WASHINGTON: A new study has shown that your web surfing history is easily accessible without your permission – through JavaScript code.
Research from computer scientists at the University of California, San Diego, showed that JavaScript code deployed by real websites and online advertising providers uses browser vulnerabilities to determine which sites you have and have not visited.
“JavaScript is a great thing, it allows things like Gmail and Google Maps and a whole bunch of Web 2.0 applications; but it also opens up a lot of security vulnerabilities,” said Sorin Lerner. The researchers documented JavaScript code secretly collecting browsing histories of Web users through “history sniffing” and sending that information across the network.
“Nobody knew if anyone on the Internet was using history sniffing to get at users’ private browsing history. What we were able to show is that the answer is yes,” said Hovav Shacham.
History sniffing takes place without your knowledge or permission and relies on the fact that browsers display links to sites you’ve visited differently than ones you haven’t: by default, visited links are purple, unvisited links blue.
History sniffing JavaScript code can be used by website owners to learn which competitor sites visitors have or have not been to or can also be deployed by advertising companies looking to build user profiles, or by online criminals collecting information for future phishing attacks.
In addition, anyone using anything but the latest versions of the patched browsers is also vulnerable. “We built a dynamic data flow engine for JavaScript to track history sniffing in the wild. I don’t know of any other practical tool that can be used to do this kind of extensive study,” said Dongseok Jang.
Out of 485 sites, 63 transferred the browser’s history to the network. “We confirmed that 46 of them are actually doing history sniffing, one of these sites being in the Alexa global top 100,” the UC San Diego computer scientists wrote. “I think people who have updated or switched browsers should now worry about things other than history sniffing, like keeping their Flash plug-in up to date so they don’t get exploited.
But that doesn’t mean that the companies that have engaged in history sniffing for the currently 60 percent of the user population that is vulnerable to it should get a free pass,” said Shacham.
The UC San Diego history-sniffing detection tool analyzes the JavaScript running on the page to identify and tag all instances where the browser history is being checked. The way the system tags each of these potential history tracking events can be compared to the ink or paint packets that banks add to bags of money being stolen.
“As soon as a JavaScript tries to look at the color of a link, we immediately put ‘paint’ on that. Some sites collected that information but never sent it over the network, so there was all this ‘paint’ inside the browser. But in other cases, we observed ‘paint’ being sent over the network, indicating that history sniffing is going on,” explained Lerner.
“We detected when browser history is looked at, collected on the browser and sent on the network from the browser to their servers. What servers then do with that information is speculation,” he said.
The “paint” tracking approach to monitoring JavaScript could be useful for more than just history sniffing, Lerner explained. “It could be useful for understanding what information is being leaked by applications on Web 2.0 sites. Many of these apps use a lot of JavaScript.”
The computer scientists from the UC San Diego Jacobs School of Engineering presented this work in October at the 2010 ACM
Conference on Computer and Communications Security (CCS 2010).
