Most surfers vulnerable to "history sniffing" attacks

 

Gallery

By Stewart Mitchell

Posted on 21 May 2010 at 09:41

Three quarters of the surfing population are open to “history sniffing” attacks that can expose surfing habits and even identify where they live.

The report, published by security researchers behind the What The Internet Knows About You website, claims that browser history detection through Cascading Style Sheets has long been documented by security academics, but had been dismissed as low risk. Until now.

“Our results indicate that at least 76% of internet users are vulnerable to history detection; for a test of most popular internet websites we were able to detect, on average, 62 visited locations,” said the report's authors, Artur Janc and Lukasz Olejnik.

“We also demonstrate the potential for detecting private data such as zipcodes [postcodes] or search queries typed into online forms,” the researchers said. “Our results confirm the feasibility of conducting attacks on user privacy using CSS-based history detection and demonstrate that such attacks are realisable with minimal resources. This is of great practical significance.”

The researchers say they analysed the real-world results collected by interrogating the browser of 271,576 internet users.

The history sniffing technology involved creating an algorithm that was able to search a browser's history and detect up to 30,000 links per second in recent browsers on modern consumer-grade hardware.

The researcher's website reveals whether your browser is susceptible to such attacks.