[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
10.1145/3419394.3423664acmconferencesArticle/Chapter ViewAbstractPublication PagesimcConference Proceedingsconference-collections
research-article
Open access

Analyzing Third Party Service Dependencies in Modern Web Services: Have We Learned from the Mirai-Dyn Incident?

Published: 27 October 2020 Publication History

Abstract

Many websites rely on third parties for services (e.g., DNS, CDN, etc.). However, it also exposes them to shared risks from attacks (e.g., Mirai DDoS attack [24]) or cascading failures (e.g., GlobalSign revocation error [21]). Motivated by such incidents, we analyze the prevalence and impact of third-party dependencies, focusing on three critical infrastructure services: DNS, CDN, and certificate revocation checking by CA. We analyze both direct (e.g., Twitter uses Dyn) and indirect (e.g., Netflix uses Symantec as CA which uses Verisign for DNS) dependencies. We also take two snapshots in 2016 and 2020 to understand how the dependencies evolved. Our key findings are: (1) 89% of the Alexa top-100K websites critically depend on third-party DNS, CDN, or CA providers i.e., if these providers go down, these websites could suffer service disruption; (2) the use of third-party services is concentrated, and the top-3 providers of CDN, DNS, or CA services can affect 50%-70% of the top-100K websites; (3) indirect dependencies amplify the impact of popular CDN and DNS providers by up to 25X; and (4) some third-party dependencies and concentration increased marginally between 2016 to 2020. Based on our findings, we derive key implications for different stakeholders in the web ecosystem.

Supplementary Material

MP4 File (imc2020507long_01.mp4)
LOng and short videos for IMC Submission#507, including subtitles
MP4 File (imc2020507short_02.mp4)
The short video for the paper presenattion at IMC 2020. This is a teaser video.

References

[1]
Abhishta Abhishta, Roland van Rijswijk-Deij, and Lambert JM Nieuwenhuis. 2019. Measuring the impact of a successful DDoS attack on the customer behaviour of managed DNS service providers. ACM SIGCOMM Computer Communication Review 48, 5 (2019), 70--76.
[2]
Bernhard Ager, Wolfgang Mühlbauer, Georgios Smaragdakis, and Steve Uhlig. 2011. Web content cartography. In Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference.585--600.
[3]
Mark Allman. 2018. Comments on DNS robustness. In Proceedings of the Internet Measurement Conference 2018.84--90.
[4]
Samantha Bates, John Bowers, Shane Greenstein, Jordi Weinstock, Yunhan Xu, and Jonathan Zittrain. 2018. Evidence of Decreasing Internet Entropy: The Lack of Redundancy in DNS Resolution by Major Websites and Services. Technical Report. National Bureau of Economic Research.
[5]
Kris Beevers. 2016. A Note From NS1's CEO: How We Responded To Last Week's Major, Multi-Faceted DDoS Attacks. https://ns1.com/blog/how-we-responded-to-last-weeks-major-multi-faceted-ddos-attacks.
[6]
Hanno Bock. 2017. The Problem with OCSP Stapling and Must Staple and why Certificate Revocation is still broken, 2017. URL https://blog.hboeck. de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken. html (2017).
[7]
Michael Butkiewicz, Harsha V Madhyastha, and Vyas Sekar. 2011. Understanding website complexity: measurements, metrics, and implications. In Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference.313--328.
[8]
Matt Calder, Xun Fan, Zi Hu, Ethan Katz-Bassett, John Heidemann, and Ramesh Govindan. 2013. Mapping the expansion of Google's serving infrastructure. In Proceedings of the 2013 conference on Internet measurement conference.313--326.
[9]
Frank Cangialosi, Taejoong Chung, David Choffnes, Dave Levin, Bruce M Maggs, Alan Mislove, and Christo Wilson. 2016. Measurement and analysis of private key sharing in the https ecosystem. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security.628--640.
[10]
CDNFinder. 2020. Webapp and cli-tool to detect CDN usage of websites. https://github.com/turbobytes/cdnfinder. Accessed: May 23, 2020.
[11]
Ericka Chickowski. April 7, 2020. Cyberattacks Against Pandemic-Stressed Healthcare Organizations. https://securityboulevard.com/2020/04/7-cyberattacks-against-pandemic-stressed-healthcare-orgs/. Accessed: April 23, 2020.
[12]
David Choffnes, Jilong Wang, et al. 2017. CDNs meet CN an empirical study of CDN deployments in China. IEEE Access 5 (2017), 5292--5305.
[13]
Taejoong Chung, Yabing Liu, David Choffnes, Dave Levin, Bruce MacDowell Maggs, Alan Mislove, and Christo Wilson. 2016. Measuring and applying invalid SSL certificates: The silent majority. In Proceedings of the 2016 Internet Measurement Conference.527--541.
[14]
Taejoong Chung, Jay Lok, Balakrishnan Chandrasekaran, David Choffnes, Dave Levin, Bruce M Maggs, Alan Mislove, John Rula, Nick Sullivan, and Christo Wilson. 2018. Is the Web Ready for OCSP Must-Staple?. In Proceedings of the Internet Measurement Conference 2018.105--118.
[15]
Matteo Dell'Amico, Leyla Bilge, Ashwin Kayyoor, Petros Efstathopoulos, and Pierre-Antoine Vervier. 2017. Lean on me: Mining internet service dependencies from large-scale dns data. In Proceedings of the 33rd Annual Computer Security Applications Conference.449--460.
[16]
Digicert. 2020. DigiCert Completes Acquisition of Symantec's Website Security and Related PKI Solutions. https://www.digicert.com/news/digicert-completes-acquisition-of-symantec-ssl/.
[17]
Dyn Secondary DNS. May 23, 2020. Dyn Secondary DNS Information. https://help.dyn.com/standard-dns/dyn-secondary-dns-information/.
[18]
Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey, and J Alex Halderman. 2015. A search engine backed by Internet-wide scanning. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security.542--553.
[19]
Zakir Durumeric, Eric Wustrow, and J Alex Halderman. 2013. ZMap: Fast Internet-wide scanning and its security applications. In Presented as part of the 22nd {USENIX} Security Symposium ({USENIX} Security 13).605--620.
[20]
Fastly. October 21, 2016. Fastly outage. https://www.fastly.com/security-advisories/widespread-dyn-dns-outage-affecting-fastly-customers. Accessed: May 23, 2020.
[21]
GlobalSign October 13, 2016. Globalsign certificate revocation issue. https://www.globalsign.com/en/status. Accessed: May 23, 2020.
[22]
Ariya Hidayat et al. 2013. PhantomJS. Computer software. PhantomJS. Vers 1, 7 (2013).
[23]
Simon Hildrew and Jenny Sivapalan. 2016. Multiple DNS: synchronising Dyn to AWS Route 53. https://www.theguardian.com/info/developer-blog/2016/dec/23/multiple-dns-synchronising-dyn-to-aws-route-53.
[24]
Scott Hilton. Oct 26, 2016. Dyn analysis summary of friday october 21 attack. http://dyn.com/blog/dyn-analysis-summary-of-friday-october-21-attack/. Accessed: May 23, 2020.
[25]
Rand Hindi. February 28, 2017. Thanks for breaking our connected homes, Amazon. https://medium.com/snips-ai/thanks-for-breaking-our-connected-homes-amazon-c820a8849021.
[26]
Nguyen Phong Hoang, Arian Akhavan Niaki, Michalis Polychronakis, and Phillipa Gill. 2020. The web is still small after more than a decade. ACM SIGCOMM Computer Communication Review 50, 2 (2020), 24--31.
[27]
Hsu-Chun Hsiao, Tiffany Hyun-Jin Kim, Yu-Ming Ku, Chun-Ming Chang, Hung-Fang Chen, Yu-Jen Chen, Chun-Wen Wang, and Wei Jeng. 2019. An Investigation of Cyber Autonomy on Government Websites. In The World Wide Web Conference.2814--2821.
[28]
IETF. Mar 4, 2018. Consolidation. https://www.ietf.org/blog/consolidation/.
[29]
Muhammad Ikram, Rahat Masood, Gareth Tyson, Mohamed Ali Kaafar, Noha Loizon, and Roya Ensafi. 2019. The chain of implicit trust: An analysis of the web third-party resources loading. In The World Wide Web Conference.2851--2857.
[30]
Mattijs Jonker, Anna Sperotto, Roland van Rijswijk-Deij, Ramin Sadre, and Aiko Pras. 2016. Measuring the adoption of DDoS protection services. In Proceedings of the 2016 Internet Measurement Conference.279--285.
[31]
Peter Koch. 1999. Recommendations for DNS SOA Values. (1999).
[32]
Platon Kotzias, Abbas Razaghpanah, Johanna Amann, Kenneth G Paterson, Narseo Vallina-Rodriguez, and Juan Caballero. 2018. Coming of age: A longitudinal study of tls deployment. In Proceedings of the Internet Measurement Conference 2018.415--428.
[33]
Balachander Krishnamurthy and Craig Wills. 2009. Privacy diffusion on the web: a longitudinal perspective. In Proceedings of the 18th international conference on World wide web.541--550.
[34]
Balachander Krishnamurthy, Craig Wills, and Yin Zhang. 2001. On the use and performance of content distribution networks. In Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement.169--182.
[35]
Deepak Kumar, Zane Ma, Zakir Durumeric, Ariana Mirian, Joshua Mason, J Alex Halderman, and Michael Bailey. 2017. Security challenges in an increasingly tangled web. In Proceedings of the 26th International Conference on World Wide Web.677--684.
[36]
Adam Lerner, Anna Kornfeld Simpson, Tadayoshi Kohno, and Franziska Roesner. 2016. Internet jones and the raiders of the lost trackers: An archaeological study of web tracking from 1996 to 2016. In 25th {USENIX} Security Symposium ({USENIX} Security 16).
[37]
Zhichun Li, Ming Zhang, Zhaosheng Zhu, Yan Chen, Albert G Greenberg, and Yi-Min Wang. 2010. WebProphet: Automating Performance Prediction for Web Services. In NSDI, Vol. 10.143--158.
[38]
Public Suffix List. [n.d.]. Mozilla Public Suffix List.
[39]
Yabing Liu, Will Tome, Liang Zhang, David Choffnes, Dave Levin, Bruce Maggs, Alan Mislove, Aaron Schulman, and Christo Wilson. 2015. An end-to-end measurement of certificate revocation in the web's PKI. In Proceedings of the 2015 Internet Measurement Conference.183--196.
[40]
Shelby Livingston. October 21, 2016. Athenahealth, Allscripts websites down amid nationwide hack. https://www.modernhealthcare.com/article/20161021/NEWS/161029973/athenahealth-allscripts-websites-down-amid-nationwide-hack.
[41]
Chaoyi Lu, Baojun Liu, Zhou Li, Shuang Hao, Haixin Duan, Mingming Zhang, Chunying Leng, Ying Liu, Zaifeng Zhang, and Jianping Wu. 2019. An End-to-End, Large-Scale Measurement of DNS-over-Encryption: How Far Have We Come?. In Proceedings of the Internet Measurement Conference.22--35.
[42]
Srdjan Matic, Gareth Tyson, and Gianluca Stringhini. 2019. Pythia: a Framework for the Automated Analysis of Web Hosting Environments. In The World Wide Web Conference.3072--3078.
[43]
Tobias Mueller, Daniel Klotzsche, Dominik Herrmann, and Hannes Federrath. 2019. Dangers and Prevalence of Unprotected Web Fonts. In 2019 International Conference on Software, Telecommunications and Computer Networks (SoftCOM). IEEE, 1--5.
[44]
Multi-CDN. 2020. Multi-CDN Strategies. https://ns1.com/multi-cdn.
[45]
Arun Natarajan, Peng Ning, Yao Liu, Sushil Jajodia, and Steve E Hutchinson. 2012. NSDMiner: Automated discovery of network service dependencies. IEEE.
[46]
Newsweek. 2020. Top Hospitals in the U.S. https://www.newsweek.com/best-hospitals-2020/united-states. Accessed: May 23, 2020.
[47]
Nick Nikiforakis, Luca Invernizzi, Alexandros Kapravelos, Steven Van Acker, Wouter Joosen, Christopher Kruegel, Frank Piessens, and Giovanni Vigna. 2012. You are what you include: large-scale evaluation of remote javascript inclusions. In Proceedings of the 2012 ACM conference on Computer and communications security.736--747.
[48]
Karlis Podins and Arturs Lavrenovs. 2018. Security Implications of Using Third-Party Resources in the World Wide Web. In 2018 IEEE 6th Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE). IEEE, 1--6.
[49]
Alexa Traffic Rank. 2020. List of most popular web sites.
[50]
Dark Reading. October 24, 2019. Eight-Hour DDoS Attack Struck AWS Customers. https://www.darkreading.com/cloud/eight-hour-ddos-attack-struck-aws-customers/d/d-id/1336165. Accessed: May 20, 2020.
[51]
Franziska Roesner, Tadayoshi Kohno, and David Wetherall. 2012. Detecting and defending against third-party tracking on the web. In Presented as part of the 9th {USENIX} Symposium on Networked Systems Design and Implementation ({NSDI} 12).155--168.
[52]
Jukka Ruohonen, Joonas Salovaara, and Ville Leppänen. 2018. Crossing cross-domain paths in the current web. In 2018 16th Annual Conference on Privacy, Security and Trust (PST). IEEE, 1--5.
[53]
Quirin Scheitle, Oliver Hohlfeld, Julien Gamba, Jonas Jelten, Torsten Zimmermann, Stephen D Strowes, and Narseo Vallina-Rodriguez. 2018. A long way to the top: Significance, structure, and stability of internet top lists. In Proceedings of the Internet Measurement Conference 2018.478--493.
[54]
Catherine Shu. February 24, 2020. Petnet's smart pet feeder system is back after a week-long outage. https://techcrunch.com/2020/02/24/petnets-smart-pet-feeder-system-is-back-after-a-week-long-outage-but-customers-are-still-waiting-for-answers/.
[55]
Milivoj Simeonovski, Giancarlo Pellegrino, Christian Rossow, and Michael Backes. 2017. Who controls the internet? analyzing global threats using property graph traversals. In Proceedings of the 26th International Conference on World Wide Web.647--656.
[56]
Rachee Singh, Arun Dunna, and Phillipa Gill. 2018. Characterizing the deployment and performance of multi-cdns. In Proceedings of the Internet Measurement Conference 2018.168--174.
[57]
Internet Society. February 26, 2019. Consolidation in the Internet Economy. https://www.internetsociety.org/news/press-releases/2019/internet-society-launches-research-project-to-understand-the-effects-of-consolidation-in-the-internet-economy/.
[58]
Akamai Multi-CDN Support. 2020. Akamai - We offer support for multiple CDNs. https://learn.akamai.com/en-us/webhelp/media-acceleration/media-acceleration-sdk-integration-guide-for-javascript/GUID-E246743C-703D-4885-B934-171788539187.html.
[59]
Fastly Multi-CDN Support. 2020. Fastly Launches Cloud Optimizer to Boost Observability and Control in Multi-Cloud and Multi-CDN Infrastructures. https://www.fastly.com/press/press-releases/fastly-launches-cloud-optimizer-boost-observability-and-control-multi-cloud-and-multi-cdn-infrastructures.
[60]
Samaneh Tajalizadehkhoob, Maciej Korczyński, Arman Noroozian, Carlos Ganán, and Michel van Eeten. 2016. Apples, oranges and hosting providers: Heterogeneity and security in the hosting market. In NOMS 2016-2016 IEEE/IFIP Network Operations and Management Symposium. IEEE, 289--297.
[61]
Kevin C. Tofel. February 26, 2020. It's time for smart home devices to have local failover options during cloud outages. https://staceyoniot.com/smart-home-devices-cloud-outage-vs-local/.
[62]
Tobias Urban, Martin Degeling, Thorsten Holz, and Norbert Pohlmann. 2020. Beyond the front page: Measuring third party dynamics in the field. In Proceedings of The Web Conference 2020.1275--1286.
[63]
Benjamin VanderSloot, Johanna Amann, Matthew Bernhard, Zakir Durumeric, Michael Bailey, and J Alex Halderman. 2016. Towards a complete view of the certificate ecosystem. In Proceedings of the 2016 Internet Measurement Conference.543--549.
[64]
Xiao Sophia Wang, Aruna Balasubramanian, Arvind Krishnamurthy, and David Wetherall. 2013. Demystifying page load performance with WProf. In Presented as part of the 10th {USENIX} Symposium on Networked Systems Design and Implementation ({NSDI} 13).473--485.
[65]
webXray. June 29, 2018. webXray Domain Owner List. https://github.com/timlib/webXray_Domain_Owner_List.
[66]
Eric A Young, Tim J Hudson, and R Engelschall. 2011. Openssl: The open source toolkit for ssl/tls.
[67]
Liang Zhu, Johanna Amann, and John Heidemann. 2016. Measuring the latency and pervasiveness of TLS certificate revocation. In International Conference on Passive and Active Network Measurement. Springer, 16--29.

Cited By

View all
  • (2024)CAMPProceedings of the 33rd USENIX Conference on Security Symposium10.5555/3698900.3699223(5769-5786)Online publication date: 14-Aug-2024
  • (2024)TANGOProceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation10.5555/3691825.3691923(1791-1811)Online publication date: 16-Apr-2024
  • (2024)Evaluating the Impact of Design Decisions on Passive DNS-Based Domain Rankings2024 8th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA62044.2024.10559182(1-11)Online publication date: 21-May-2024
  • Show More Cited By

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences
IMC '20: Proceedings of the ACM Internet Measurement Conference
October 2020
751 pages
ISBN:9781450381383
DOI:10.1145/3419394
This work is licensed under a Creative Commons Attribution International 4.0 License.

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 27 October 2020

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. CDN
  2. DDoS
  3. DNS
  4. OCSP
  5. redundancy
  6. third-party dependency

Qualifiers

  • Research-article
  • Research
  • Refereed limited

Conference

IMC '20
IMC '20: ACM Internet Measurement Conference
October 27 - 29, 2020
Virtual Event, USA

Acceptance Rates

IMC '20 Paper Acceptance Rate 53 of 216 submissions, 25%;
Overall Acceptance Rate 277 of 1,083 submissions, 26%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)1,366
  • Downloads (Last 6 weeks)188
Reflects downloads up to 06 Jan 2025

Other Metrics

Citations

Cited By

View all
  • (2024)CAMPProceedings of the 33rd USENIX Conference on Security Symposium10.5555/3698900.3699223(5769-5786)Online publication date: 14-Aug-2024
  • (2024)TANGOProceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation10.5555/3691825.3691923(1791-1811)Online publication date: 16-Apr-2024
  • (2024)Evaluating the Impact of Design Decisions on Passive DNS-Based Domain Rankings2024 8th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA62044.2024.10559182(1-11)Online publication date: 21-May-2024
  • (2024)ResLake: Towards Minimum Job Latency and Balanced Resource Utilization in Geo-Distributed Job SchedulingProceedings of the VLDB Endowment10.14778/3685800.368581717:12(3934-3946)Online publication date: 8-Nov-2024
  • (2024)DNS Congestion Control in Adversarial SettingsProceedings of the ACM SIGOPS 30th Symposium on Operating Systems Principles10.1145/3694715.3695982(726-747)Online publication date: 4-Nov-2024
  • (2024)Of Choices and Control - A Comparative Analysis of Government HostingProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688447(462-479)Online publication date: 4-Nov-2024
  • (2024)Deep Dive into NTP Pool's Popularity and MappingProceedings of the ACM on Measurement and Analysis of Computing Systems10.1145/36390418:1(1-30)Online publication date: 21-Feb-2024
  • (2024)Is a Trustmark and QR Code Enough? The Effect of IoT Security and Privacy Label Information Complexity on Consumer Comprehension and BehaviorProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642011(1-32)Online publication date: 11-May-2024
  • (2024)DID Link: Authentication in TLS with Decentralized Identifiers and Verifiable Credentials2024 21st Annual International Conference on Privacy, Security and Trust (PST)10.1109/PST62714.2024.10788053(1-11)Online publication date: 28-Aug-2024
  • (2024)Robust or Risky: Measurement and Analysis of Domain Resolution DependencyIEEE INFOCOM 2024 - IEEE Conference on Computer Communications10.1109/INFOCOM52122.2024.10621098(161-170)Online publication date: 20-May-2024
  • Show More Cited By

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media