Skip to main content
SpringerLink
Log in

An Empirical Assessment of Security and Privacy Risks of Web-Based Chatbots

  • Conference paper
  • First Online:
Web Information Systems Engineering – WISE 2022 (WISE 2022)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13724))

Included in the following conference series:

Abstract

Web-based chatbots provide website owners with the benefits of increased sales, immediate response to their customers, and insight into customer behaviour. While Web-based chatbots are getting popular, they have not received much scrutiny from security researchers. The benefits to owners come at the cost of users’ privacy and security. Vulnerabilities, such as tracking cookies and third-party domains, can be hidden in the chatbot’s iFrame script. This paper presents a large-scale analysis of five Web-based chatbots among the top 1-million Alexa websites. Through our crawler tool, we identify the presence of chatbots in these 1-million websites. We discover that 13,392 out of the top 1- million Alexa websites (1.58%) use one of the five analysed chatbots. Our analysis reveals that the top 300k Alexa ranking websites are dominated by Intercom chatbots that embed the least number of third-party domains. LiveChat chatbots dominate the remaining websites and embed the highest samples of third-party domains. We also find that 721 (5.38%) web-based chatbots use insecure protocols to transfer users’ chats in plain text. Furthermore, some chatbots heavily rely on cookies for tracking and advertisement purposes. More than two-thirds (68.92%) of the identified cookies in chatbot iFrames are used for ads and tracking users. Our results show that, despite the promises for privacy, security, and anonymity given by most websites, millions of users may unknowingly be subject to poor security guarantees by chatbot service providers.

This research is supported by the Australian Government Research Training Program Scholarship.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 84.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://eluminoustechnologies.com.

  2. 2.

    https://pypi.org/project/tldextract/.

  3. 3.

    Drift = 3, Livechat = 10, Hubspot = 145, Tidio = 4, Intercom = 1.

References

  1. Angular - a platform for building mobile and desktop web applications (2022). https://angular.io

  2. Intercom cookie policy (2022). https://www.intercom.com/legal/cookie-policy

  3. React - a Javascript library for building user interfaces (2022). https://reactjs.org

  4. Web filter lookup (2022). https://www.fortiguard.com/webfilter

  5. Brooks, A.: 10 best chatbot builders in 2022 (2022). https://www.ventureharbour.com/best-chatbot-builders/

  6. Amazon: Alexa top websites (2022). https://www.alexa.com/topsites

  7. Andreou, A., Silva, M., Benevenuto, F., Goga, O., Loiseau, P., Mislove, A.: Measuring the Facebook advertising ecosystem. In: Network and Distribution Systems Security Symposium, San Diego (2019)

    Google Scholar 

  8. Andreou, A., Venkatadri, G., Goga, O., Gummadi, K.P., Loiseau, P., Mislove, A.: Investigating Ad transparency mechanisms in social media: a case study of Facebook’s explanations. In: NDSS, San Diego (2018)

    Google Scholar 

  9. Balkhi, S.: 14 best AI chatbots software for your website (compared) (2021). https://www.wpbeginner.com/showcase/best-chatbots-software-ai/

  10. Barker, S.: 15 best AI chatbot platforms to boost your conversations in 2022 (2021). https://shanebarker.com/blog/best-ai-chatbot/

  11. Bhuiyan, M.S.I., Razzak, A., Ferdous, M.S., Chowdhury, M.J.M., Hoque, M.A., Tarkoma, S.: BONIK: a blockchain empowered chatbot for financial transactions. In: TrustCom (2020)

    Google Scholar 

  12. Biswas, D.: Privacy preserving chatbot conversations. In: Proceedings - 2020 IEEE 3rd International Conference on Artificial Intelligence and Knowledge Engineering, AIKE 2020, pp. 179–182 (2020). https://doi.org/10.1109/AIKE48582.2020.00035

  13. Bozic, J., Wotawa, F.: Security testing for chatbots. In: Medina-Bulo, I., Merayo, M.G., Hierons, R. (eds.) ICTSS 2018. LNCS, vol. 11146, pp. 33–38. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-99927-2_3

    Chapter  Google Scholar 

  14. Carter, E., Knol, C.: Chatbot - an organisation’s friend or foe? Res. Hospitality Manag. 9(2), 113–115 (2019)

    Article  Google Scholar 

  15. Cook, J., Nithyanand, R., Shafiq, Z.: Inferring tracker-advertiser relationships in the online advertising ecosystem using header bidding. arXiv preprint arXiv:1907.07275 (2019)

  16. Ghosh, A., Venkatadri, G., Mislove, A., Kharagpur, I.: Analyzing political advertisers’ use of Facebook’s targeting features. In: Workshop on Technology and Consumer Protection (ConPro 2019) (2019). https://facebook-targeting.ccs.neu.edu

  17. Gondaliya, K., Butakov, S., Zavarsky, P.: SLA as a mechanism to manage risks related to chatbot services. In: IEEE International Conference on Intelligent Data and Security (2020). https://doi.org/10.1109/BigDataSecurity-HPSC-IDS49724.2020.00050

  18. Group, Z.: Top 10 best AI chatbots (2020). https://medium.datadriveninvestor.com/top-10-best-ai-chatbots-f68705a8f559

  19. Hashmi, S.S., Ikram, M., Kaafar, M.A.: A longitudinal analysis of online ad-blocking blacklists. In: 2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), pp. 158–165. IEEE (2019)

    Google Scholar 

  20. Hashmi, S.S., Ikram, M., Smith, S.: On optimization of ad-blocking lists for mobile devices. In: Proceedings of the 16th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, MobiQuitous 2019, pp. 220–227 (2019). https://doi.org/10.1145/3360774.3360830

  21. Hashmi, S.S., Waheed, N., Tangari, G., Ikram, M., Smith, S.: Longitudinal compliance analysis of android applications with privacy policies. In: Hara, T., Yamaguchi, H. (eds.) MobiQuitous 2021. LNICST, vol. 419, pp. 280–305. Springer, Cham (2022). https://doi.org/10.1007/978-3-030-94822-1_16

    Chapter  Google Scholar 

  22. HubSpot: Cookies set on HubSpot’s websites (2022). https://knowledge.hubspot.com/account/hubspot-cookie-security-and-privacy

  23. Ikram, M., Asghar, H.J., Kaafar, M.A., Mahanti, A., Krishnamurthy, B.: Towards seamless tracking-free web: improved detection of trackers via one-class learning. Proc. Priv. Enhancing Technol. 2017(1), 79–99 (2016). https://doi.org/10.1515/popets-2017-0006

    Article  Google Scholar 

  24. Ikram, M., Kaafar, M.A.: A first look at mobile Ad-Blocking apps. In: 2017 IEEE 16th International Symposium on Network Computing and Applications, NCA 2017, pp. 1–8 (2017). https://doi.org/10.1109/NCA.2017.8171376

  25. Ikram, M., Masood, R., Tyson, G., Kaafar, M.A., Loizon, N., Ensafi, R.: The chain of implicit trust: an analysis of the web third-party resources loading (2019). https://doi.org/10.1145/3308558.3313521

  26. Ikram, M., Vallina-Rodriguez, N., Seneviratne, S., Kaafar, M.A., Paxson, V.: An analysis of the privacy and security risks of Android VPN permission-enabled apps, pp. 349–364 (2016). https://doi.org/10.1145/2987443.2987471

  27. Drift Inc.: What is the drift cookie security and privacy policy? (2019). https://gethelp.drift.com/hc/en-us/articles/360019665133-What-is-the-Drift-Cookie-Security-and-Privacy-Policy-

  28. Legal Inc.: Privacy policy (2021). https://www.livechat.com/legal/privacy-policy/

  29. Tidio Inc.: Privacy policy (2021). https://www.tidio.com/privacy-policy/

  30. Ischen, C., Araujo, T., Voorveld, H., van Noort, G., Smit, E.: Privacy concerns in chatbot interactions. In: Følstad, A., et al. (eds.) CONVERSATIONS 2019. LNCS, vol. 11970, pp. 34–48. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-39540-7_3

    Chapter  Google Scholar 

  31. Ivanov, S., Webster, C.: Adoption of robots, artificial intelligence and service automation by travel, tourism and hospitality companies - a cost-benefit analysis. In: International Scientific Conference “Contemporary Tourism - Traditions and Innovations”, 19–21 October 2017, Sofia University, pp. 1–9 (2017)

    Google Scholar 

  32. Lal, I.: 13 best chatbots to transform your conversation landscape in 2022 (2022). https://surveysparrow.com/blog/best-chatbot-platforms/

  33. Leah: The 8 best chatbots of 2022 (2022). https://www.userlike.com/en/blog/best-chatbots

  34. Masood, R., Vatsalan, D., Ikram, M., Kaafar, M.A.: Incognito: a method for obfuscating web data, pp. 267–276 (2018)

    Google Scholar 

  35. Michiels, E.: Modelling chatbots with a cognitive system allows for a differentiating user experience. In: PoEM Doctoral Consortium (2017)

    Google Scholar 

  36. Shawar, B.A., Atwell, E.: Chatbots: are they really useful? LDV Forum 22, 29–49 (2007)

    Google Scholar 

  37. Starov, O., Gill, P., Nikiforakis, N.: Are you sure you want to contact us? Quantifying the leakage of PII via website contact forms. PETS 2016(1), 20–33 (2015)

    Google Scholar 

  38. Venkatadri, G., Lucherini, E., Sapiezynski, P., Mislove, A.: Proceedings on Privacy Enhancing Technologies (2019). https://doi.org/10.2478/popets-2019-0013

  39. Geyser, W.: Best AI chatbot platforms for 2022 (2022). https://influencermarketinghub.com/ai-chatbot-platforms/

  40. Ye, W., Li, Q.: Chatbot security and privacy in the age of personal assistants. In: Proceedings - 2020 IEEE/ACM Symposium on Edge Computing, SEC 2020, pp. 388–393 (2020). https://doi.org/10.1109/SEC50012.2020.00057

Download references

Author information

Authors and Affiliations

  1. University of Technology Sydney, Ultimo, NSW, 2007, Australia

    Nazar Waheed & Priyadarsi Nanda

  2. Macquarie University, Macquarie Park, NSW, 2109, Australia

    Muhammad Ikram

  3. University of Wollongong, Wollongong, NSW, 2522, Australia

    Saad Sajid Hashmi

  4. CSIRO’s Data61, Sydney, Australia

    Saad Sajid Hashmi

  5. University of Nottingham Ningbo China, Ningbo, China

    Xiangjian He

Authors
  1. Nazar Waheed
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Muhammad Ikram
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Saad Sajid Hashmi
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Xiangjian He
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Priyadarsi Nanda
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Nazar Waheed .

Editor information

Editors and Affiliations

  1. University of Pau and Pays de l'Adour, Anglet, France

    Richard Chbeir

  2. The University of Queensland, Brisbane, QLD, Australia

    Helen Huang

  3. Sapienza Università di Roma, Rome, Italy

    Fabrizio Silvestri

  4. Open University of Cyprus, Nicosia, Cyprus

    Yannis Manolopoulos

  5. The New Cyber Research Department, Peng Cheng Laboratory, Shenzhen, China

    Yanchun Zhang

Rights and permissions

Reprints and permissions

Copyright information

© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Waheed, N., Ikram, M., Hashmi, S.S., He, X., Nanda, P. (2022). An Empirical Assessment of Security and Privacy Risks of Web-Based Chatbots. In: Chbeir, R., Huang, H., Silvestri, F., Manolopoulos, Y., Zhang, Y. (eds) Web Information Systems Engineering – WISE 2022. WISE 2022. Lecture Notes in Computer Science, vol 13724. Springer, Cham. https://doi.org/10.1007/978-3-031-20891-1_23

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-20891-1_23

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-20890-4

  • Online ISBN: 978-3-031-20891-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation