Alexander Sjösten (Chalmers University of Technology), Steven Van Acker (Chalmers University of Technology), Pablo Picazo-Sanchez (Chalmers University of Technology), Andrei Sabelfeld (Chalmers University of Technology)

Browser extensions enable rich experience for the users of today's web. Being
deployed with elevated privileges, extensions are given the power to overrule
web pages. As a result, web pages often seek to detect the installed extensions,
sometimes for benign adoption of their behavior but sometimes as part of
privacy-violating user fingerprinting.
Researchers have studied a class of attacks that allow detecting extensions by
probing for Web Accessible Resources (WARs) via URLs that include public
extension IDs.
Realizing privacy risks associated with WARs, Firefox has recently moved to
randomize a browser extension's ID, prompting the Chrome team to plan for
following the same path.
However, rather than mitigating the issue, the randomized IDs can in fact
exacerbate the extension detection problem, enabling attackers to use a
randomized ID as a reliable fingerprint of a user.
We study a class of extension revelation attacks, where extensions reveal
themselves by injecting their code on web pages.
We demonstrate how a combination of revelation and probing can uniquely identify
90% out of all extensions injecting content, in spite of a randomization scheme.
We perform a series of large-scale studies to estimate possible implications of
both classes of attacks.
As a countermeasure, we propose a browser-based mechanism that enables control
over which extensions are loaded on which web pages and present a proof of
concept implementation which blocks both classes of attacks.

View More Papers

Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation

Victor Le Pochat (imec-DistriNet, KU Leuven), Tom Van Goethem (imec-DistriNet, KU Leuven), Samaneh Tajalizadehkhoob (Delft University of Technology), Maciej Korczyński (Grenoble Alps University), Wouter Joosen (imec-DistriNet, KU Leuven)

Read More

Geo-locating Drivers: A Study of Sensitive Data Leakage in...

Qingchuan Zhao (The Ohio State University), Chaoshun Zuo (The Ohio State University), Giancarlo Pellegrino (CISPA, Saarland University; Stanford University), Zhiqiang Lin (The Ohio State University)

Read More

Fine-Grained and Controlled Rewriting in Blockchains: Chameleon-Hashing Gone Attribute-Based

David Derler (DFINITY), Kai Samelin (TÜV Rheinland i-sec GmbH), Daniel Slamanig (AIT Austrian Institute of Technology), Christoph Striecks (AIT Austrian Institute of Technology)

Read More

Please Forget Where I Was Last Summer: The Privacy...

Kostas Drakonakis (FORTH, Greece), Panagiotis Ilia (FORTH, Greece), Sotiris Ioannidis (FORTH, Greece), Jason Polakis (University of Illinois at Chicago, USA)

Read More