Measuring Privacy Threats in China-Wide Mobile Networks


Mingming Zhang, Baojun Liu, Chaoyi Lu, and Jia Zhang, Tsinghua University; Shuang Hao, University of Texas at Dallas; Haixin Duan, Tsinghua University


HTTP transparent proxies are widely deployed in mobile networks and can lead to potential security and privacy issues. HTTP traffic is increasingly subject to in-path manipulation, especially in cellular networks. Although the traffic manipulation behavior has been studied for long, little has been understood about the manipulation and privacy concerns that arise on networks in China, due to the limitations in measurement vantage points. In this work, we aim to fill this research gap by collecting large-scale HTTP sessions originating from China-wide mobile networks, and investigating potential privacy threats caused by HTTP transparent proxy devices. Our findings are multi-faceted. First, contents of web pages can be modified by proxy devices, which are replaced by or injected with advertisements. Second, HTTP headers with user-related and device-related data are injected into HTTP requests, which raises privacy concerns. In particular, we also find HTTP headers that embed exploit codes. Our study sheds light on the HTTP traffic manipulation behavior in China-wide mobile networks, and discusses related privacy threats.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

@inproceedings {220444,
author = {Mingming Zhang and Baojun Liu and Chaoyi Lu and Jia Zhang and Shuang Hao and Haixin Duan},
title = {Measuring Privacy Threats in {China-Wide} Mobile Networks},
booktitle = {8th USENIX Workshop on Free and Open Communications on the Internet (FOCI 18)},
year = {2018},
address = {Baltimore, MD},
url = {},
publisher = {USENIX Association},
month = aug