Ad blockers heavily rely on filter lists to block ad domains, which can serve advertisements and trackers. However, recent research has reported that some advertisers keep registering replica ad domains (RAD domains)—new domains that serve the same purpose as the original ones—which tend to slip through ad-blocker filter lists. Although this phenomenon might negatively affect ad blockers’ effectiveness, no study to date has thoroughly investigated its prevalence and the issues caused by RAD domains. In this work, we proposed methods to discover RAD domains and categorized their change patterns. From a crawl of 50,000 websites, we identified 1,748 unique RAD domains, 1,096 of which survived for an average of 410.5 days before they were blocked; the rest have not been blocked as of February 2021. Notably, we found that non-blocked RAD domains could extend the timespan of ad or tracker distribution by more than two years. Our analysis further revealed a taxonomy of four techniques used to create RAD domains, including two less-studied ones. Additionally, we discovered that the RAD domains affected 10.2% of the websites we crawled, and 23.7% of the RAD domains exhibiting privacy-intrusive behaviors, undermining ad blockers’ privacy protection.

Abstract Over half of all visits to websites now take place in a mobile browser, yet the majority of web privacy studies take the vantage point of desktop browsers, use emulated mobile browsers, or focus on just a single mobile browser instead. In this paper, we present a comprehensive web-tracking measurement study on mobile browsers and privacy-focused mobile browsers. Our study leverages a new web measurement infrastructure, OmniCrawl, which we develop to drive browsers on desktop computers and smartphones located on two continents. We capture web tracking measurements using 42 different non-emulated browsers simultaneously. We find that the third-party advertising and tracking ecosystem of mobile browsers is more similar to that of desktop browsers than previous findings suggested. We study privacy-focused browsers and find their protections differ significantly and in general are less for lower-ranked sites. Our findings also show that common methodological choices made by web measurement studies, such as the use of emulated mobile browsers and Selenium, can lead to website behavior that deviates from what actual users experience.

Cloud-based DDoS mitigation techniques have been widely deployed. However, existing approaches severely violate user privacy as they intercept HTTPS to uncover non-volumetric attacks. This paper presents DAMUP, DDoS Attack Mitigation Upholding Privacy. DAMUP is a practical and privacy-aware solution that empowers the cloud to blindly filter encrypted traffic while remaining deployable on the current Internet. The main idea underlying DAMUP is to encode the server's filtering policy, e.g., client's priority level or rate limit, into cryptographic tokens that can be stapled to an encrypted connection and be efficiently verified by the cloud. DAMUP is designed to be deployable on the current Internet because it requires no modification to the Internet architecture. For example, DAMUP leverages the Server Name Indication field in the TLS handshake to exchange tokens, and uses SOCKS proxy to override DNS. Our evaluation shows that DAMUP can significantly improve the connection success rate from 11.4% to 99.8% under HTTP(S) floods.