Lantern to the Underworld - Following User Actions Using Bing URL Parameters When Child Exploitation Terms Are Suggested by the Search Engine

Simple item page
dc.contributor.author Spear, Nicholas
dc.contributor.author Hawbecker, David
dc.contributor.author Mcelyea, Benjamin
dc.date.accessioned 2021-12-24T18:28:55Z
dc.date.available 2021-12-24T18:28:55Z
dc.date.issued 2022-01-04
dc.description.abstract During a 2016 criminal investigation overseen by the authors, a discovery was made that the Bing search engine was suggesting search terms known to be associated with child exploitation materials. This was in response to a non-contraband search by a subject, leading to increasingly explicit suggestions. This information led to the discovery that, with a user’s browser history files, the specific actions taken by a user could be isolated and tracked using Bing’s own unique URL parameters. While the suggestion of contraband terms by the Bing search engine has since ceased, there has been little to no research conducted on analyzing a user’s browser activity in order to determine their specific actions behind the keyboard through the use of these unique URL parameters. The purpose of this paper is to document Bing’s URL parameters related to image searches (specifically the FORM parameter) in order to detail how a user’s actions during searching may be determined by an analyst. The authors also provide a new tool for creating a timeline of Bing image search events when an analyst possesses a user’s browser history files.
dc.format.extent 7 pages
dc.identifier.doi 10.24251/HICSS.2022.906
dc.identifier.isbn 978-0-9981331-5-7
dc.identifier.uri http://hdl.handle.net/10125/80248
dc.language.iso eng
dc.relation.ispartof Proceedings of the 55th Hawaii International Conference on System Sciences
dc.rights Attribution-NonCommercial-NoDerivatives 4.0 International
dc.rights.uri https://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subject Cyber Operations, Defence, and Forensics
dc.title Lantern to the Underworld - Following User Actions Using Bing URL Parameters When Child Exploitation Terms Are Suggested by the Search Engine
dc.type.dcmi text
Files
Original bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
0736.pdf
Size:
467.97 KB
Format:
Adobe Portable Document Format
Description:
Download
Collections
Cyber Operations, Defence, and Forensics