杏吧原创

Furtive web surfers might not be able to rely on their web browser鈥檚 private mode to hide their tracks.

Most web browsers offer a private mode, intended to leave no trace of surfing history on the computer. But at Carnegie Mellon University in Silicon Valley, California, and colleagues, have found ways to detect which sites were visited with the mode enabled.

For example, many banking websites encrypt their data for security reasons by automatically establishing a secure key with the user鈥檚 computer 鈥� but even if private browsing is enabled, details relating to the key remain stored on the computer鈥檚 hard drive, allowing a hacker to establish that a particular site had been visited. A hacker could 鈥済uess what sites you鈥檝e been to based on traces left behind鈥�, says Jackson.

These attacks on privacy 鈥渄o not require a great deal of technical sophistication and could easily be built into forensics tools鈥�, he adds.

Alternative attacks

Although the work clearly shows there are weaknesses in browsers鈥� private-browsing implementations, says a UK-based security researcher at Trend Micro of Tokyo, Japan, any attacker with the knowledge to exploit the weaknesses would probably look to other attacks first, which may yield more detailed information.

鈥淚f someone is capable of tracking your browsing habits in this way, then they are probably also tech-savvy enough to know about commercial spyware which could much more effectively track your computer use,鈥� says Ferguson.

The research will be presented at next month鈥檚 Usenix Security Symposium in Washington DC.