Cloak of Visibility: Detecting When Machines Browse A Different Web Luca Invernizzi∗, Kurt Thomas∗, Alexandros Kapravelosy, Oxana Comanescu∗, Jean-Michel Picod∗, and Elie Bursztein∗ ∗Google, Inc. finvernizzi, kurtthomas, elieb, oxana,
[email protected] yNorth Carolina State University
[email protected] Abstract—The contentious battle between web services and a limited set of known cloaking techniques. These include miscreants involved in blackhat search engine optimization and redirect cloaking in search engine results [16], [18], [24], malicious advertisements has driven the underground to develop [27], [33], [34] or search visitor profiling based on the increasingly sophisticated techniques that hide the true nature of malicious sites. These web cloaking techniques hinder the User-Agent and Referer of HTTP requests [32], [35]. effectiveness of security crawlers and potentially expose Internet An open question remains as to what companies and crawlers users to harmful content. In this work, we study the spectrum blackhat cloaking software targets, the capabilities necessary of blackhat cloaking techniques that target browser, network, or for security practitioners to bypass state of the art cloaking, contextual cues to detect organic visitors. As a starting point, we and ultimately whether blackhat techniques generalize across investigate the capabilities of ten prominent cloaking services marketed within the underground. This includes a first look traffic sources including search results and advertisements. at multiple IP blacklists