on Security and Privacy, EURO S and P 2018

Other

Other3rd IEEE European Symposium on Security and Privacy, EURO S and P 2018
国/地域United Kingdom
CityLondon
Period18/4/2418/4/26

ASJC Scopus subject areas

  • 人工知能
  • コンピュータ ネットワークおよび通信
  • 安全性、リスク、信頼性、品質管理

フィンガープリント

「User Blocking Considered Harmful? An Attacker-Controllable Side Channel to Identify Social Accounts」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル