Proceedings of the 16th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, 2019
Online advertisements and third-party web tracking has gained much attention in recent years. Adv... more Online advertisements and third-party web tracking has gained much attention in recent years. Advertisers gather as much data and information about the users to provide targeted advertisement. Though this leads to a better user experience, it comes at the cost of privacy intrusive tracking. To this end, ad-blocking lists (or filter-lists, blacklists) have been introduced which prevent third-party tracking. Ad-blocking lists operate in a crowd-sourced manner, where new tracking domains (or rules) are continuously added by privacy activists and the redundant domains are discarded from the filter-list. Over time, the number of rules added outgrow the number of rules omitted, making it hard to manage the filter-lists. We empirically observe that the filter-lists mostly detect different ad and tracking domains. The filter-lists also use less than 1% of their rules on Alexa top 5,000 websites. This suggests the need to curate optimized filter-lists that provide high coverage and require less time to scan for a given domain on mobile devices. We develop an aggregated and filtered blacklist that is more than 150 times less bulky, and provides the same coverage as the union of the blacklists on Alexa top 5,000 websites. We also develop an update mechanism to incorporate new ad and tracking domains in the aggregated and filtered blacklist in a resource efficient manner.
2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), 2019
Websites employ third-party ads and tracking services leveraging cookies and JavaScript code, to ... more Websites employ third-party ads and tracking services leveraging cookies and JavaScript code, to deliver ads and track users' behavior, causing privacy concerns. To limit online tracking and block advertisements, several ad-blocking (black) lists have been curated consisting of URLs and domains of well-known ads and tracking services. Using Internet Archive's Wayback Machine in this paper, we collect a retrospective view of the Web to analyze the evolution of ads and tracking services and evaluate the effectiveness of ad-blocking blacklists. We propose metrics to capture the efficacy of ad-blocking blacklists to investigate whether these blacklists have been reactive or proactive in tackling the online ad and tracking services. We introduce a stability metric to measure the temporal changes in ads and tracking domains blocked by ad-blocking blacklists and a diversity metric to measure the ratio of new ads and tracking domains detected. We observe that ads and tracking domains in websites change over time, and among the ad-blocking blacklists that we investigated, our analysis reveals that some blacklists were more informed with the existence of ads and tracking domains, but their rate of change was slower than other blacklists. Our analysis also shows that Alexa top 5K websites in the US, Canada, and the UK have the most number of ads and tracking domains per website, and have the highest proactive scores. This suggests that ad-blocking blacklists are updated by prioritizing ads and tracking domains reported in the popular websites from these countries.
Security and privacy of users have become significant concerns due to the involvement of the Inte... more Security and privacy of users have become significant concerns due to the involvement of the Internet of Things (IoT) devices in numerous applications. Cyber threats are growing at an explosive pace making the existing security and privacy measures inadequate. Hence, everyone on the Internet is a product for hackers. Consequently, Machine Learning (ML) algorithms are used to produce accurate outputs from large complex databases, where the generated outputs can be used to predict and detect vulnerabilities in IoT-based systems. Furthermore, Blockchain (BC) techniques are becoming popular in modern IoT applications to solve security and privacy issues. Several studies have been conducted on either ML algorithms or BC techniques. However, these studies target either security or privacy issues using ML algorithms or BC techniques, thus posing a need for a combined survey on efforts made in recent years addressing both security and privacy issues using ML algorithms and BC techniques. In...
Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, 2022
Contemporary mobile applications (apps) are designed to track, use, and share users' data, often ... more Contemporary mobile applications (apps) are designed to track, use, and share users' data, often without their consent, which results in potential privacy and transparency issues. To investigate whether mobile apps have always been (non-)transparent regarding how they collect information about users, we perform a longitudinal analysis of the historical versions of 268 Android apps. These apps comprise 5,240 app releases or versions between 2008 and 2016. We detect inconsistencies between apps' behaviors and the stated use of data collection in privacy policies to reveal compliance issues. We utilize machine learning techniques for the classification of the privacy policy text to identify the purported practices that collect and/or share users' personal information, such as phone numbers and email addresses. We then uncover the data leaks of an app through static and dynamic analysis. Over time, our results show a steady increase in the number of apps' data collection practices that are undisclosed in the privacy policies. This behavior is particularly troubling since privacy policy is the primary tool for describing the app's privacy protection practices. We find that newer versions of the apps are likely to be more non-compliant than their preceding versions. The discrepancies between the purported and the actual data practices show that privacy policies are often incoherent with the apps' behaviors, thus defying the 'notice and choice' principle when users install apps.
Proceedings of the 16th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, 2019
Online advertisements and third-party web tracking has gained much attention in recent years. Adv... more Online advertisements and third-party web tracking has gained much attention in recent years. Advertisers gather as much data and information about the users to provide targeted advertisement. Though this leads to a better user experience, it comes at the cost of privacy intrusive tracking. To this end, ad-blocking lists (or filter-lists, blacklists) have been introduced which prevent third-party tracking. Ad-blocking lists operate in a crowd-sourced manner, where new tracking domains (or rules) are continuously added by privacy activists and the redundant domains are discarded from the filter-list. Over time, the number of rules added outgrow the number of rules omitted, making it hard to manage the filter-lists. We empirically observe that the filter-lists mostly detect different ad and tracking domains. The filter-lists also use less than 1% of their rules on Alexa top 5,000 websites. This suggests the need to curate optimized filter-lists that provide high coverage and require less time to scan for a given domain on mobile devices. We develop an aggregated and filtered blacklist that is more than 150 times less bulky, and provides the same coverage as the union of the blacklists on Alexa top 5,000 websites. We also develop an update mechanism to incorporate new ad and tracking domains in the aggregated and filtered blacklist in a resource efficient manner.
2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), 2019
Websites employ third-party ads and tracking services leveraging cookies and JavaScript code, to ... more Websites employ third-party ads and tracking services leveraging cookies and JavaScript code, to deliver ads and track users' behavior, causing privacy concerns. To limit online tracking and block advertisements, several ad-blocking (black) lists have been curated consisting of URLs and domains of well-known ads and tracking services. Using Internet Archive's Wayback Machine in this paper, we collect a retrospective view of the Web to analyze the evolution of ads and tracking services and evaluate the effectiveness of ad-blocking blacklists. We propose metrics to capture the efficacy of ad-blocking blacklists to investigate whether these blacklists have been reactive or proactive in tackling the online ad and tracking services. We introduce a stability metric to measure the temporal changes in ads and tracking domains blocked by ad-blocking blacklists and a diversity metric to measure the ratio of new ads and tracking domains detected. We observe that ads and tracking domains in websites change over time, and among the ad-blocking blacklists that we investigated, our analysis reveals that some blacklists were more informed with the existence of ads and tracking domains, but their rate of change was slower than other blacklists. Our analysis also shows that Alexa top 5K websites in the US, Canada, and the UK have the most number of ads and tracking domains per website, and have the highest proactive scores. This suggests that ad-blocking blacklists are updated by prioritizing ads and tracking domains reported in the popular websites from these countries.
Security and privacy of users have become significant concerns due to the involvement of the Inte... more Security and privacy of users have become significant concerns due to the involvement of the Internet of Things (IoT) devices in numerous applications. Cyber threats are growing at an explosive pace making the existing security and privacy measures inadequate. Hence, everyone on the Internet is a product for hackers. Consequently, Machine Learning (ML) algorithms are used to produce accurate outputs from large complex databases, where the generated outputs can be used to predict and detect vulnerabilities in IoT-based systems. Furthermore, Blockchain (BC) techniques are becoming popular in modern IoT applications to solve security and privacy issues. Several studies have been conducted on either ML algorithms or BC techniques. However, these studies target either security or privacy issues using ML algorithms or BC techniques, thus posing a need for a combined survey on efforts made in recent years addressing both security and privacy issues using ML algorithms and BC techniques. In...
Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, 2022
Contemporary mobile applications (apps) are designed to track, use, and share users' data, often ... more Contemporary mobile applications (apps) are designed to track, use, and share users' data, often without their consent, which results in potential privacy and transparency issues. To investigate whether mobile apps have always been (non-)transparent regarding how they collect information about users, we perform a longitudinal analysis of the historical versions of 268 Android apps. These apps comprise 5,240 app releases or versions between 2008 and 2016. We detect inconsistencies between apps' behaviors and the stated use of data collection in privacy policies to reveal compliance issues. We utilize machine learning techniques for the classification of the privacy policy text to identify the purported practices that collect and/or share users' personal information, such as phone numbers and email addresses. We then uncover the data leaks of an app through static and dynamic analysis. Over time, our results show a steady increase in the number of apps' data collection practices that are undisclosed in the privacy policies. This behavior is particularly troubling since privacy policy is the primary tool for describing the app's privacy protection practices. We find that newer versions of the apps are likely to be more non-compliant than their preceding versions. The discrepancies between the purported and the actual data practices show that privacy policies are often incoherent with the apps' behaviors, thus defying the 'notice and choice' principle when users install apps.
Uploads
Papers by Saad Hashmi