Paper Info
Title
Measuring and Analysing the Chain of Implicit Trust: A Study of Third-party Resources Loading
Abstract
AbstractThe web is a tangled mass of interconnected services, whereby websites import a range of external resources from various third-party domains. The latter can also load further resources hosted on other domains. For each website, this creates a dependency chain underpinned by a form of implicit trust between the first-party and transitively connected third parties. The chain can only be loosely controlled as first-party websites often have little, if any, visibility on where these resources are loaded from. This article performs a large-scale study of dependency chains in the web to find that around 50% of first-party websites render content that they do not directly load. Although the majority (84.91%) of websites have short dependency chains (below three levels), we find websites with dependency chains exceeding 30. Using VirusTotal, we show that 1.2% of these third parties are classified as suspicious—although seemingly small, this limited set of suspicious third parties have remarkable reach into the wider ecosystem. We find that 73% of websites under-study load resources from suspicious third parties, and 24.8% of first-party webpages contain at least three third parties classified as suspicious in their dependency chain. By running sandboxed experiments, we observe a range of activities with the majority of suspicious JavaScript codes downloading malware.
Year
DOI
Venue
2020
10.1145/3380466
ACM Transactions on Privacy and Security
Keywords
DocType
Volume
Measurement, web of trust, third party resources, javascript, web security and privacy, sandbox, experiments
Journal
23
Issue
ISSN
Citations 
2
2471-2566
0
PageRank 
References 
Authors
0.34
0
6
Name
Order
Citations
PageRank
Ikram Muhammad1187.16
Rahat Masood2407.94
Gareth Tyson344346.65
Mohamed Ali Kâafar4265.28
Noha Loizon500.34
Roya Ensafi6113.25