Social profiling of users through information leakages

Abstract

Over the last decade, an overwhelming number of network attacks and methods have been developed to obtain sensitive information about end users. Such sensitive information can then be analyzed to predict the behaviour or interests of individuals or even worse, to enable the use of identity theft. More recently, companies that analyze such data have garnered attraction due to the legality and questionable effectiveness of these analyses. Regardless whether or not these social analyses are legal, they are actively being used for predicting social media influence, personalized advertisements, assessing financial and health conditions or even in forensic science. Based on this, we discuss and analyze the different attacks that can be used to socially profile Internet users. First, we discuss some practical cases why social profiling is in demand and examples in which context a malicious adversary can deploy such methods. Next, we discuss several attacks that can be utilized to fingerprint the devices and websites used by an Internet user and provide some effective countermeasures to defend ourselves against those attacks. Furthermore, we propose a novel fingerprinting method named 'IUPTIS' to identify specific profile URLs navigated by an end user. To quantify the practicality of this method, we conduct several experiments where we analyze the impact and defenses of utilizing this method in a realistic scenario.