Ιδρυματικό Αποθετήριο [SANDBOX]
Πολυτεχνείο Κρήτης
EN  |  EL

Αναζήτηση

Πλοήγηση

Ο Χώρος μου

The seven deadly sins of the HTML5 WebAPI: a large-scale study on the risks of mobile sensor-based attacks

Diamantaris Michalis, Marcantoni Francesco, Ioannidis Sotirios, Polakis Jason

Απλή Εγγραφή


URIhttp://purl.tuc.gr/dl/dias/0F4254BA-DFFD-48B7-8E4C-8E0EE26D8CF8-
Αναγνωριστικόhttps://doi.org/10.1145/3403947-
Αναγνωριστικόhttps://dl.acm.org/doi/10.1145/3403947-
Γλώσσαen-
Μέγεθος31 pagesen
ΤίτλοςThe seven deadly sins of the HTML5 WebAPI: a large-scale study on the risks of mobile sensor-based attacksen
ΔημιουργόςDiamantaris Michalisen
ΔημιουργόςMarcantoni Francescoen
ΔημιουργόςIoannidis Sotiriosen
ΔημιουργόςSotiriosel
ΔημιουργόςPolakis Jasonen
ΕκδότηςAssociation for Computing Machinery (ACM)en
ΠερίληψηModern smartphone sensors can be leveraged for providing novel functionality and greatly improving the user experience. However, sensor data can be misused by privacy-invasive or malicious entities. Additionally, a wide range of other attacks that use mobile sensor data have been demonstrated; while those attacks have typically relied on users installing malicious apps, browsers have eliminated that constraint with the deployment of HTML5 WebAPI. In this article, we conduct a comprehensive evaluation of the multifaceted threat that mobile web browsing poses to users by conducting a large-scale study of mobile-specific HTML5 WebAPI calls across more than 183K of the most popular websites. We build a novel testing infrastructure consisting of actual smartphones on top of a dynamic Android app analysis framework, allowing us to conduct an end-to-end exploration. In detail, our system intercepts and tracks data access in real time, from the WebAPI JavaScript calls down to the Android system calls. Our study reveals the extent to which websites are actively leveraging the WebAPI for collecting sensor data, with 2.89% of websites accessing at least one sensor. To provide a comprehensive assessment of the risks of this emerging practice, we create a taxonomy of sensor-based attacks from prior studies and present an in-depth analysis by framing our collected data within that taxonomy. We find that 1.63% of websites can carry out at least one attack and emphasize the need for a standardized policy across all browsers and the ability for users to control what sensor data each website can access.en
ΤύποςPeer-Reviewed Journal Publicationen
ΤύποςΔημοσίευση σε Περιοδικό με Κριτέςel
Άδεια Χρήσηςhttp://creativecommons.org/licenses/by/4.0/en
Ημερομηνία2021-06-01-
Ημερομηνία Δημοσίευσης2020-
Θεματική ΚατηγορίαAndroiden
Θεματική Κατηγορία Mobile HTML5en
Θεματική ΚατηγορίαWebAPIen
Θεματική ΚατηγορίαMobile sensorsen
Θεματική ΚατηγορίαSensor attack taxonomyen
Θεματική ΚατηγορίαBrowser guidelinesen
Βιβλιογραφική ΑναφοράM. Diamantaris, F. Marcantoni, S. Ioannidis, and J. Polakis, “The seven deadly sins of the HTML5 WebAPI: a large-scale study on the risks of mobile sensor-based attacks,” ACM Trans. Priv. Secur., vol. 23, no. 4, pp. 1–31, Aug. 2020. doi: 10.1145/3403947en

Υπηρεσίες

Στατιστικά