A dangerous mix: Large-scale analysis of mixed-content websites

Ping Chen; Nick Nikiforakis; Christophe Huygens; Lieven Desmet

doi:10.1007/978-3-319-27659-5_25

A dangerous mix: Large-scale analysis of mixed-content websites

Ping Chen
, Nick Nikiforakis
, Christophe Huygens
, Lieven Desmet

Computer Science

KU Leuven

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

15 Scopus citations

Abstract

In this paper, we investigate the current state of practice about mixed-content websites, websites that are accessed using the HTTPS protocol, yet include some additional resources using HTTP. Through a large-scale experiment, we show that about half of the Internet’s most popular websites are currently using this practice and are thus vulnerable to a wide range of attacks, including the stealing of cookies and the injection of malicious JavaScript in the context of the vulnerable websites. Additionally, we investigate the default behavior of browsers on mobile devices and show that most of them, by default, allow the rendering of mixed content, which demonstrates that hundreds of thousands of mobile users are currently vulnerable to MITM attacks.

Original language	English
Title of host publication	Information Security - 16th International Conference, ISC 2013, Proceedings
Editors	Yvo Desmedt
Publisher	Springer Verlag
Pages	354-363
Number of pages	10
ISBN (Print)	9783319276588
DOIs	https://doi.org/10.1007/978-3-319-27659-5_25
State	Published - 2015
Event	16th International Conference on Information Security, ISC 2013 - Dallas, United States Duration: Nov 13 2013 → Nov 15 2013

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	7807
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	16th International Conference on Information Security, ISC 2013
Country/Territory	United States
City	Dallas
Period	11/13/13 → 11/15/13

Access to Document

10.1007/978-3-319-27659-5_25

Cite this

Chen, P., Nikiforakis, N., Huygens, C., & Desmet, L. (2015). A dangerous mix: Large-scale analysis of mixed-content websites. In Y. Desmedt (Ed.), Information Security - 16th International Conference, ISC 2013, Proceedings (pp. 354-363). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7807). Springer Verlag. https://doi.org/10.1007/978-3-319-27659-5_25

Chen, Ping ; Nikiforakis, Nick ; Huygens, Christophe et al. / A dangerous mix : Large-scale analysis of mixed-content websites. Information Security - 16th International Conference, ISC 2013, Proceedings. editor / Yvo Desmedt. Springer Verlag, 2015. pp. 354-363 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{5748935b08384fd0886d2de64ad7df50,

title = "A dangerous mix: Large-scale analysis of mixed-content websites",

abstract = "In this paper, we investigate the current state of practice about mixed-content websites, websites that are accessed using the HTTPS protocol, yet include some additional resources using HTTP. Through a large-scale experiment, we show that about half of the Internet{\textquoteright}s most popular websites are currently using this practice and are thus vulnerable to a wide range of attacks, including the stealing of cookies and the injection of malicious JavaScript in the context of the vulnerable websites. Additionally, we investigate the default behavior of browsers on mobile devices and show that most of them, by default, allow the rendering of mixed content, which demonstrates that hundreds of thousands of mobile users are currently vulnerable to MITM attacks.",

author = "Ping Chen and Nick Nikiforakis and Christophe Huygens and Lieven Desmet",

note = "Publisher Copyright: {\textcopyright} Springer International Publishing Switzerland 2015.; 16th International Conference on Information Security, ISC 2013 ; Conference date: 13-11-2013 Through 15-11-2013",

year = "2015",

doi = "10.1007/978-3-319-27659-5\_25",

language = "English",

isbn = "9783319276588",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "354--363",

editor = "Yvo Desmedt",

booktitle = "Information Security - 16th International Conference, ISC 2013, Proceedings",

}

Chen, P, Nikiforakis, N, Huygens, C & Desmet, L 2015, A dangerous mix: Large-scale analysis of mixed-content websites. in Y Desmedt (ed.), Information Security - 16th International Conference, ISC 2013, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 7807, Springer Verlag, pp. 354-363, 16th International Conference on Information Security, ISC 2013, Dallas, United States, 11/13/13. https://doi.org/10.1007/978-3-319-27659-5_25

A dangerous mix: Large-scale analysis of mixed-content websites. / Chen, Ping; Nikiforakis, Nick; Huygens, Christophe et al.
Information Security - 16th International Conference, ISC 2013, Proceedings. ed. / Yvo Desmedt. Springer Verlag, 2015. p. 354-363 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7807).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - A dangerous mix

T2 - 16th International Conference on Information Security, ISC 2013

AU - Chen, Ping

AU - Nikiforakis, Nick

AU - Huygens, Christophe

AU - Desmet, Lieven

PY - 2015

Y1 - 2015

N2 - In this paper, we investigate the current state of practice about mixed-content websites, websites that are accessed using the HTTPS protocol, yet include some additional resources using HTTP. Through a large-scale experiment, we show that about half of the Internet’s most popular websites are currently using this practice and are thus vulnerable to a wide range of attacks, including the stealing of cookies and the injection of malicious JavaScript in the context of the vulnerable websites. Additionally, we investigate the default behavior of browsers on mobile devices and show that most of them, by default, allow the rendering of mixed content, which demonstrates that hundreds of thousands of mobile users are currently vulnerable to MITM attacks.

AB - In this paper, we investigate the current state of practice about mixed-content websites, websites that are accessed using the HTTPS protocol, yet include some additional resources using HTTP. Through a large-scale experiment, we show that about half of the Internet’s most popular websites are currently using this practice and are thus vulnerable to a wide range of attacks, including the stealing of cookies and the injection of malicious JavaScript in the context of the vulnerable websites. Additionally, we investigate the default behavior of browsers on mobile devices and show that most of them, by default, allow the rendering of mixed content, which demonstrates that hundreds of thousands of mobile users are currently vulnerable to MITM attacks.

UR - https://www.scopus.com/pages/publications/84955304032

U2 - 10.1007/978-3-319-27659-5_25

DO - 10.1007/978-3-319-27659-5_25

M3 - Conference contribution

AN - SCOPUS:84955304032

SN - 9783319276588

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 354

EP - 363

BT - Information Security - 16th International Conference, ISC 2013, Proceedings

A2 - Desmedt, Yvo

PB - Springer Verlag

Y2 - 13 November 2013 through 15 November 2013

ER -

Chen P, Nikiforakis N, Huygens C, Desmet L. A dangerous mix: Large-scale analysis of mixed-content websites. In Desmedt Y, editor, Information Security - 16th International Conference, ISC 2013, Proceedings. Springer Verlag. 2015. p. 354-363. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-27659-5_25

A dangerous mix: Large-scale analysis of mixed-content websites

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this