arXiv subjects

Jason Polakis

Publications and source records attributed to Jason Polakis.

4 recordsLinked to original sources

arXiv2026

Exploring Privacy Leakage and Data Disclosure Violations in the MacOS Application Ecosystem

The systematic and excessive data collection practices of tech companies have rendered online privacy both a necessity and a sought-after commodity. However, while the privacy risks of the web, mobile, and IoT ecosystems have been extensively examined, desktop environments have been largely overlooked. As desktop apps continue to be widely used, they remain a critical yet understudied dimension of user privacy. In this paper, we address this gap by presenting the first, to our knowledge, comprehensive study of the mechanisms designed to regulate and disclose data collection and sharing practices in the macOS ecosystem. We adopt an app-development-centric view, and shed light on the interactions between the various macOS mechanisms that mediate apps' data access. Driven by our findings, we develop NutriScan, an analysis framework that incorporates both static and dynamic analysis techniques to create a consolidated view of macOS apps' data practices and disclosures. We use our system to dynamically analyze 1K macOS apps, and find that 85% of them access user-data APIs without disclosing it. 49.7% also exfiltrate data to advertising entities and hosting providers, 12.5% of which do so without a corresponding disclosure. We find that desktop apps are being leveraged by online trackers to enrich user profiles and device fingerprints, thus shedding new light on the true scope of the online tracking ecosystem. Our analysis reveals how the macOS app ecosystem is comprised of disjoint mechanisms with divergent data abstractions, thus increasing complexity for developers while also facilitating undisclosed privacy-invasive practices. Accordingly, we propose a series of mitigations that aim to both streamline the data disclosure process for developers and improve Apple's app vetting process.

cs.CR↗

arXiv2025

SoK: Advances and Open Problems in Web Tracking

Web tracking is a pervasive and opaque practice that enables personalized advertising, retargeting, and conversion tracking. Over time, it has evolved into a sophisticated and invasive ecosystem, employing increasingly complex techniques to monitor and profile users across the web. The research community has a long track record of analyzing new web tracking techniques, designing and evaluating the effectiveness of countermeasures, and assessing compliance with privacy regulations. Despite a substantial body of work on web tracking, the literature remains fragmented across distinctly scoped studies, making it difficult to identify overarching trends, connect new but related techniques, and identify research gaps in the field. Today, web tracking is undergoing a once-in-a-generation transformation, driven by fundamental shifts in the advertising industry, the adoption of anti-tracking countermeasures by browsers, and the growing enforcement of emerging privacy regulations. This Systematization of Knowledge (SoK) aims to consolidate and synthesize this wide-ranging research, offering a comprehensive overview of the technical mechanisms, countermeasures, and regulations that shape the modern and rapidly evolving web tracking landscape. This SoK also highlights open challenges and outlines directions for future research, aiming to serve as a unified reference and introductory material for researchers, practitioners, and policymakers alike.

cs.CR↗

arXiv2019

Deep Complex Networks for Protocol-Agnostic Radio Frequency Device Fingerprinting in the Wild

Researchers have demonstrated various techniques for fingerprinting and identifying devices. Previous approaches have identified devices from their network traffic or transmitted signals while relying on software or operating system specific artifacts (e.g., predictability of protocol header fields) or characteristics of the underlying protocol (e.g.,frequency offset). As these constraints can be a hindrance in real-world settings, we introduce a practical, generalizable approach that offers significant operational value for a variety of scenarios, including as an additional factor of authentication for preventing impersonation attacks. Our goal is to identify artifacts in transmitted signals that are caused by a device's unique hardware "imperfections" without any knowledge about the nature of the signal. We develop RF-DCN, a novel Deep Complex-valued Neural Network (DCN) that operates on raw RF signals and is completely agnostic of the underlying applications and protocols. We present two DCN variations: (i) Convolutional DCN (CDCN) for modeling full signals, and (ii) Recurrent DCN (RDCN) for modeling time series. Our system handles raw I/Q data from open air captures within a given spectrum window, without knowledge of the modulation scheme or even the carrier frequencies. While our experiments demonstrate the effectiveness of our system, especially under challenging conditions where other neural network architectures break down, we identify additional challenges in signal-based fingerprinting and provide guidelines for future explorations. Our work lays the foundation for more research within this vast and challenging space by establishing fundamental directions for using raw RF I/Q data in novel complex-valued networks.

cs.CR↗

arXiv2019

Please Forget Where I Was Last Summer: The Privacy Risks of Public Location (Meta)Data

The exposure of location data constitutes a significant privacy risk to users as it can lead to de-anonymization, the inference of sensitive information, and even physical threats. In this paper we present LPAuditor, a tool that conducts a comprehensive evaluation of the privacy loss caused by publicly available location metadata. First, we demonstrate how our system can pinpoint users' key locations at an unprecedented granularity by identifying their actual postal addresses. Our experimental evaluation on Twitter data highlights the effectiveness of our techniques which outperform prior approaches by 18.9%-91.6% for homes and 8.7%-21.8% for workplaces. Next we present a novel exploration of automated private information inference that uncovers "sensitive" locations that users have visited (pertaining to health, religion, and sex/nightlife). We find that location metadata can provide additional context to tweets and thus lead to the exposure of private information that might not match the users' intentions. We further explore the mismatch between user actions and information exposure and find that older versions of the official Twitter apps follow a privacy-invasive policy of including precise GPS coordinates in the metadata of tweets that users have geotagged at a coarse-grained level (e.g., city). The implications of this exposure are further exacerbated by our finding that users are considerably privacy-cautious in regards to exposing precise location data. When users can explicitly select what location data is published, there is a 94.6% reduction in tweets with GPS coordinates. As part of current efforts to give users more control over their data, LPAuditor can be adopted by major services and offered as an auditing tool that informs users about sensitive information they (indirectly) expose through location metadata.

cs.CY↗