The Web's Sixth Sense:

The study is a collaboration of Anupam Das¹, Gunes Acar², Nikita Borisov³ and Amogh Pradeep^4
1 North Carolina State University
² Princeton University
³ University of Illinois at Urbana-Champaign
⁴ Northeastern University

All the findings below are based on a web crawl of the Alexa top 100K websites carried out in May 2018.

From our crawl results we found that sensor APIs were accessed on 3695 of the 100K websites by scripts served from 603 distinct domains. Orientation and motion sensors are by far the most frequently accessed, on 2653 and 2036 sites respectively. Light and proximity sensors, which were only supported by Firefox^[1], are accessed on fewer than 200 sites each.

In addition to listing the number of sites that feature scripts, we use the prominence metric proposed by Engelhardt and Narayanan (§5.2) to capture the popularity of the sites where scripts are present. It is calculated as the inverse sum of the rank of the sites: \( \sum 1/\mathit{rank}_i \). For ease of interpretation, we normalize this by dividing by the prominence of all sites, \( \sum_{i=1}^{100000} 1/i, \) and expresss the value as a percentage.

Sensor	# of sites	# of domains	Norm. prominence
Motion	2653	384	1.82%
Orientation	2036	420	4.34%
Proximity	186	50	0.13%
Light	181	35	0.13%

We found several scripts that access and send sensor data to remote servers either in clear text or in base64 encoded form. To detect such exfiltrations, we analyzed HTTP request headers and POST request bodies obtained through OpenWPM-Mobile’s instrumentation.

By clustering scripts based on features extracted from instrumentation data we were able to classify major use cases. We found that sensor data are commonly used for tracking and analytics, verifying ad impressions, and distinguishing real devices from bots.

We also found that a large fraction of the scripts that access sensors also perform browser fingerprinting.

We measure the rate of blocking by three popular tracking protection lists: EasyList, EasyPrivacy, and Disconnect. The table below reports the fraction of script domains that use sensors which are blocked by each list. In general, we see that a significant portion of scripts that access sensors are missed by the popular blacklists, which is in line with the previous research on tracking protection lists. However, the lists do tend to capture the most prominent scripts; the numbers in parentheses are the percentage of scripts weighted by their prominence.

Scripts from the following domains were found to access one or more sensors APIs.

The list of websites where one or more sensor were accessed.

We have made all of the data supporting this research, including raw crawl data, extracted features, and clustering results, available via the Illinois Data Bank.

Data »

• On p.2, "63% of the scripts that access motion sensors also perform canvas fingerprinting" should read "63% of the scripts that access motion sensors also perform browser fingerprinting".
• In Table 10, our numbers in the "Any sensor" line were slightly incorrect due to a calculation error. The corresponding table on this page has the corrected data.

We would like to thank all the anonymous reviewers for their feedback. We would also like to thank Arvind Narayanan, Steven Englehardt and our shepherd Ben Stock for their valuable feedback. This material is based in part upon work supported by the National Science Foundation grants CNS 1739966 and CNS 1526353.

Reference: Anupam Das, Gunes Acar, Nikita Borisov, Amogh Pradeep. The Web's Sixth Sense: A Study of Scripts Accessing Smartphone Sensors. In Proceedings of the 25th ACM Conference on Computer and Communications Security (CCS), Toronto, Canada, October 15–19, 2018.

BibTeX: Copy to clipboard

@inproceedings{sensor-js-2018,
  author    = {Anupam Das and Gunes Acar and Nikita Borisov and Amogh Pradeep},
  title     = {The {Web's} Sixth Sense: A Study of Scripts Accessing Smartphone Sensors},
  booktitle = {Proceedings of the 25th ACM Conference on Computer and Communication Security (CCS)},
  year      = 2018,
  month     = oct,
  publisher = {ACM},
  doi       = {10.1145/3243734.3243860},
  url       = {https://doi.org/0.1145/3243734.3243860}
}