Even HTTPS can leak your PRIVATE browsing

'Secure' browsing trapped in a BoG


HTTPS may be good at securing financial transactions, but it isn't much use as a privacy tool: US researchers have found that a traffic analysis of ten HTTPS-secured Web sites yielded “personal data such as medical conditions, legal or financial affairs or sexual orientation”.

In I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis, (Arxiv, here), UC Berkeley researchers Brad Miller, AD Joseph and JD Tygar and Intel Labs' Ling Huang show that even encrypted Web traffic can leave enough breadcrumbs on the trail to be retraced.

Sites tested in the study included healthcare services, banking and finance, legal services, as well as Netflix and YouTube. Their “traffic analysis attack” covered 6,000 individual pages on the ten Websites, and got close to 90 per cent accuracy in associating users with the pages they viewed.

It's not the first time that such work has been conducted, but the paper's authors say they've obtained the highest-quality reconstruction of Internet users' browsing of sites secured by HTTPS. The researchers were able to work out which pages users were viewing with 89 per cent accuracy.

The researchers call their analysis a “Bag of Gaussians” (BoG) “due to similarity with the Bag-of-Words approach to document classification”:

“Our attack applies clustering techniques to identify patterns in traffic. We then use a Gaussian distribution to determine similarity to each cluster and map traffic samples into a fixed width representation compatible with a wide range of machine learning techniques,” they write.

The attack isn't trivial: as the authors note, the attacker has to be able to visit the same Web pages as the target, and has to be able to capture the victim's traffic. That way, the attacker can identify patterns in the encrypted traffic that can be matched against the pages the attacker and victim both visited.

However, they note, ISPs, employers – and by extension, spies and censors – have exactly this view of user traffic.

The analysis attack can be mitigated, the paper says, with a padding technique they refer to as “Burst padding” that would change the signature of encrypted pages on separate visits.

As well as Netflix and YouTube, the researchers used traffic analysis covering the Mayo Clinic, Planned Parenthood, Kaiser Permanente, Wells Fargo, Bank of America, Vanguard, the ACLU and Legal Zoom. ®


Keep Reading

Tech Resources

Apps are Essential, so your WAF must be effective

You can’t run a business today without applications—and because apps are critical to strategic business imperatives and commerce, they have become the prime target for attackers.

Webcast Slide Deck | How backup modernization changes the ransomware game

If the thrill of backing up your data and wondering if you will ever see it again has worn off, start the new year by getting rid of the lingering pain of legacy backup. Bipul Sinha, CEO of the Cloud Data Management Company, Rubrik, and Miguel Zatarain, Director of Global Infrastructure Technology at PACCAR, Fortune 500 manufacturer of trucks and Rubrik customer, are talking to the Reg’s Tim Phillips about how to eliminate the costly, slow and spotty performance of legacy backup, and how to modernize your implementation in 2021 to make your business more resilient.

Three reasons you need a hybrid multicloud

Businesses need their IT teams to operate applications and data in a hybrid environment spanning on-premises private and public clouds. But this poses many challenges, such as managing complex networking, re-architecting applications for the cloud, and managing multiple infrastructure silos. There is a pressing need for a single platform that addresses these challenges - a hybrid multicloud built for the digital innovation era. Just this Regcast to find out: Why hybrid multicloud is the ideal path to accelerate cloud migration.

Top 20 Private Cloud Questions Answered

Download this asset for straight answers to your top private cloud questions.

Biting the hand that feeds IT © 1998–2021