All Your Clicks Belong to Me: Investigating Click Interception on the Web.

摘要: Click is the prominent way that users interact with web applications. For example, we click hyperlinks to navigate among different pages on Web, form submission buttons send data websites, and player controls tune video playback. Clicks are also critical in online advertising, which fuels revenue of billions websites. Because role clicks Web ecosystem, attackers aim intercept genuine user either malicious commands another application behalf or fabricate realistic ad traffic. However, existing studies mainly consider one type interceptions cross-origin settings via iframes, i.e., clickjacking. This does not comprehensively represent various types can be launched by third-party JavaScript code. In this paper, therefore systematically investigate interception practices Web. We developed a browser-based analysis framework, Observer, collect analyze related behaviors. Using identified three techniques Alexa top 250K detected 437 scripts intercepted 613 total receive around 43 million visits daily basis. revealed some websites collude hijack for monetization. particular, our demonstrated more than 36% 3,251 unique URLs were primary monetization approach Further, discovered exposed contents such as scamware through interceptions. Our research has become an emerging threat users.