Apple’s privacy software allowed users to be tracked, says Google

guest · Jan 23, 2020

Google finds security flaws in Apple's web browser: FT
January 22, 2020
https://www.reuters.com/article/us-...-flaws-in-apples-web-browser-ft-idUSKBN1ZL2K9

Google researchers have found multiple security flaws in Apple Inc’s Safari web browser that allowed the tracking of users’ browsing behavior, the Financial Times reported on Wednesday, citing a soon-to-be published paper.

The vulnerabilities were found in a tool specifically designed to protect privacy and could have allowed third parties to obtain sensitive information about the browsing habits of users, the report added.
Alphabet Inc’s Google disclosed the flaws to Apple last August, according to the report. In a blog post in December, an Apple engineer said that the company had fixed flaws disclosed to it by Google researchers.
Click to expand...

[paywall]
FT: Apple’s privacy software allowed users to be tracked, says Google

“You would not expect privacy-enhancing technologies to introduce privacy risks,” said Lukasz Olejnik, an independent security researcher who has seen the paper. “If exploited or used, [these vulnerabilities] would allow unsanctioned and uncontrollable user tracking.

“While today such privacy vulnerabilities are very rare, issues in mechanisms designed to improve privacy are unexpected and highly counter-intuitive.”
According to the Google researchers, the vulnerabilities left personal data exposed “because the ITP list implicitly stores information about the websites visited by the user”.

“Unlike other approaches . . . ITP runs its algorithms on-device, which makes it able to detect [user] behaviour and ‘learn’ about them automatically,” said Mr Olejnik. “But this user-specific aspect is also partly why the risk of information leaks was possible.”
The researchers also identified a flaw that allowed hackers to “create a persistent fingerprint that will follow the user around the web”, while others were able to reveal what individual users were searching for on search engine pages.
Click to expand...

Apple - blog post (December 2019):

This blog post covers enhancements to Intelligent Tracking Prevention (ITP) included in Safari on iOS and iPadOS 13.3, Safari 13.0.4 on macOS Catalina, Mojave, and High Sierra.
[...]
Thanks To Google
We’d like to thank Google for sending us a report in which they explore both the ability to detect when web content is treated differently by tracking prevention and the bad things that are possible with such detection. Their responsible disclosure practice allowed us to design and test the changes detailed above. Full credit will be given in upcoming security release notes.
Click to expand...

guest · Jan 23, 2020

Safari’s anti-tracking protections can leak browsing and search histories
January 23, 2020
https://arstechnica.com/information...tions-can-leak-browsing-and-search-histories/

A paper published on Wednesday by researchers from Google said this protection came at considerable risk to the privacy end users. Because the list of restricted sites is based on users’ individual browsing patterns, Intelligent Tracking Prevention—commonly abbreviated as ITP—introduces settings into Safari that can be modified and detected by any page on the Internet. The paper said websites have been able to use this capability for a host of attacks, [...]
Some cross-site tracking is OK
Not all third-party tracking is invasive. Using Google or Facebook credentials to log in to a different site through OAuth is one example of cross-site tracking that many people find useful.

It’s trivial for attackers to determine the ITP status of any domain under their control. Attackers simply issue cross-site requests from another domain and check if the referer header has been truncated or if a cookie previously sent in a first-party context is present in the request.

Besides Wednesday’s paper, threads here and here provide additional technical details.
Click to expand...

Paper: Information Leaks via Safari's Intelligent Tracking Prevention (PDF): https://arxiv.org/pdf/2001.07421.pdf

Rasheed187 · Jan 25, 2020

mood said: ↑

Safari’s anti-tracking protections can leak browsing and search histories
January 23, 2020
https://arstechnica.com/information...tions-can-leak-browsing-and-search-histories/

Paper: Information Leaks via Safari's Intelligent Tracking Prevention (PDF): https://arxiv.org/pdf/2001.07421.pdf
Click to expand...

This is pretty painful, so much for Apple being superior to Windows.

guest · Jan 26, 2020

Apple Fixed Tracking Flaws In Safari, But Google Director Disagrees
January 23, 2020
https://www.silicon.co.uk/security/security-management/apple-tracking-flaws-safari-331080

Google reportedly told Apple about the problem with five flaws in August 2019, and in December Apple published a blog post saying it had fixed the issues and it thanked Google for its help.
Not fixed
But it seems as though Google doesn’t believe that Apple has actually patched the problem, despite its claims that it had.

This week on Twitter, Google Chrome Engineering Director Justin Schuh tweeted that the actual vulnerabilities have not been fixed, despite Apple’s claim.

“No, I can assure you that they still haven’t fixed these issues, which is what made that blog post last year so weird,” tweeted Schuh in a thread. “Apple didn’t disclose the vulnerabilities or appropriately credit the researchers, but put out a post implying they fixed ‘something’”.
Click to expand...

I have no idea what Apple plans to do about this, because it's been a defining theme in their anti-tracking approach (and one of our major concerns). They attempt to mitigate tracking by adding state mechanisms, but adding state often introduces worse privacy/security issues.
— Justin Schuh @justinschuh January 22, 2020
Click to expand...

Log in or Sign up

Apple’s privacy software allowed users to be tracked, says Google

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Apple’s privacy software allowed users to be tracked, says Google

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches