Webextensions can improve web browser privacy, security, and user experience. The APIs offered by the browser to webextensions affect possible functionality. Currently, Chrome transitions to a modified set of APIs called Manifest v3. This paper studies the challenges and opportunities of Manifest v3 with an in-depth structured qualitative research. Even though some projects observed positive effects, a majority expresses concerns over limited benefits to users, removal of crucial APIs, or the need to find workarounds. Our findings indicate that the transition affects different types of webextensions differently; some can migrate without losing functionality, while other projects remove functionality or decline to update. The respondents identified several critical missing APIs, including reliable APIs to inject content scripts, APIs for storing confidential content, and others.

Session replay scripts allow website owners to record the interaction of each web site visitor and aggregate the interaction to reveal the interests and problems of the visitors. However, previous research identified such techniques as privacy intrusive. This position paper updates the information on data collection by Hotjar. It revisits the previous findings to detect and describe the changes. The default policy to gather inputs changed; the recording script gathers only information from explicitly allowed input elements. Nevertheless, Hotjar does record content reflecting users' behaviour outside input HTML elements. Even though we propose changes that would prevent the leakage of the reflected content, we argue that such changes will most likely not appear in practice. The paper discusses improvements in handling TLS. Not only do web page operators interact with Hotjar through encrypted connections, but Hotjar scripts do not work on sites not protected by TLS. Hotjar respects the Do Not Track signal; however, users need to connect to Hotjar even in the presence of the Do Not Track setting. Worse, malicious web operators can trick Hotjar into recording sessions of users with the active Do Not Track setting. Finally, we propose and motivate the extension of GDPR Art. 25 obligations to processors.

The web is used daily by billions. Even so, users are not protected from many threats by default. This position paper builds on previous web privacy and security research and introduces JShelter, a webextension that fights to return the browser to users. Moreover, we introduce a library helping with common webextension development tasks and fixing loopholes misused by previous research. JShelter focuses on fingerprinting prevention, limitations of rich web APIs, prevention of attacks connected to timing, and learning information about the device, the browser, the user, and surrounding physical environment and location. We discovered a loophole in the sensor timestamps that lets any page observe the device boot time if sensor APIs are enabled in Chromium-based browsers. JShelter provides a fingerprinting report and other feedback that can be used by future security research and data protection authorities. Thousands of users around the world use the webextension every day.

The European directive on energy efficiency requires that all meters in multi-apartment buildings installed after 25 October 2020 shall be remotely readable devices when technically feasible and cost-effective in terms of being proportionate to the potential energy savings. The European Commission Recommendation of 9 March 2012 on preparations for the roll-out of smart metering systems (2012/148/EU) explicitly mentions that smart metering predominantly processes personal data. This chapter recommends how to design a metering system that fully conforms to legal regulations. The main contribution is the recommendation of eight steps for data controllers that make metering systems legally compliant. Additionally, the chapter lists recommendations for smart meter manufacturers that remove the burden of being a controller of the processing. The recommendations apply to the distribution of electricity, water, gas, heat, cooling, and other energies. The chapter shows that the recommendations can be generalized for smart home deployments.

Network Error Logging helps web server operators detect operational problems in real-time to provide fast and reliable services. HTTP Archive provides detail information of historical data on HTTP requests. This paper leverages the data and provides a long term analysis of Network Error Logging deployment. The deployment raised from 0 to 11.73 % (almost 2,250,000 unique domains) since 2019. Current deployment is dominated by Cloudflare. Although we observed different policies, the default settings prevail. Third party collectors emerge raising the diversity needed to gather sound data. Even so, many service deploy self-hosted services. Moreover, we identify potentially malicious adversaries deploy collectors on randomly-generated domains and shortened URLs.

Network Error Logging helps web server operators detect operational problems in real-time to provide fast and reliable services. This paper analyses Network Error Logging from two angles. Firstly, this paper overviews Network Error Logging from the data protection view. The ePrivacy Directive requires consent for nonessential access to the end devices. Nevertheless, the Network Error Logging design does not allow limiting the tracking to consenting users. Other issues lay in GDPR requirements for transparency and the obligations in the contract between controllers and processors of personal data. Secondly, this paper explains Network Error Logging exploitations to deploy long-time trackers to the victim devices. Even though users should be able to disable Network Error Logging, it is not clear how to do so. Web server operators can mitigate the attack by configuring servers to preventively remove policies that adversaries might have added.

The European directive on energy efficiency requires that all meters in multi-apartment buildings installed after 25 October 2020 shall be remotely readable devices where technically feasible and cost effective in terms of being proportionate in relation to the potential energy savings. We observed that some manufacturers produce meters that monitor energy consumption in very short intervals, for example, a minute, even though the directive expects to provide billing information to consumers only once a month starting from 2022. This paper reviews privacy and security risks stemming from the high-frequency readouts and provides recommendations for manufacturers and suppliers. The paper focuses on Wireless M-Bus metering devices sold and advertised as a solution to fulfil the directive on energy efficiency requirements. We responsibly disclosed four issues in the metering devices to Common Vulnerability Exposure database; real-world deployments are vulnerable. Many recommendations and observations are also applicable to other protocols or deployments.

Internet of Things (IoT) is a network connecting various devices like sensors, actuators, and intelligent gadgets that monitor and control temperature, light, humidity, electrical power, and other physical quantities in a smart environment such as smart buildings. Data provided by IoT devices are essential for the management of the smart environment. So, it is important to be aware of the reachability of connected IoT devices, their state, volume of transferred data, connections they make, etc. Unfortunately, many IoT devices communicate directly over the data link layer (Layer 2) as ZigBee, Bluetooth, or WiFi. Traditional network monitoring techniques like SNMP, Netflow, or Syslog, however, require the full TCP/IP stack, so they cannot be directly applied on IoT networks. IoT devices are managed independently through vendor-specific solutions mostly implemented in the cloud. This leads to the divided network management where IP network devices are managed by a central network management system (NMS) while IoT devices are managed separately using proprietary applications. In order to include IoT devices into the network monitoring, two steps are required: (i) obtain IoT monitoring data, (ii) present these data in a standardized format supported by a common NMS. In this paper, we propose a solution based on the SNMP Proxy Agent that collects IoT information from IoT communication and the IoT log file on a local gateway. The agent converts gathered data into MIB objects that are provided to the SNMP monitoring system. Thus, information about IoT devices are fed to the locally deployed network management system. The paper demonstrates the proposed solution on the smart building where IoT data is obtained from MQTT packets and the Home Assistant log file.

Lawful interception, network forensics, and security incident investigations require cross-layer linking of identification information to link different activities of a particular person. This paper presents a model called graphs of identifiers that allows cross-layer linking of identifiers detected by various methods. Graphs of identifiers provide operations that link identifiers according to the constraints provided in the queries. The goal is to employ the linking during early stages of the network forensic investigations when an investigator searches for leads. The tools that implement the proposed model are publicly available.

The identification of causes of errors in network systems is difficult due to their inherent complexity. Network administrators usually rely on available information sources to analyze the current situation and identify possible problems. Even though they are able to identify the symptoms seen in the past and thus can apply their experience gathered from the solved cases the time needed to identify and correct the errors is considerable. The automation of the troubleshooting process is a way to reduce the time spent on individual cases. In this paper, the model that can be used to automate the diagnostic process of network communication is presented. The model is based on building the finite automaton to describe protocol behavior in various situations. The unknown communication is checked against the model to identify error states and associated descriptions of causes. The tool prototype was implemented in order to demonstrate the proposed method via a set of experiments.

Network diagnostics is a time-consuming activity that requires an administrator with good knowledge of network principles and technologies. Even if some network errors have been resolved in the past, the administrator must spend considerable time removing these errors when they reoccur. This article presents an automated tool to learn the expected behavior of network protocols and possible variations. The created model can be used to automate the diagnostic process. The model presents a finite automaton containing protocol behavior for different situations. Diagnostics of unknown communication is performed by checking the created model and searching for error states and their descriptions. We have also created a proof-of-concept tool that demonstrates the practical potential of this approach.

Network diagnostics is a time-consuming activity that requires an administrator with good knowledge of network principles and technologies. Even if some network errors have been resolved in the past, the administrator must spend considerable time removing these errors when they reoccur. This article presents an automated tool to learn the expected behavior of network protocols and possible variations. The created model can be used to automate the diagnostic process. The model presents a finite automaton containing protocol behavior for different situations. Diagnostics of unknown communication is performed by checking the created model and searching for error states and their descriptions. We have also created a proof-of-concept tool that demonstrates the practical potential of this approach.

Policies for network traffic handling define packet routes through networks, enforce required quality of service, and protect networks from security threats. When expressing a policy, one needs to characterise the traffic to which the policy applies by traffic identifiers. Low level traffic identifiers, such as IP addresses and port numbers, are available in each packet. Indeed, low level traffic identifiers are perfect for data plane routing and switching. However, high level traffic identifiers, such as user name and application name, are better for the readability and clarity of a policy. In this paper, we extend software defined networks with high level traffic identifiers. We propose to add additional interface to SDN controllers for collecting traffic meta data and high level traffic identifiers. The controller maintains a database that maps high level traffic identifiers to a set of flows defined by low level traffic identifiers. SDN applications can apply policies based on both high level and low level traffic identifiers. We leave the southbound protocols intact. This paper provides two examples of High Level SDN paradigms – Application-Aware Networks and Identity-Aware Networks. The first paradigm enables policies depending on application names and characteristics. The latter allows policies based on user names and their roles.

Each clock has built-in deficiencies since the manufacturing process is not precise on atomic level. These inaccuracies cause each clock to drift in a unique way. Clock skew has been already studied and used to identify computers. Based on the previous research in clock-skew-based identification, this paper provides a summary of use cases and methods for clock-skew-based identification. Nevertheless, the main contribution of the paper is following: (1) A formal evaluation of the requirements for precise clock skew estimations. The formal approach is accompanied with an empirical study of 24,071 clock skew measurements. (2) A method that links IPv4 and IPv6 addresses of a single computer. (3) A scenario, during which a malicious attacker mimics clock skew of another computer and consequently, for example, penetrates through authentication mechanisms considered during previous research. (4) Even though the real network observations expose that current precision in clock skew estimation is not sufficient to uniquely identify devices in moderately-sized network, some IPv4 and IPv6 addresses can be linked based on unique clock skew shifts of a computer, for example caused by a running NTP daemon.

As the number of network services and applications increases, each one of them showing different requirements in terms of bandwidth and latency, it becomes critical for network operators to identify these applications. This paper builds up on the principles of Software Defined Networking, proposing a novel Application-Aware Network architecture, which is able to directly handle applications and their requirements; abstracting the complexity of dealing with network flows. Since metadata about applications are signalled either directly from the endpoints or from application managers, the information is precise and the approach can also be used for encrypted traffic. The benefits of the Application-Aware Approach for the network flow management is demonstrated in real network by two proof-of-concept services: aimed on quality of experience and load balancing.

Clocks have a small in-built error. As the error is unique, each clock can be identified. This paper explores remote computer identification based on the estimation of clock skew computed from network packets. The previous knowledge of the method is expanded in various ways: (1) we argue about the amount of data that is necessary to get accurate clock skew estimation, (2) the study of different time stamp sources unveils several irregularities that hinders the identification, and (3) the distribution of clock skew in real network makes the precise identification hard or even impossible.

Communicating parties inside computer networks use different kind of identifiers. Some of these identifiers are stable, e.g., logins used to access a specific service, some are only temporary, e.g., dynamically assigned IP addresses. This paper tackles several challenges of lawful interception that emerged in modern networks. The main contribution is the graph model that links identities learnt from various sources distributed in a network. The inferred identities result into an interception of more detailed data in conformance with the issued court order. The approach deals with network address translation, short-lived identifiers and simultaneous usage of different identities. The approach was evaluated to be viable during real network testing based on various means to learn identities of users connected to a network.

It is important to keep networks secure and reliable. In order to backtrack security incidents, provide accounting for offered services etc., it is necessary to know the identity of network users. With various methods for IPv6 address assignments, user identification in IPv6 networks is challenging. This paper proposes a new approach for user identity tracking in LANs. The approach is based on network control traffic that is already present in IPv6 networks. In contrast to current methods, the proposed approach does not bring any extensive workload to active network devices and works in networks with Multicast Listener Discovery snooping. In addition, the approach is able to detect that an address is no longer used. The proposed approach is passive to end devices. In order to make the approach reliable, we studied the behaviour of current operating systems during IPv6 address assignments. We implemented a tool called ndtrack based on the proposed approach and tested it in a real network.

In this paper we revisited a method to identify computers by their clocks skew computed from TCP timestamps. We introduced our own tool to compute clock skew of computers in a network. We validated that the original method is suitable for the computer identification but we also discovered that Linux hosts running NTP had become immune to the identification.

For security, management and accounting, network administrators benefit from knowledge of IP and MAC address bindings. In IPv6, learning these bindings is not as straightforward as it is in IPv4. This paper presents a new approach to track IPv6 address assignments in LANs. The method is based on a study of implementation of IPv6 (mainly neighbor discovery) in current operating systems. The detection is passive for end devices and does not require any software or hardware modifications. In contrast with current methods, our approach does not poll routers in the network and works also in networks where IPv6 multicast is not broadcasted (active Multicast Listener Discovery snooping - MLD snooping). Moreover, our approach detects that an address is no longer used. The approach was successfully tested in a campus network.