{'fraction_non_alphanumeric': 0.020473448496481125, 'fraction_numerical': 0.0067178502879078695, 'mean_word_length': 5.036679536679537, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Blind Mice : Compromising Web Browsing Privacy Through Mouse Clicks

Many computer systems that are otherwise secure are vulnerable to side channel attacks. In this work we show how mouse movement and clicks data can leak sensitive information about which webpage a user is browsing based only on the pattern of mouse clicks and how they differ according to a webpage‟s layout and structure. Such information leakage is concerning especially when the proliferation of wireless mice is taken into consideration. Through our initial experiments and hardware setup, we show that it is possible for an adversary to sniff mouse data at a distance without the user‟s knowledge and permission. We collected mouse movement and clicks data (along with the ground truth as to which website was being browsed), for several users over a period of 6 weeks, by means of a Google Chrome extension. We then developed a preliminary probabilistic classifier to identify unique click patterns produced when browsing a certain website. In our experiments, we could successfully identify which webpage the user is browsing from a known corpus of websites with a mean accuracy of 77% given a single click and 100% when given 10 consecutive clicks. We also propose potential defenses and highlight opportunity for future work and extensions that may significantly improve our findings. Introduction and Prior Research Side channel attacks on an otherwise secure system is a well-studied discipline within the security community. Pioneering work in analysis of risks associated with various side channel attacks was performed by Eck et. al [1] in mid 1980s. Since then, within the academic community several side channel attacks have been identified and demonstrated, such as differential power measurements for cryptanalysis [2] [3], timing attacks on SSH by monitoring keystrokes patterns [4], electromagnetic interference for inferring a CRT and LCD‟s screen contents [5] [6] [7] [8], and more recently inferring human activity and privacy leakage by analyzing a home‟s or a device‟s power consumption [9]. In this paper we examine information leakage from computer peripherals, in particular a computer mouse. The use of wireless computer peripheral is quickly becoming ubiquitous due to increasing numbers of people who browse the Internet and do business on their mobile devices. Analyzing the information sent between the peripherals and the computer could reveal information about how the computer is being used and often what it‟s being used for. It is well known that by tapping into the information being sent between a keyboard and a PC, for example by use of a physical or software keylogger one can learn quite a lot of information about the user, including passwords and other sensitive data. Such key loggers can either be purely software based, that hook onto certain system calls or purely hardware. The latter are generally installed in line with a keyboard, that is, the keyboard being compromised is plugged into the logger and the logger is plugged into the PC. It does not alter the function of the keyboard itself, but records