Third-party Trackers Research Articles

Measuring the Security of Indonesian Local Goverment Mobile Apps

Mobile apps are critical in supporting the Indonesian provincial government during daily operations. Regarding their important role, these apps are the potential to become a target of malicious activity to gain access to government information. Hence, in this research, we conduct a security measurement of mobile apps affiliated with the provincial governments in Indonesia, aiming to provide a source of information for the app's developer to make further security improvements. To the best of our knowledge, this is the first study to conduct an empirical analysis related to this area, expecting to become a cornerstone for further research. In total, we found 162 mobile apps available on the Google Play Store and correlated to 31 province governments in Indonesia. We conducted standard mobile apps static analysis method, starting from metadata scraping of each provincial government-affiliated app available at the Google Play Store and measured their security based on several indicators, including access to sensitive permission, unprotected exported components, the adoption of binary protection mechanism, and the appearance of third-party tracker libraries. We found that 27.1% (44) government apps request at least two dangerous permission, over 5% of the apps embed the Advertisement library, 10% of the apps have more than five exported Activities, and 44 (25.94%) Indonesian government apps did not adopt any binary protection mechanism. Hence, these results can be tailored as a reference for the provincial government in determining the level of effectiveness and impact of an app when developing mobile-based software in the future.

How should we present the epidemic curve for COVID-19?

Epidemic curves are used by decision makers and the public to infer the trajectory of the COVID-19 pandemic and to understand the appropriateness of response measures. Symptom onset date is commonly used to date incident cases on the epidemic curve in public health reports and dashboards; however, third-party trackers date cases by the date they were publicly reported by the public health authority. These two curves create very different impressions of epidemic progression. On April 1, 2020, the epidemic curve based on public reporting date for Ontario, Canada showed an accelerating epidemic, whereas the curve based on a proxy variable for symptom onset date showed a rapidly declining epidemic. This illusory downward trend is a feature of epidemic curves anchored using date variables earlier in time than the date a case was publicly reported, such as the symptom onset date. Delays between the onset of symptoms and the detection of a case by the public health authority mean that recent days will always have incomplete case data, creating a downward bias. Public reporting date is not subject to this bias and can be used to visualize real-time epidemic curves meant to inform the public and decision makers.

How should we present the epidemic curve for COVID-19?

Epidemic curves are used by decision makers and the public to infer the trajectory of the COVID-19 pandemic and to understand the appropriateness of response measures. Symptom onset date is commonly used to date incident cases on the epidemic curve in public health reports and dashboards; however, third-party trackers date cases by the date they were publicly reported by the public health authority. These two curves create very different impressions of epidemic progression. On April 1, 2020, the epidemic curve based on public reporting date for Ontario, Canada showed an accelerating epidemic, whereas the curve based on a proxy variable for symptom onset date showed a rapidly declining epidemic. This illusory downward trend is a feature of epidemic curves anchored using date variables earlier in time than the date a case was publicly reported, such as the symptom onset date. Delays between the onset of symptoms and the detection of a case by the public health authority mean that recent days will always have incomplete case data, creating a downward bias. Public reporting date is not subject to this bias and can be used to visualize real-time epidemic curves meant to inform the public and decision makers.

Tracking the Trackers: A Large-Scale Analysis of Embedded Web Trackers

We perform a large-scale analysis of third-party trackers on the World Wide Web. We extract third-party embeddings from more than 3.5 billion web pages of the CommonCrawl 2012 corpus, and aggregate those to a dataset representing more than 41 million domains. With that, we study global online tracking on two levels: (1) On a global level, we give a precise figure for the extent of tracking, and analyse which trackers (and subsequently, which companies) are used by how many websites. (2) On a country-specific level, we analyse which trackers are used by websites in different countries, and identify the countries in which websites choose significantly different trackers than in the rest of the world. We find that trackers are widespread (as expected), and that very few trackers dominate the web (Google, Facebook and Twitter), except for a few countries such as China and Russia.

Aiding and Abetting: Third-Party Tracking and (In)secure Connections in Public Libraries

ABSTRACT Patron privacy, as articulated in the American Library Association (ALA) Code of Ethics, is a longstanding concern for librarians. In online environments, the possibility of tracking by third parties, usage of HTTPS/TLS to provide secure connections, and easy disclosure of a site’s privacy policies all have implications for user privacy. This paper presents new empirical evidence about these issues and discusses their ethical implications. Data about the incidence of third-party tracking, usage of HTTPS by default, and easy discoverability of a privacy policy or terms of service (TOS) were collected for public libraries across Canada and the United States. The sample consisted of 178 public libraries; members of the Canadian Urban Libraries Council and Urban Libraries Council. Several common commercial databases (e.g. OverDrive) were also examined using the same criteria. Results show that only 12% of libraries were devoid of third-party tracking, with Google Analytics being the most common third-party tracker. While libraries may support HTTPS under certain circumstances, it was found that a majority of libraries serve neither their websites nor their online catalogs (OPACs) HTTPS by default. Regarding disclosure of possible tracking, it was found that 58% of libraries did not link to a TOS or privacy policy from their homepage. Together with previous research on the usage of privacy-enhancing tools in public libraries, these results suggest that public libraries are accessories to third-party tracking on a large scale. Implications of this fact in light of library professional ethics are discussed.

Notified But Unaware: Third-Party Tracking Online

Drawing from conceptual studies on transparency, particularly with regard to market complexity, user literacy and resignation, this article studies and analyzes the practices of third-party data collection online. Empirically, we map third-party trackers on a sample of Swedish websites in five sectors (media, retail, banking/insurance, public sector, and health), and the trackers are compared to lists of known trackers to determine their main purpose. These results are then used in digital focus groups divided into high-trust and low-trust individuals, to better understand how everyday consumers perceive and cope with the tracking infrastructure. The main results indicate that third-party tracking is omnipresent online, particularly for media and retail sites, showing that data-driven markets depend on the collection, sharing and trade of consumers’ personal data. Furthermore, despite regulatory provisions promoting clearer notifications and designs within the EU, many users are still highly unaware of the data collection practices and their underlying purposes. The results indicate a weak consent base for data collection and a market structure and data collecting practices that are highly non-transparent. We recommend more active supervisory authorities, and more stringent requirements primarily in relation to the obscure ad tech infrastructures to improve transparency and promote consumer awareness.

A Multi-Tier Security Analysis of Official Car Management Apps for Android

Using automotive smartphone applications (apps) provided by car manufacturers may offer numerous advantages to the vehicle owner, including improved safety, fuel efficiency, anytime monitoring of vehicle data, and timely over-the-air delivery of software updates. On the other hand, the continuous tracking of the vehicle data by such apps may also pose a risk to the car owner, if, say, sensitive pieces of information are leaked to third parties or the app is vulnerable to attacks. This work contributes the first to our knowledge full-fledged security assessment of all the official single-vehicle management apps offered by major car manufacturers who operate in Europe. The apps are scrutinised statically with the purpose of not only identifying surfeits, say, in terms of the permissions requested, but also from a vulnerability assessment viewpoint. On top of that, we run each app to identify possible weak security practices in the owner-to-app registration process. The results reveal a multitude of issues, ranging from an over-claim of sensitive permissions and the use of possibly privacy-invasive API calls, to numerous potentially exploitable CWE and CVE-identified weaknesses and vulnerabilities, the, in some cases, excessive employment of third-party trackers, and a number of other flaws related to the use of third-party software libraries, unsanitised input, and weak user password policies, to mention just a few.

Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels

Abstract Web tracking has been extensively studied over the last decade. To detect tracking, previous studies and user tools rely on filter lists. However, it has been shown that filter lists miss trackers. In this paper, we propose an alternative method to detect trackers inspired by analyzing behavior of invisible pixels. By crawling 84,658 webpages from 8,744 domains, we detect that third-party invisible pixels are widely deployed: they are present on more than 94.51% of domains and constitute 35.66% of all third-party images. We propose a fine-grained behavioral classification of tracking based on the analysis of invisible pixels. We use this classification to detect new categories of tracking and uncover new collaborations between domains on the full dataset of 4, 216, 454 third-party requests. We demonstrate that two popular methods to detect tracking, based on EasyList&EasyPrivacy and on Disconnect lists respectively miss 25.22% and 30.34% of the trackers that we detect. Moreover, we find that if we combine all three lists, 379, 245 requests originated from 8,744 domains still track users on 68.70% of websites.

Privacy Policies Caught Between the Legal and the Ethical: European Media and Third Party Trackers Before and After GDPR.

This contribution analyses the use of third-party trackers by European countries media before and after the introduction of the EU’s General Data Protection Regulation (hereafter: GDPR) as an inroad to discuss the legal versus ethical obligations of media with regards to audiences’ privacy and the impact on the key value of trust in media. In force since 25 May 2018, GDPR provides extended rights to users to protect personal information. The legislation deals with third-party servers (represented by URLs) that play a role in compiling a webpage presented to the user. We focus on third-party servers that track, collect and analyse user behaviour. Theoretically, the paper starts from the idea that legal discussions of and instruments to regulate third-party servers’ impact on privacy do not cover more fundamental ethical questions. Data collection may be lawful but can affect users' lives in unwanted ways and, thus, affect their trust in the service provider, i.e. media. This has two complementary theoretical perspectives: computer ethics (e.g. Moore, 1997; Brey 2005) and (public service) media values (authors, 2017) in the ‘calculated public sphere’ (Harper, 2016). Data result from an extensive and repeated collecting of third party traffic on media-related websites. From a dataset of +32 million recordings of HTTP responses from servers for files like pictures, code or text to +12700 web pages from 1250 websites visited 25 times before and after GDPR, we selected 355 media websites from 38 European countries (#114 from EBU members, #241 from private media). Data were analysed and third-party servers were identified and categorized. The result section, first, discusses various characteristics of third-party trackers before focusing on differences between public service and private media, comparing for EU/EEA versus the rest of Europe. Next, we analyse evolutions over time finding that public service websites are unchanged with regards to third party URLs, while private media show a decrease. Furthermore, GDPR has led to smaller third-parties disappearing to the advantage of the big ones, enhancing concentration of power for access to and collecting of user data. Results are discussed in light of the ethical implications of what may legally be a licensed use of audiences’ data by third-party trackers. We assumed that the more third-party servers involved in a webpage visit, 1) the higher the potential exposure of personal, identifiable information and, thus, 2) the more the ethical aspects of privacy and, ultimately 3) the soft value of trust – crucial to the working of media, especially PSM - are compromised. Finally, it discusses how media policies in the area of privacy and wider individual rights need to go beyond the legal boundaries as set out in legal frameworks such as GDPR.

Measuring Third-party Tracker Power across Web and Mobile

Third-party networks collect vast amounts of data about users via websites and mobile applications. Consolidations among tracker companies can significantly increase their individual tracking capabilities, prompting scrutiny by competition regulators. Traditional measures of market share, based on revenue or sales, fail to represent the tracking capability of a tracker, especially if it spans both web and mobile. This article proposes a new approach to measure the concentration of tracking capability, based on the reach of a tracker on popular websites and apps. Our results reveal that tracker prominence and parent–subsidiary relationships have significant impact on accurately measuring concentration.

Group Behavior Recognition Based on Dictionary and Hierarchical Learning

Group behavior recognition is the task of inferring the collective action of people that have interaction among them in the contextual scenes. The challenge is harder when face with different individual actions. Hierarchical structure model based on deep learning tackles this problem with multi-stages spatio-temporal information modeling. Convolutional neural network (CNN) is designed for extracting the spatial features of scene and person-level. The other component, recurrent neural network (RNN) is aimed to capture temporal feature of the person trajectories in contextual scenes. However, in some prior works, to get the trajectory information in this framework still rely on a third-party tracker that makes the solution not in an end-to-end framework. The exist end-to-end solution incorporates matching strategy in Euclidean space that implicitly tracks the corresponding states as input of RNN unit.In this work, we propose an improved RNN matching strategy by explicitly transform the feature in Euclidean space by distance learning function. Our distance function is based on simple Siamese network with two sub network share the same weights. The network consists of the learned feature based on unsupervised dictionary learning as an intermediate layer between raw input and fully connected layers with non-linear activation and regularization. Our proposed method can yield a little improvement in the applied group behavior recognition framework and yet empirically prove that it can be brought into another task without change the hyper-parameter.

A Novel Performance Evaluation Methodology for Single-Target Trackers.

This paper addresses the problem of single-target tracker performance evaluation. We consider the performance measures, the dataset and the evaluation system to be the most important components of tracker evaluation and propose requirements for each of them. The requirements are the basis of a new evaluation methodology that aims at a simple and easily interpretable tracker comparison. The ranking-based methodology addresses tracker equivalence in terms of statistical significance and practical differences. A fully-annotated dataset with per-frame annotations with several visual attributes is introduced. The diversity of its visual properties is maximized in a novel way by clustering a large number of videos according to their visual attributes. This makes it the most sophistically constructed and annotated dataset to date. A multi-platform evaluation system allowing easy integration of third-party trackers is presented as well. The proposed evaluation methodology was tested on the VOT2014 challenge on the new dataset and 38 trackers, making it the largest benchmark to date. Most of the tested trackers are indeed state-of-the-art since they outperform the standard baselines, resulting in a highly-challenging benchmark. An exhaustive analysis of the dataset from the perspective of tracking difficulty is carried out. To facilitate tracker comparison a new performance visualization technique is proposed.

TrackerDetector: A system to detect third-party trackers through machine learning

Privacy violation caused by third-party tracking has become a serious problem, and the most effective defense against it is blocking. However, as the core part of blocking, the blacklist is usually manually curated and is difficult to maintain. To make it easier to generate a blacklist and reduce human work, we propose an effective system with high accuracy, named TrackerDetector, to detect third-party trackers automatically. Intuitively, the behaviors of trackers and non-trackers are different, which leads to different JavaScript API sets being called. Thus, an incremental classifier is trained from JavaScript files crawled from a large number of websites to detect whether a website is a third-party tracker. High accuracy of 97.34% is obtained with our dataset and that of 93.56% is obtained within a 10-fold cross validation.