An Empirical Assessment of Security and Privacy Risks of Web-Based Chatbots

Nazar Waheed, Muhammad Ikram, Saad Sajid Hashmi, Xiangjian He, Priyadarsi Nanda

Research output: Chapter in Book/Conference proceedingConference contributionpeer-review

2 Citations (Scopus)

Abstract

Web-based chatbots provide website owners with the benefits of increased sales, immediate response to their customers, and insight into customer behaviour. While Web-based chatbots are getting popular, they have not received much scrutiny from security researchers. The benefits to owners come at the cost of users’ privacy and security. Vulnerabilities, such as tracking cookies and third-party domains, can be hidden in the chatbot’s iFrame script. This paper presents a large-scale analysis of five Web-based chatbots among the top 1-million Alexa websites. Through our crawler tool, we identify the presence of chatbots in these 1-million websites. We discover that 13,392 out of the top 1- million Alexa websites (1.58%) use one of the five analysed chatbots. Our analysis reveals that the top 300k Alexa ranking websites are dominated by Intercom chatbots that embed the least number of third-party domains. LiveChat chatbots dominate the remaining websites and embed the highest samples of third-party domains. We also find that 721 (5.38%) web-based chatbots use insecure protocols to transfer users’ chats in plain text. Furthermore, some chatbots heavily rely on cookies for tracking and advertisement purposes. More than two-thirds (68.92%) of the identified cookies in chatbot iFrames are used for ads and tracking users. Our results show that, despite the promises for privacy, security, and anonymity given by most websites, millions of users may unknowingly be subject to poor security guarantees by chatbot service providers.

Original languageEnglish
Title of host publicationWeb Information Systems Engineering – WISE 2022 - 23rd International Conference, Proceedings
EditorsRichard Chbeir, Helen Huang, Fabrizio Silvestri, Yannis Manolopoulos, Yanchun Zhang, Yanchun Zhang
PublisherSpringer Science and Business Media Deutschland GmbH
Pages325-339
Number of pages15
ISBN (Print)9783031208904
DOIs
Publication statusPublished - 2022
Event23rd International Conference on Web Information Systems Engineering, WISE 2021 - Biarritz, France
Duration: 1 Nov 20223 Nov 2022

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume13724 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference23rd International Conference on Web Information Systems Engineering, WISE 2021
Country/TerritoryFrance
CityBiarritz
Period1/11/223/11/22

Keywords

  • Chatbot
  • Web privacy
  • Web-based chatbot

ASJC Scopus subject areas

  • Theoretical Computer Science
  • General Computer Science

Fingerprint

Dive into the research topics of 'An Empirical Assessment of Security and Privacy Risks of Web-Based Chatbots'. Together they form a unique fingerprint.

Cite this