Take this personally: pollution attacks on personalized services

摘要: Modern Web services routinely personalize content to appeal the specific interests, viewpoints, and contexts of individual users. Ideally, personalization allows sites highlight information uniquely relevant each their users, thereby increasing user satisfaction--and, eventually, service's bottom line. Unfortunately, as we demonstrate in this paper, mechanisms currently employed by popular have not been hardened against attack. We show that third parties can manipulate them increase visibility arbitrary content--whether it be a new YouTube video, an unpopular product on Amazon, or low-ranking website Google search returns. In particular, attackers inject into users' profiles these services, perturbing results services' algorithms. While details our exploits are tailored service, general approach is likely apply quite broadly. By demonstrating attack three class vulnerability attacker affect user's experience with unbeknownst service provider.