Browser History Stealing with Captive Wi-Fi Portals

摘要: In this paper we show that HSTS headers and long-term cookies (like those used for user tracking) are so prevailing they allow a malicious Wi-Fi operator to gain significant knowledge about the past browsing history of users. We demonstrate how combine both into stealing attack by including specially crafted references captive portal or injecting them legitimate HTTP traffic. Captive portals on many Internet hotspots display message, like login page an acceptable use policy before connected Internet. They typically found in public places such as airports, train stations, restaurants. Such systems have been known be troublesome reasons. can not only current session, but also user's past. By invisibly placing vast amounts these pages, lure browser revealing either reading stored persistent (long-term) evaluating responses previously set headers. An occurrence cookie, well direct call pages' HTTPS site is reliable sign having visited earlier. Thus, technique allows site-based stealing, similar famous link-color attacks. For Alexa Top 1,000 sites, between 82% 92% sites effected over HTTP. 200,000 determined number vulnerable 59% 86%. extended our implementation other privacy-invading attacks enrich collected data with additional personal information.