1. This work was supported by the TRUST Center (NSF award number CCF-0424422) Methods Data Collection: 1. Start Sever on the host OS: This creates a sanitized VM guest environment 2. Start Client on the guest OS: This creates a Firefox instance at site 'x' (See Image 1) 3. Browse the web making 10 clicks on the same domain to simulate a user session. 4. Exit the browser: This will automatically do the data collection, and prompt the user to send the data to the server or “punt”(restart at domain 'x') 5. Browse next site. Note: The script will restart the VM at the next website on a new Respawning: Analysis of FLASH,HTTP, and HTML5 DATA Mika Ayenson – Worcester Polytechnic Institute, Dietrich Wambach – University of Wyoming Faculty : Professor Chris Hoofnagle, J.D., Mentors : Nathan Good, Ph.D, Ashkan Soltani Abstract Web tracking is an increasingly demonstrated technique that websites are using to determine private and sensitive information about their users. Companies employ a number of techniques to track users in order to place advertisements and measure usage of websites. It is generally agreed that users can avoid this tracking by deleting or blocking cookies. Here, we investigate techniques employed by website owners to track individuals persistently, even where they take privacy- protective steps. Background Flash and HTTP cookies have been the cranking engine behind user tracking. With the introduction of HTML5 local storage data, it has provided further areas of research. The 2009 Flash study similarly analyzed the top 100 websites in order to determine how Flash and Http cookies were being used. 54 of the sites set 157 LSOs, and 98 of the sites set 3,602 HTTP cookies[1]. Cookies not only have the power to track a user, but also to respawn previously deleted cookies. The study discovered HTTP cookie's respawning on several websites including about.com, hulu.com, aol.com, and mapquest.com. HTML5 data is very analogous to Flash and HTTP cookies in being able to respawn HTTP cookies or Flash cookies, thus it is just as vital to test if HTML5 is respawning user deleted data. Project Goals The overall goal of this project is to expose the potential threat of user tracking devices deployed by websites, while developing an overall survey on the tracking usage per device. These devices include, HTTP Cookies, FLASH Cookies, and HTML5 local storage data. It is also important to determine if these websites are using these devices to respawn user deleted tracking devices. Results/Outcomes HTTP Seen on all 100 websites Detected 5,675 7 websites placed more than 150 (wikia.com, 242; legacy.com, 230; foxnews.com, 185; bizrate.com, 175; drudgereport.com, 168; myspace.com, 151; time.com 151) FLASH Seen on 37 websites (decrease from 2009 at 54) Detected 100 Shared values seen between HTML5 HTML5 Seen on 17 websites Detected 60 key/value pairs Shared values seen between FLASH and HTTP Respawning Hulu.com via HTTP and HTML5 -Kissmetrics is using ETags and an array of different tracking mechanisms to create a unique identifier and set it on first-party sites such as hulu.com -This method tracks the user even if she blocks Flash, HTML5, and HTTP cookies. Foxnews.com via FLASH and HTML5 Photo or graphic caption Conclusions/Future Work Over the last couple years, websites have shifted their tracking techniques in comparison to the 2009 Flash study. Fewer websites are using Flash to respawn cookies. In contrast, more websites are setting more HTTP cookies. Due to the spike in HTTP cookies, and the HTML5 tracking technique addition, there is a significant increase in overall cookies being set. This study is evidence that with HTML5 still gaining exposure and popularity, there is a growing threat of tracking users with this new technique. As future work, further exploration in sites not in the top 100 that are focusing on HTML5 development would provide more information on how the power of HTML5 is used. References [1] Soltani, Ashkan, Canty, Shannon, Mayo, Quentin, Thomas, Lauren and Hoofnagle, Chris Jay, Flash Cookies and Privacy (August 10, 2009). Available at SSRN: http://ssrn.com/abstract=1446862 Acknowledgments I would like to thank TRUST (Team for Research in Ubiquitous Secure Technology) as well as the National Science Foundation for the support throughout this research experience. A special thank you is to Dr. Gates and my advisors Chris Hoofnagle, Nathan Good, and Ashkan Soltani for working with me on this project. Image 1 Image 3 Image 2