The Chain of Implicit Trust: An Analysis of the Web Third-party Resources Loading

Abstract

The Web is a tangled mass of interconnected services, where websites import a range of external resources from various third-party domains. However, the latter can further load resources hosted on other domains. For each website, this creates a dependency chain underpinned by a form of implicit trust between the first-party and transitively connected third-parties. The chain can only be loosely controlled as first-party websites often have little, if any, visibility of where these resources are loaded from. This paper performs a large-scale study of dependency chains in the Web, to find that around 50% of first-party websites render content that they did not directly load. Although the majority (84.91%) of websites have short dependency chains (below 3 levels), we find websites with dependency chains exceeding 30. Using VirusTotal, we show that 1.2% of these third-parties are classified as suspicious -although seemingly small, this limited set of suspicious third-parties have remarkable reach into the wider ecosystem. By running sandboxed experiments, we observe a range of activities with the majority of suspicious JavaScript downloading malware; worryingly, we find this propensity is greater among implicitly trusted JavaScripts.

Beyond the Front Page:Measuring Third Party Dynamics in the Field

“…Third Party Inclusion. Closely related to our approach is the work of Kumar et al [28] and Ikram et al [21]. Both works use a concept of the implicit trust of the embedded third and further parties.…”

“…To do so, we model third party trees (TPTs) for each visited URL (for each landing page and all subpages, respectively), which include all third parties loaded on the visited page. A similar concept was used by Ikram et al [21] and Kumar et al [28] to analyze resource loading dependencies (termed "inclusion chains"). We extend this concept as we visit several sites of a single domain, which enables us to construct a more comprehensive and realistic view of a website's dependencies, and we do not limit ourselves to JavaScript inclusions.…”

K-resolver: Towards Decentralizing Encrypted DNS Resolution

“…All DNS queries generated from within the same web page should be resolved by the same recursor of the parent domain. Rendering a web page often requires the download of several third-party resources, including images, scripts, and style sheets, as observed by previous work [3,9,22,27,35,38,39]. DNS resolutions of these third-party resources can be used as an effective feature to fingerprint web sites.…”

Who Watches the Watchmen: Exploring Complaints on the Web

“…We classify each domain using the Virus-Total API. 2 This API has been used in a wide set of research, and is known to provide good accuracy [28,31,56]. The API provides a classification for each domain in our dataset, e.g., games, education, file sharing, blogs etc.…”