NDLI: Resource Hints in HTML5: A New Pandora's Box of Security Nightmares

Please wait, while we are loading the content...

Security Proofs for Participation Privacy, Receipt-Freeness and Ballot Privacy for the Helios Voting Scheme

Continuous Biometric Verification for Non-Repudiation of Remote Services

Establishing Mutually Trusted Channels for Remote Sensing Devices with Trusted Execution Environments

Secure Enrollment of Certificates Using Short PINs

Systemic Risk Modeling and Evaluation through Simulation and Bayesian Networks

Measuring privacy in high dimensional microdata collections

Memory carving can finally unveil your embedded personal data

Lightweight Address Hopping for Defending the IPv6 IoT

Searchable Encryption with Access Control

A Trust-based Resilient Routing Mechanism for the Internet of Things

Incremental Clustering for Semi-Supervised Anomaly Detection applied on Log Data

Investigating User Comprehension and Risk Perception of Apple's Touch ID Technology

Integrating Reactive Cloud Applications in SERECA

Authentication Shutter: Alternative Countermeasure against Password Reuse Attack by Availability Control

bin2llvm: Analysis of Binary Programs Using LLVM Intermediate Representation

Provisioning Software with Hardware-Software Binding

Forensic Image Inspection Assisted by Deep Learning

On the Usefulness of Compression Models for Authorship Verification

The Demon is in the Configuration: Revisiting Hybrid Mobile Apps Configuration Model

Type Me the Truth!: Detecting Deceitful Users via Keystroke Dynamics

A Comparative Study on the Scalability of Dynamic Group Key Agreement Protocols

Towards Semi-automated Detection of Trigger-based Behavior for Software Security Assurance

Identification of Dependency-based Attacks on Node.js

DoS Attacks on Controller Area Networks by Fault Injections from the Software Layer

An Approach to Botnet Malware Detection Using Nonparametric Bayesian Methods

How to Ensure Bad Quality in Metal Additive Manufacturing: In-Situ Infrared Thermography from the Security Perspective

Are Network Covert Timing Channels Statistical Anomalies?

REMI: A Reliable and Secure Multicast Routing Protocol for IoT Networks

Position Paper: The Past, Present, and Future of Sanitizable and Redactable Signatures

Towards the Adoption of Secure Cloud Identity Services

Self-healing Multi-Cloud Application Modelling

Rolling DICE: Lightweight Remote Attestation for COTS IoT Hardware

Using Ciphers for Failure-Recovery in ITS Systems

VMAttack: Deobfuscating Virtualization-Based Packed Binaries

Artificial Ambient Environments for Proximity Critical Applications

Enabling Trust Assessment In Clouds-of-Clouds: A Similarity-Based Approach

Secure Matrix Multiplication with MapReduce

Attack Scenario Modeling for Smart Grids Assessment through Simulation

Constrained PET Composition for Measuring Enforced Privacy

PPAndroid-Benchmarker: Benchmarking Privacy Protection Systems on Android Devices

Quantifying the Spectrum of Denial-of-Service Attacks through Internet Backscatter

One-Message Unilateral Entity Authentication Schemes

M2M-REP: Reputation of Machines in the Internet of Things

Attack Potential in Impact and Complexity

C'mon: Monitoring the Compliance of Cloud Services to Contracted Properties

Anomaly-Based Detection and Classification of Attacks in Cyber-Physical Systems

Insider Misuse Attribution using Biometrics

Security Analysis of Cordova Applications in Google Play

Victim Communication Stack (VCS): A flexible model to select the Human Attack Vector

Application-Specific Digital Forensics Investigative Model in Internet of Things (IoT)

Quantitave Dynamic Taint Analysis of Privacy Leakage in Android Arabic Apps

Resource Hints in HTML5: A New Pandora's Box of Security Nightmares

Secure and Efficient Data Sharing with Atribute-based Proxy Re-encryption Scheme

Protection of personal data in security alert sharing platforms

DevOps for Better Software Security in the Cloud Invited Paper

Source Code Patterns of SQL Injection Vulnerabilities

Malware and Formal Methods: Rigorous Approaches for detecting Malicious Behaviour

Popularity-based Detection of Domain Generation Algorithms

FROST: Anti-Forensics Digital-Dead-DROp Information Hiding RobuST to Detection & Data Loss with Fault tolerance

Machine Learning Approach for Detection of nonTor Traffic

The Archistar Secret-Sharing Backup Proxy

Towards a Model of User-centered Privacy Preservation

Application of the holistic Data Privacy and Security Framework PaaSword: A focus on the integration in industrial Pilots

ZONESEC: built-in cyber-security for wide area surveillance system

Towards DDoS Attack Resilient Wide Area Monitoring Systems

A Non-Parametric Model for Accurate and Provably Private Synthetic Data Sets

Using Markov Chains to Model Sensor Network Reliability

Reliable Behavioural Factors in the Information Security Context

A Blockchain-based Approach for Data Accountability and Provenance Tracking

A Holistic Approach for Privacy Protection in E-Government

On the Sequential Pattern and Rule Mining in the Analysis of Cyber Security Alerts

Overcoming Limits of Blockchain for IoT Applications

Which Security Requirements Engineering Methodology Should I Choose?: Towards a Requirements Engineering-based Evaluation Approach

Timestamp hiccups: Detecting manipulated filesystem timestamps on NTFS

A Cloud-Based Compilation and Hardening Platform for Android Apps

k-rAC: a Fine-Grained k-Resilient Access Control Scheme for Distributed Hash Tables

Security and Privacy Implications of NFC-enabled Contactless Payment Systems

Fully threshold broadcast encryption

Forensic State Acquisition from Internet of Things (FSAIoT): A general framework and practical approach for IoT forensics through IoT device state acquisition

Learning Android Malware

SAFE and Secure: Deeply Integrating Security in a New Hazard Analysis

Implementing Secure DevOps assessment for highly regulated environments

Towards a Secure SCRUM Process for Agile Web Application Development

End-node Fingerprinting for Malware Detection on HTTPS Data

JSDES: An Automated De-Obfuscation System for Malicious JavaScript

A New Data-Hiding Approach for IP Telephony Applications with Silence Suppression

Investigating the darknet: limitations in Slovenian legal system

Orchestrating Privacy Enhancing Technologies and Services with BPM Tools: The WITDOM Data Protection Orchestrator

NEXTLEAP: Decentralizing Identity with Privacy for Secure Messaging

Protecting Future Maritime Communication

Anomaly Detection for Simulated IEC-60870-5-104 Trafiic

SONAR: Automatic Detection of Cyber Security Events over the Twitter Stream

A Low-Cost UAV-Based Secure Location Verification Method

SensorBuster: On Identifying Sensor Nodes in P2P Botnets

Go with the -Bitcoin- Flow, with Visual Analytics

Efficient ID-based Designated Verifier Signature

Microblogging in a Privacy-Preserving way

Adaptive Resource Management Enabling Deception (ARMED)

On Using TLS to Secure In-Vehicle Networks

Busting a Myth: Review of Agile Security Engineering Methods

Resource Hints in HTML5: A New Pandora's Box of Security Nightmares

Content Provider	ACM Digital Library
Author	Shi, X. Y. Roumani, H. Madani, P. Vlajic, N.
Abstract	1 To date, much of the development in Web-related technologies has been driven by the users' quest for ever faster and more intuitive WWW. One of the most recent trends in this development is built around the idea that a user's WWW experience can further be improved by predicting and/or preloading Web resources most likely sought by this user, ahead of time. Resource hints is a set of features introduced in HTML5 and intended to support the idea of predictive preloading in the WWW. Unfortunately, as the very actualization and the present use of the resource hints have been almost exclusively driven by the speed and end-user experience in mind, the opportunities for their misuse in terms of other user-related metrics (user privacy and reputation, as well as business analytics) appear to be considerable. In this article, we outline four different scenarios (i.e., attacks) in which the resource hints end up turning the browser into a dangerous tool that acts without the knowledge of and/or against its very own user. What makes these attacks particularly concerning is the fact that they are extremely easy to execute, and they do not require that any form of client-side malware be implanted on the user machine. While one of the attacks is (just) a new form of the well-known cross-site request forgery attacks, the other attacks have not been addressed much or at all in the literature. Through this work, we ultimate hope to make the wider Internet community critically rethink the way the resource hints are implemented and used in today's WWW.
Starting Page	1
Ending Page	9
Page Count	9
File Format	PDF
ISBN	9781450352574
DOI	10.1145/3098954.3104046
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2017-08-29
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	User privacy User reputation Html5 Web attacks Resource hints Chrome Unsolicited web requests Browser forensics
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in