Abstract:This paper presents a practical side-channel attack that identifies the social web service account of a visitor to an attacker's website. Our attack leverages the widely adopted user-blocking mechanism, abusing its inherent property that certain pages return different web content depending on whether a user is blocked from another user. Our key insight is that an account prepared by an attacker can hold an attacker-controllable binary state of blocking/non-blocking with respect to an arbitrary user on the same service; provided that the user is logged in to the service, this state can be retrieved as one-bit data through the conventional cross-site timing attack when a user visits the attacker's website. We generalize and refer to such a property as visibility control, which we consider as the fundamental assumption of our attack. Building on this primitive, we show that an attacker with a set of controlled accounts can gain a complete and flexible control over the data leaked through the side channel. Using this mechanism, we show that it is possible to design and implement a robust, large-scale user identification attack on a wide variety of social web services. To verify the feasibility of our attack, we perform an extensive empirical study using 16 popular social web services and demonstrate that at least 12 of these are vulnerable to our attack. Vulnerable services include not only popular social networking sites such as Twitter and Facebook, but also other types of web services that provide social features, e.g., eBay and Xbox Live. We also demonstrate that the attack can achieve nearly 100% accuracy and can finish within a sufficiently short time in a practical setting. We discuss the fundamental principles, practical aspects, and limitations of the attack as well as possible defenses.

A Bestiary of Blocking: The Motivations and Modes behind Website Unavailability

Block the blocker: Studying the effects of Anti Ad-blocking

A Longitudinal Analysis of Online Ad-Blocking Blacklists

Blocking JavaScript without Breaking the Web: An Empirical Investigation

From Blocking to Breaking: Evaluating the Impact of Adblockers on Web Usability

Blocking Mechanism of Porn Website in India: Claim and Truth

Understanding the Country-Level Security of Free Content Websites and their Hosting Infrastructure

Legal Regulation Research on Internet Platform Blocking Behavior

The effect of blockability affordance on confrontation against cyberbullying on social networking sites: theoretical and methodological implications

Does Query Blocking Improve Dns Privacy? Quantifying Privacy Under Partial Blocking Deployment

Herding Vulnerable Cats: A Statistical Approach to Disentangle Joint Responsibility for Web Security in Shared Hosting

A Review of the GIC Blocker Placement Problem

Blocked or Broken? Automatically Detecting When Privacy Interventions Break Websites

Where The Light Gets In: Analyzing Web Censorship Mechanisms in India

An Empirical Study on Critical Blocking Bugs.

Somesite I Used To Crawl: Awareness, Agency and Efficacy in Protecting Content Creators From AI Crawlers

Automatically Generating a Large, Culture-Specific Blocklist for China

User Blocking Considered Harmful? An Attacker-controllable Side Channel to Identify Social Accounts

Trajectories of Blocked Community Members: Redemption, Recidivism and Departure

Robust, privacy-preserving, transparent, and auditable on-device blocklisting

Automated Discovery of Internet Censorship by Web Crawling