TY - GEN
T1 - An Empirical Assessment of Security and Privacy Risks of Web-Based Chatbots
AU - Waheed, Nazar
AU - Ikram, Muhammad
AU - Hashmi, Saad Sajid
AU - He, Xiangjian
AU - Nanda, Priyadarsi
N1 - Publisher Copyright:
© 2022, The Author(s), under exclusive license to Springer Nature Switzerland AG.
PY - 2022
Y1 - 2022
N2 - Web-based chatbots provide website owners with the benefits of increased sales, immediate response to their customers, and insight into customer behaviour. While Web-based chatbots are getting popular, they have not received much scrutiny from security researchers. The benefits to owners come at the cost of users’ privacy and security. Vulnerabilities, such as tracking cookies and third-party domains, can be hidden in the chatbot’s iFrame script. This paper presents a large-scale analysis of five Web-based chatbots among the top 1-million Alexa websites. Through our crawler tool, we identify the presence of chatbots in these 1-million websites. We discover that 13,392 out of the top 1- million Alexa websites (1.58%) use one of the five analysed chatbots. Our analysis reveals that the top 300k Alexa ranking websites are dominated by Intercom chatbots that embed the least number of third-party domains. LiveChat chatbots dominate the remaining websites and embed the highest samples of third-party domains. We also find that 721 (5.38%) web-based chatbots use insecure protocols to transfer users’ chats in plain text. Furthermore, some chatbots heavily rely on cookies for tracking and advertisement purposes. More than two-thirds (68.92%) of the identified cookies in chatbot iFrames are used for ads and tracking users. Our results show that, despite the promises for privacy, security, and anonymity given by most websites, millions of users may unknowingly be subject to poor security guarantees by chatbot service providers.
AB - Web-based chatbots provide website owners with the benefits of increased sales, immediate response to their customers, and insight into customer behaviour. While Web-based chatbots are getting popular, they have not received much scrutiny from security researchers. The benefits to owners come at the cost of users’ privacy and security. Vulnerabilities, such as tracking cookies and third-party domains, can be hidden in the chatbot’s iFrame script. This paper presents a large-scale analysis of five Web-based chatbots among the top 1-million Alexa websites. Through our crawler tool, we identify the presence of chatbots in these 1-million websites. We discover that 13,392 out of the top 1- million Alexa websites (1.58%) use one of the five analysed chatbots. Our analysis reveals that the top 300k Alexa ranking websites are dominated by Intercom chatbots that embed the least number of third-party domains. LiveChat chatbots dominate the remaining websites and embed the highest samples of third-party domains. We also find that 721 (5.38%) web-based chatbots use insecure protocols to transfer users’ chats in plain text. Furthermore, some chatbots heavily rely on cookies for tracking and advertisement purposes. More than two-thirds (68.92%) of the identified cookies in chatbot iFrames are used for ads and tracking users. Our results show that, despite the promises for privacy, security, and anonymity given by most websites, millions of users may unknowingly be subject to poor security guarantees by chatbot service providers.
KW - Chatbot
KW - Web privacy
KW - Web-based chatbot
UR - http://www.scopus.com/inward/record.url?scp=85142674397&partnerID=8YFLogxK
U2 - 10.1007/978-3-031-20891-1_23
DO - 10.1007/978-3-031-20891-1_23
M3 - Conference contribution
AN - SCOPUS:85142674397
SN - 9783031208904
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 325
EP - 339
BT - Web Information Systems Engineering – WISE 2022 - 23rd International Conference, Proceedings
A2 - Chbeir, Richard
A2 - Huang, Helen
A2 - Silvestri, Fabrizio
A2 - Manolopoulos, Yannis
A2 - Zhang, Yanchun
A2 - Zhang, Yanchun
PB - Springer Science and Business Media Deutschland GmbH
T2 - 23rd International Conference on Web Information Systems Engineering, WISE 2021
Y2 - 1 November 2022 through 3 November 2022
ER -