Towards accurate detection of obfuscated web tracking

Abstract

Web tracking is currently recognized as one of the most important privacy threats on the Internet. Over the last years, many methodologies have been developed to uncover web trackers. Most of them are based on static code analysis and the use of predefined blacklists. However, our main hypothesis is that web tracking has started to use obfuscated programming, a transformation of code that renders previous detection methodologies ineffective and easy to evade. In this paper, we propose a new methodology based on dynamic code analysis that monitors the actual JavaScript calls made by the browser and compares them to the original source code of the website in order to detect obfuscated tracking. The main advantage of this approach is that detection cannot be evaded by code obfuscation. We applied this methodology to detect the use of canvas-font tracking and canvas fingerprinting on the top-10K most visited websites according to Alexa's ranking. Canvas-based tracking is a fingerprinting method based on JavaScript that uses the HTML5 canvas element to uniquely identify a user. Our results show that 10.44% of the top-10K websites use canvas-based tracking (canvas-font and canvas fingerprinting), while obfuscation was used in 2.25% of them. These results confirm our initial hypothesis that obfuscated programming in web tracking is already in use. Finally, we argue that canvas-based tracking can be more present in secondary pages than in the home page of websites.

AdGraph: A Graph-Based Approach to Ad and Tracker Blocking

“…Such approaches fail against adversaries who rotate domains quickly [39], proxy resources through trusted domains (e.g. the first party, CDNs) [20], or restructure or obfuscate JavaScript [51], among other common techniques.…”

Network Measurements for Web Tracking Analysis and Detection: A Tutorial

“…Lastly, in [8], Le et al study the presence of obfuscation within web tracking, and specifically in the canvas fingerprinting method. They found obfuscation to be present, although still not very widely used.…”

URL-based Web Tracking Detection Using Deep Learning

“…IP Address, HTTP headers) or content properties require explicitly to download the content hosted by the URL to perform the inspection, increasing the risk and slowing down the process. Moreover, given that our method does not use code inspection, it is more robust against code minification and obfuscation, which is used by some JavaScript trackers to avoid detection [13].…”

“…The classification is done locally and exclusively based on the properties of the URL string, without the necessity of using any external features or communications. This approach has several advantages: (i) it does not require to download the source files, so malicious resources can be blocked in advance, (ii) it is more robust against the use of minification and code obfuscation techniques [13], (iii) it is more difficult to evade than traditional content-blockers, (iv) it can potentially generalize to new tracking domains, which would be missed by traditional content-blockers based on blacklists, and (v) it is lightweight enough to be included in a browser plugin.…”