Author: alphacodic

A New Attack Can Unmask Anonymous Users on Any Major Browser

EVERYONE FROM ADVERTISERS and marketers to government-backed hackers and spyware makers wants to identify and track users across the web. And while a staggering amount of infrastructure is already in place to do exactly that, the appetite for data and new tools to collect it has proved insatiable. With that reality in mind, researchers from the New Jersey Institute of Technology are warning this week about a novel technique attackers could use to de-anonymize website visitors and potentially connect the dots on many components of targets’ digital lives.

The findings, which NJIT researchers will present at the Usenix Security Symposium in Boston next month, show how an attacker who tricks someone into loading a malicious website can determine whether that visitor controls a particular public identifier, like an email address or social media account, thus linking the visitor to a piece of potentially personal data. 

When you visit a website, the page can capture your IP address, but this doesn’t necessarily give the site owner enough information to individually identify you. Instead, the hack analyzes subtle features of a potential target’s browser activity to determine whether they are logged into an account for an array of services, from YouTube and Dropbox to Twitter, Facebook, TikTok, and more. Plus the attacks work against every major browser, including the anonymity-focused Tor Browser.

“If you’re an average internet user, you may not think too much about your privacy when you visit a random website,” says Reza Curtmola, one of the study authors and a computer science professor at NJIT. “But there are certain categories of internet users who may be more significantly impacted by this, like people who organize and participate in political protest, journalists, and people who network with fellow members of their minority group. And what makes these types of attacks dangerous is they’re very stealthy. You just visit the website and you have no idea that you’ve been exposed.”

The risk that government-backed hackers and cyber-arms dealers will attempt to de-anonymize web users isn’t just theoretical. Researchers have documented a number of techniques used in the wild and have witnessed situations in which attackers identified individual users, though it wasn’t clear how.

Other theoretical work has looked at an attack similar to the one NJIT researchers developed, but much of this past investigation has focused on grabbing revealing data that’s leaked between websites when one service makes a request to another. As a result of this prior work, browsers and website developers have improved how data is isolated and restricted when content loads, making these potential attack paths less feasible. Knowing that attackers are motivated to seek out techniques for identifying users, though, the researchers wanted to explore additional approaches.

“Let’s say you have a forum for underground extremists or activists, and a law enforcement agency has covertly taken control of it,” Curtmola says. “They want to identify the users of this forum but can’t do this directly because the users use pseudonyms. But let’s say that the agency was able to also gather a list of Facebook accounts who are suspected to be users of this forum. They would now be able to correlate whoever visits the forum with a specific Facebook identity.”

How this de-anonymization attack works is difficult to explain but relatively easy to grasp once you have the gist. Someone carrying out the attack needs a few things to get started: a website they control, a list of accounts tied to people they want to identify as having visited that site, and content posted to the platforms of the accounts on their target list that either allows the targeted accounts to view that content or blocks them from viewing it—the attack works both ways. 

Next, the attacker embeds the aforementioned content on the malicious website. Then they wait to see who clicks. If anyone on the targeted list visits the site, the attackers will know who they are by analyzing which users can (or cannot) view the embedded content.

The attack takes advantage of a number of factors most people likely take for granted: Many major services—from YouTube to Dropbox—allow users to host media and embed it on a third-party website. Regular users typically have an account with these ubiquitous services and, crucially, they often stay logged into these platforms on their phones or computers. Finally, these services allow users to restrict access to content uploaded to them. For example, you can set your Dropbox account to privately share a video with one or a handful of other users. Or you can upload a video to Facebook publicly but block certain accounts from viewing it. 

These “block” or “allow” relationships are the crux of how the researchers found that they can reveal identities. In the “allow” version of the attack, for instance, hackers might quietly share a photo on Google Drive with a Gmail address of potential interest. Then they embed the photo on their malicious web page and lure the target there. When visitors’ browsers attempt to load the photo via Google Drive, the attackers can accurately infer whether a visitor is allowed to access the content—aka, whether they have control of the email address in question. 

Thanks to the major platforms’ existing privacy protections, the attacker can’t check directly whether the site visitor was able to load the content. But the NJIT researchers realized they could analyze accessible information about the target’s browser and the behavior of their processor as the request is happening to make an inference about whether the content request was allowed or denied.

Cloud Hosting Growing Faster Ever

Want to know the one thing that every successful digital marketer does first to ensure they get the biggest return on their marketing budget? It’s simple: goal-setting. This is an absolutely essential practice for any digital marketer who knows how to execute their campaigns in a productive, cost-effective way. With a few. With a few simple tips, you can be doing the same in no time! In this blog, we’ll walk you through the first steps every savvy digital marketer takes to ensure that they’re on target to hit all their marketing objectives. Get ready for revenue! 

Remember: even if the channel you’re considering is all the rage right now, it might not fit your brand. Always make informed decisions that directly relate to your company. Otherwise, your message won’t be delivered to its intended audience and you’ll have wasted time, effort and money.

Know Your Digital Goals

The first step is clearly identifying which goals you want to achieve. Get specific. Do you want to increase brand awareness? Are you all about locking in leads? Do you want to establish a strong network of influencers that can help you be discovered? How about pushing engagement on social media?

Get Specific

A useful tool for narrowing down your goals to ensure they’re viable is the SMART mnemonic. It’s important to get specific to understand exactly what you’re working towards, and help you break down the process of hitting your targets. This is exactly what this mnemonic helps you to achieve.

• Does the channel reach my intended audience?
• Is the channel sustainable and affordable within my company’s marketing budget?
• Will I be able to measure the success of the channel?
• Does the channel allow me to express my brand’s intended message?
• Do the channels I’m considering work together to convey my message?

Always Remember Your Goals!

Establishing a solid vision for your business is the first step to planning your digital marketing budget. Always keep your final goals in sight when organising anything for your company. When deciding which steps to take next in your business, ask yourself how they will help you achieve the goals you outlined in Step #1. This will ensure that you stay on track and prevent you from spending your budget on anything that won’t help you achieve.

Cum et essent similique. Inani propriae menandri sed in. Pericula expetendis has no,
quo populo forensibus contentiones et, nibh error in per.

Denis Robinson

As your budget progresses and evolves, continue referring to your SMART objectives. Stay focused and remember your goals – they will always inform what your next step will be!