id,collection,Type de document,DOI,Titre,Titre en anglais,Auteur(s),Éditeur(s) ou directeur(s) scientifique,Directeur(s) de thèse,Titre de la manifestation scientifique,Ville,Pays,Date de début de la manifestation scientifique,Titre de l'ouvrage,Titre de la revue,Éditeur,Date de publication,Date de soutenance,Organisme de délivrance,Mot(s)-clé(s),Mot(s)-clé(s) en anglais,Discipline(s) HAL,Résumé,Résumé en anglais,Langue,Article revu par les pairs,Audience,Vulgarisation,Projet ANR
"1a6211f6-b4fe-4491-a47a-780bee2048db","20.500.12210/28","Communication dans un congrès avec actes",,"FP-TESTER: Automated Testing of Browser Fingerprint Resilience",,"Vastel, Antoine||Rudametkin, Walter||Rouvoy, Romain",,,"IWPE 2018 - 4th International Workshop on Privacy Engineering","London","Royaume-Uni","2018-04-27",,"Proceedings of the 4th International Workshop on Privacy Engineering (IWPE'18)",,"2018-04-27",,,,,"Informatique [cs]/Système d'exploitation [cs.OS]||Informatique [cs]/Web||Informatique [cs]/Génie logiciel [cs.SE]",,"Despite recent regulations and growing user awareness , undesired browser tracking is increasing. In addition to cookies, browser fingerprinting is a stateless technique that exploits a device's configuration for tracking purposes. In particular , browser fingerprinting builds on attributes made available from Javascript and HTTP headers to create a unique and stable fingerprint. For example, browser plugins have been heavily exploited by state-of-the-art browser fingerprinters as a rich source of entropy. However, as browser vendors abandon plugins in favor of extensions, fingerprinters will adapt. We present FP-TESTER, an approach to automatically test the effectiveness of browser fingerprinting countermeasure extensions. We implement a testing toolkit to be used by developers to reduce browser fingerprintability. While countermeasures aim to hinder tracking by changing or blocking attributes, they may easily introduce subtle side-effects that make browsers more identifiable , rendering the extensions counterproductive. FP-TESTER reports on the side-effects introduced by the countermeasure, as well as how they impact tracking duration from a fingerprinter's point-of-view. To the best of our knowledge, FP-TESTER is the first tool to assist developers in fighting browser fingerprinting and reducing the exposure of end-users to such privacy leaks.","Anglais","Oui","Internationale","Non",
"0e73f4c8-8ba6-47dc-acbb-18a70416280e","20.500.12210/28","Communication dans un congrès avec actes","10.14722/ndss.2020.23xxx","FP-Crawlers: Studying the Resilience of Browser Fingerprinting to Block Crawlers",,"Vastel, Antoine||Rudametkin, Walter||Rouvoy, Romain||Blanc, Xavier","Oleksii Starov||Alexandros Kapravelos||Nick Nikiforakis",,"MADWeb'20 - NDSS Workshop on Measurements, Attacks, and Defenses for the Web","San Diego","Etats-Unis d'Amérique","2020-02-23",,,,,,,,"Detection of bots||browser fingerprinting","Informatique [cs]/Cryptographie et sécurité [cs.CR]||Informatique [cs]/Web",,"Data available on the Web, such as financial data or public reviews, provides a competitive advantage to companies able to exploit them. Web crawlers, a category of bot, aim at automating the collection of publicly available Web data. While some crawlers collect data with the agreement of the websites being crawled, most crawlers do not respect the terms of service. CAPTCHAs and approaches based on analyzing series of HTTP requests classify users as humans or bots. However, these approaches require either user interaction or a significant volume of data before they can classify the traffic.In this paper, we study browser fingerprinting as a crawler detection mechanism. We crawled the Alexa top 10K and identified 291 websites that block crawlers. We show that fingerprinting is used by 93 (31.96%) of them and we report on the crawler detection techniques implemented by the major fingerprinters. Finally, we evaluate the resilience of fingerprinting against crawlers trying to conceal themselves. We show that although fingerprinting is good at detecting crawlers, it can be bypassed with little effort by an adversary with knowledge on the fingerprints collected.","Anglais","Oui","Internationale","Non","FP-Locker : Renforcer l'authentification web grâce aux empreintes de navigateur||Comprendre et diagnostiquer les dégradations des communications de bout en bout dans l'Internet"
"4e16ea4c-0055-4910-a1b9-5d3af5bc8306","20.500.12210/28","Communication dans un congrès avec actes","10.1109/SP.2018.00008","FP-STALKER: Tracking Browser Fingerprint Evolutions",,"Vastel, Antoine||Laperdrix, Pierre||Rudametkin, Walter||Rouvoy, Romain","Bryan Parno||Christopher Kruegel",,"IEEE S&P 2018 - 39th IEEE Symposium on Security and Privacy","San Francisco","Etats-Unis d'Amérique","2018-05-21",,"Proceedings of the 39th IEEE Symposium on Security and Privacy (S&P)","IEEE",,,,,"user tracking||random forests||browser fingerprinting","Informatique [cs]/Web||Informatique [cs]/Génie logiciel [cs.SE]||Informatique [cs]/Cryptographie et sécurité [cs.CR]||Informatique [cs]/Apprentissage [cs.LG]",,"Browser fingerprinting has emerged as a technique to track users without their consent. Unlike cookies, fingerprinting is a stateless technique that does not store any information on devices, but instead exploits unique combinations of attributes handed over freely by browsers. The uniqueness of fingerprints allows them to be used for identification. However, browser fingerprints change over time and the effectiveness of tracking users over longer durations has not been properly addressed. In this paper, we show that browser fingerprints tend to change frequently—from every few hours to days—due to, for example, software updates or configuration changes. Yet, despite these frequent changes, we show that browser fingerprints can still be linked, thus enabling long-term tracking. FP-STALKER is an approach to link browser fingerprint evolutions. It compares fingerprints to determine if they originate from the same browser. We created two variants of FP-STALKER, a rule-based variant that is faster, and a hybrid variant that exploits machine learning to boost accuracy. To evaluate FP-STALKER, we conduct an empirical study using 98,598 fingerprints we collected from 1,905 distinct browser instances. We compare our algorithm with the state of the art and show that, on average, we can track browsers for 54.48 days, and 26 % of browsers can be tracked for more than 100 days.","Anglais","Oui","Internationale","Non",
"23ff15c5-6a54-43a0-b7a3-b2444b612981","20.500.12210/28","Communication dans un congrès avec actes","10.14722/madweb.2024.23035","Free Proxies Unmasked: A Vulnerability and Longitudinal Analysis of Free Proxy Services",,"Mehanna, Naif||Rudametkin, Walter||Laperdrix, Pierre||Vastel, Antoine",,,"MADWeb 2024 - Workshop on Measurements, Attacks, and Defenses for the Web","San Diego (CA)","Etats-Unis d'Amérique","2024-02-23","Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb'24)",,,"2024",,,,"Free Proxies||Web security||Vulnerabilities||Web Proxies","Informatique [cs]/Cryptographie et sécurité [cs.CR]",,"Free-proxies have been widespread since the early days of the Web, helping users bypass geo-blocked content and conceal their IP addresses. Various proxy providers promise faster Internet or increased privacy while advertising their lists comprised of hundreds of readily available free proxies. However, while paid proxy services advertise the support of encrypted connections and high stability, free proxies often lack such guarantees, making them prone to malicious activities such as eavesdropping or modifying content. Furthermore, there’s a market that encourages exploiting devices to install proxies.In this paper, we present a 30-month longitudinal study analyzing the stability, security, and potential manipulation of free web proxies that we collected from 11 providers. Our collection resulted in over 640, 600 proxies, that we cumulatively tested daily. We find that only 34.5% of proxies were active at least once during our tests, showcasing the general instability of free proxies. Geographically, a majority of proxies originate from the US and China. Leveraging the Shodan search engine, we identified 4, 452 distinct vulnerabilities on the proxies’ IP addresses, including 1, 755 vulnerabilities that allow unauthorized remote code execution and 2, 036 that enable privilege escalation on the host device. Through the software analysis on the proxies’ IP addresses, we find that 42, 206 of them appear to run on MikroTik routers. Worryingly, we also discovered 16, 923 proxies that manipulate content, indicating potential malicious intent by proxy owners. Ultimately, our research reveals that the use of free web proxies poses significant risks to users’ privacy and security. The instability, vulnerabilities, and potential for malicious actions uncovered in our analysis lead us to strongly caution users against relying on free proxies.","Anglais","Oui","Internationale","Non","Fingerprinting et exploration des attaques et défenses sur CPU depuis des scripts web||FP-Locker : Renforcer l'authentification web grâce aux empreintes de navigateur"
"843e9c71-fbcc-40c4-880b-575a93202dc9","20.500.12210/28","Communication dans un congrès avec actes","10.1145/3366423.3380161","Don’t count me out: On the relevance of IP addresses in the tracking ecosystem",,"Mishra, Vikas||Laperdrix, Pierre||Vastel, Antoine||Rudametkin, Walter||Rouvoy, Romain||Lopatka, Martin","Bruno Crispo||Nick Nikiforakis",,"The Web Conference 2020","Tapeï","Taïwan","2020-04-20",,"Proceedings of The Web Conference (WWW'20)",,"2020-04-20",,,,"Online tracking||Privacy||IP Address tracking","Informatique [cs]/Web",,"Targeted online advertising has become an inextricable part of the way Web content and applications are monetized. At the beginning, online advertising consisted of simple ad-banners broadly shown to website visitors. Over time, it evolved into a complex ecosystem that tracks and collects a wealth of data to learn user habits and show targeted and personalized ads. To protect users against tracking, several countermeasures have been proposed, ranging from browser extensions that leverage filter lists, to features natively integrated into popular browsers like Firefox and Brave to combat more modern techniques like browser fingerprinting. Nevertheless, few browsers offer protections against IP address-based tracking techniques. Notably, the most popular browsers, Chrome, Firefox, Safari and Edge do not offer any.In this paper, we study the stability of the public IP addresses a user device uses to communicate with our server. Over time, a same device communicates with our server using a set of distinct IP addresses, but we find that devices reuse some of their previous IP addresses for long periods of time. We call this IP address retention and, the duration for which an IP address is retained by a device, is named theIP address retention period.We present an analysis of 34,488 unique public IP addresses collected from 2,230 users over a period of 111 days and we show that IP addresses remain a prime vector for online tracking. 87 % of participants retain at least one IP address for more than a month and 45 % of ISPs in our dataset allow keeping the same IP address for more than 30 days. Furthermore, we also detect the presence of cycles of IP addresses in a user’s history and highlight their potential to be abused to infer traits of the user behaviour, as well as mobility traces. Our findings paint a bleak picture of the current state of online tracking at a time where IP addresses are overlooked compared to other techniques like cookies or fingerprinting.","Anglais","Oui","Internationale","Non","Comprendre et diagnostiquer les dégradations des communications de bout en bout dans l'Internet||FP-Locker : Renforcer l'authentification web grâce aux empreintes de navigateur"
"ce244d7f-c619-4d3e-b673-c879d65b3d70","20.500.12210/28","Communication dans un congrès avec actes",,"FP-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies",,"Vastel, Antoine||Laperdrix, Pierre||Rudametkin, Walter||Rouvoy, Romain",,,"Proceedings of the 27th USENIX Security Symposium","Baltimore","Etats-Unis d'Amérique","2018-08-15",,,,,,,,"web privacy||browser fingerprinting","Informatique [cs]/Système d'exploitation [cs.OS]||Informatique [cs]/Web||Informatique [cs]/Informatique mobile||Informatique [cs]/Informatique ubiquitaire||Informatique [cs]/Génie logiciel [cs.SE]",,"By exploiting the diversity of device and browser configurations, browser fingerprinting established itself as a viable technique to enable stateless user tracking in production. Companies and academic communities have responded with a wide range of countermeasures. However , the way these countermeasures are evaluated does not properly assess their impact on user privacy, in particular regarding the quantity of information they may indirectly leak by revealing their presence. In this paper, we investigate the current state of the art of browser fingerprinting countermeasures to study the inconsistencies they may introduce in altered fingerprints , and how this may impact user privacy. To do so, we introduce FP-SCANNER as a new test suite that explores browser fingerprint inconsistencies to detect potential alterations, and we show that we are capable of detecting countermeasures from the inconsistencies they introduce. Beyond spotting altered browser fingerprints, we demonstrate that FP-SCANNER can also reveal the original value of altered fingerprint attributes, such as the browser or the operating system. We believe that this result can be exploited by fingerprinters to more accurately target browsers with countermeasures.","Anglais","Oui","Internationale","Non",
"c97fb9a6-aef8-474c-8be3-aca2a1b78b83","20.500.12210/28","Thèse",,"Traçage versus Sécurité : Explorer les Deux Facettes des Empreintes de Navigateurs.","Tracking Versus Security: Investigating the Two Facets of Browser Fingerprinting","Vastel, Antoine",,"Romain Rouvoy||Walter Rudametkin",,,,,,,,,"2019-10-24","Université de Lille Nord de France","Vie privé||sécurité informatique||web||empreintes de navigateurs||traçage||bots informatiques","Privacy and confidentiality||Computer security||web||Browser fingerprinting||tracking||Bot detection","Informatique [cs]||Informatique [cs]/Web","De nos jours, une grande diversité d'appareils tels que des smartphones, des ordinateurs ou des télévisions connectées peuvent naviguer sur le web. Afin d'adapter leur expérience de navigation, les utilisateurs modifient également diverses options telles que l'affichage de la barre des favoris ou leurs langues préférées. Cette diversité d'appareils et de configurations sont à l'origine du suivi par empreintes de navigateurs. En effet, pour gérer cette diversité, les sites web peuvent accéder à des informations relatives à la configuration de l'appareil grâce aux interfaces du langage JavaScript, sans obtenir l'accord préalable de l'utilisateur. La combinaison de ces informations est appelée empreinte de navigateur, et est bien souvent unique, pouvant donc servir à des fins de suivi marketing.Néanmoins, le fait que les empreintes ne soient pas stockées sur la machine rend cette technique également intéressante pour des applications relatives à la sécurité sur le web.A travers cette thèse, je propose 3 contributions relatives aux domaines des empreintes de navigateurs :1. Je collecte 122,000 empreintes de 2,346 navigateurs et analysons leur stabilité pendant plus de 2 ans. Je montre qu'en dépit de changements fréquents dans leur empreinte, une part significative des navigateurs peut être suivie pendant de longues périodes;2. Je conçois une suite de tests afin d'évaluer la résistance des outils de protection contre le suivi par empreinte de navigateurs. Je l'applique à 7 outils de protection, et montre que tous peuvent être détectés, ce qui peut rendre leur utilisateurs plus facilement identifiables, et donc vulnérables au suivi;3.  Enfin, j'explore l'utilisation des empreintes de navigateurs pour la détection de crawlers. Après avoir mesuré l'usage de cette technique sur le web, je présente les différents attributs et tests permettant la détection. Comme les empreintes de navigateurs sont collectées côté client, j'évalue également la résilience de cette forme de détection contre un adversaire développant des crawlers dont les empreintes ont été modifiées.","Nowadays, a wide range of devices can browse the web, ranging from smartphones, desktop computers, to connected TVs. To increase their browsing experience, users also customize settings in their browser, such as displaying the bookmark bar or their preferred languages. Customization and the diversity of devices are at the root of browser fingerprinting. Indeed, to manage this diversity, websites can access attributes about the device using JavaScript APIs, without asking for user consent. The combination of such attributes is called a browser fingerprint and has been shown to be highly unique, making of fingerprinting a suitable tracking technique. Its stateless nature makes it also suitable for enhancing authentication or detecting bots. In this thesis, I report three contributions to the browser fingerprinting field:1. I collect 122K fingerprints from 2,346 browsers and study their stability over more than 2 years. I show that, despite frequent changes in the fingerprints, a significant fraction of browsers can be tracked over a long period of time;2. I design a test suite to evaluate fingerprinting countermeasures. I apply our test suite to 7 countermeasures, some of them claiming to generate consistent fingerprints, and show that all of them can be identified, which can make their users more identifiable;3. I explore the use of browser fingerprinting for crawler detection. I measure its use in the wild, as well as the main detection techniques. Since fingerprints are collected on the client-side, I also evaluate its resilience against an adversarial crawler developer that tries to modify its crawler fingerprints to bypass security checks.","Anglais",,,,
