Measuring Privacy Threats in China-Wide Mobile Networks

HTTP transparent proxies are widely deployed in mobile networks and can lead to potential security and privacy issues. HTTP traffic is increasingly subject to in-path manipulation, especially in cellular networks. Although the traffic manipulation behavior has been studied for long, little has been understood about the manipulation and privacy concerns that arise on networks in China, due to the limitations in measurement vantage points. In this work, we aim to fill this research gap by collecting large-scale HTTP sessions originating from China-wide mobile networks, and investigating potential privacy threats caused by HTTP transparent proxy devices. Our findings are multi-faceted. First, contents of web pages can be modified by proxy devices, which are replaced by or injected with advertisements. Second, HTTP headers with user-related and device-related data are injected into HTTP requests, which raises privacy concerns. In particular, we also find HTTP headers that embed exploit codes. Our study sheds light on the HTTP traffic manipulation behavior in China-wide mobile networks, and discusses related privacy threats.