I Know Where You've Been: Geo-Inference Attacks Via The Browser Cache
summary
Attack uses shared browser cache timing to infer country, city and even neighborhood by probing which resources are cached: it times Google logos, loads Craigslist subsites and predicts and probes map tile URLs. Experiments across Chrome/Firefox/IE and mobile show ~50–700 ms timing gaps, 60% of top sites expose location-specific resources, and the method works even in private mode and partially in Tor. A Chromium per-origin-cache prototype blocks the attack but adds ~50% page-load overhead.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:26Do You Care About your Geo-location?
- 7:11Sources of Users' Geo-locations
- 9:28Problem Statement
- 10:02Background: Browser Cache
- 11:04Directives in Response Headers to Control Cache
- 12:09Browser Cache Stores Static Resources
- 12:55Benefits of Browser Cache
- 17:15Attack Vector (11) : Measuring Page Load Time
- 18:02Time of XMLHttpRequests
- 18:57Attack Vector (IV): Use img complete Property
- 21:19How to Infer a User's City?
- 24:39Evaluation Setup
- 28:00Loading Time: Without Cache.s. With Cachel
- 31:46Private Browsing Mode is not the Cure
- 33:01Randomizing Timing Measurements
- 34:24TorBrowser is not Perfect
- 39:47Segregating Browser Cache
- 44:29Take-away
related talks
51mTiming Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks
26mLoophole: Timing Attacks on Shared Event Loops in Chrome
44mCache Me If You Can: Messing with Web Caching
24mSide-Channel Attacks on Everyday Applications
14mBrowser Fingerprinting: Stalking With a Personal Touch
35mWhen Geo goes Wrong
48mA Weakness In Chrome & A New Hacking Technique
34mCovert web-to-app tracking via localhost on Android