SimAttack: private web search under fire

Abstract

Web Search engines have become an indispensable online service to retrieve content on the Internet. However, using search engines raises serious privacy issues as the latter gather large amounts of data about individuals through their search queries. Two main techniques have been proposed to privately query search engines. A first category of approaches, called unlinkability, aims at disassociating the query and the identity of its requester. A second category of approaches, called indistinguishability, aims at hiding user's queries or user's interests by either obfuscating user's queries, or forging new fake queries. This paper presents a study of the level of protection offered by three popular solutions: Tor-based, TrackMeNot, and GooPIR. For this purpose, we present an efficient and scalable attack -SimAttack -leveraging a similarity metric to capture the distance between preliminary information about the users (i.e., history of query) and a new query. SimAttack de-anonymizes up to 36.7 % of queries protected by an unlinkability solution (i.e., Tor-based), and identifies up to 45.3 and 51.6 % of queries protected by indistinguishability solutions (i.e., TrackMeNot and GooPIR, respectively). In addition, SimAttack de-anonymizes 6.7 % more queries than state-of-the-art attacks and dramatically improves the performance of the attack on TrackMeNot by 23.6 %, while retaining an execution time faster by two orders of magnitude.

CYCLOSA: Decentralizing Private Web Search through SGX-Based Browser Extensions

“…The exit node retrieves the query and sends it to the search engine on behalf of the user. Other protocols increasing the security of TOR (e.g., against relays acting selfishly) have been proposed in the literature (e.g., Dissent [17], RAC [5]) but we do not discuss these alternatives as their cost (mainly due to the use of all-to- Most importantly, all these protocols, including TOR (see Section VIII) are not resilient to re-identification attacks [6], [7]. These attacks work as follows: assuming a set of user profiles built from user past queries, user re-identification attacks try to link anonymous queries to a profile corresponding to their originating user.…”

“…However, studies have shown that anonymously sending queries to the search engine is not sufficient to actually protect users' privacy [6], [7]. Indeed, a search engine that has prior knowledge about users (e.g., user profiles built from past user queries) can link back a large proportion of anonymous search queries to their originating user by running re-identification attacks.…”

X-search

“…ese approaches generally operate by sending fake queries (also called dummy queries) on behalf of the user. It has been shown [31], however, that the external resources used for generating fake queries (e.g., RSS feeds, dictionaries) makes it possible for search engines to easily distinguish fake from real tra c. Combination of unlinkability and indistinguishability has also been proposed in the literature, yet the only existing solution that we are aware of (PEAS [32]) assumes a weak adversarial model of non-colluding proxy servers. e last category of solutions are those enabling private information retrieval (PIR), e.g., [24,28]).…”

Plausible Deniability in Web Search—From Detection to Assessment

“…The quantity ψ D (w|a k ) in the expression for the PRI estimator, (32), is problematic when the adverts a k on page k do not contain any of the topic keywords in dictionary D i.e. when a k = ∅, indicating there is no detectable evidence of a particular topic.…”

“…The importance of background information in user profiling is explored in [32]. Here a similarity metric measuring distance between known background information about a user, given by query history, and subsequent queries is shown to identify 45.3% of TrackMeNot and 51.6% of GooPIR queries.…”