A Study of Third-party Resources Loading on Web

TL;DR

This study analyzes web dependency chains, revealing that many websites load third-party resources, some of which are suspicious and potentially malicious, impacting web security and privacy.

Contribution

It provides a large-scale analysis of dependency chains, identifying the prevalence of suspicious third-parties and their potential security risks in web content loading.

Findings

50% of websites load third-party content indirectly.

1.2% of third-parties are classified as suspicious.

Majority of suspicious scripts download malware.

Abstract

This paper performs a large-scale study of dependency chains in the web, to find that around 50% of first-party websites render content that they did not directly load. Although the majority (84.91%) of websites have short dependency chains (below 3 levels), we find websites with dependency chains exceeding 30. Using VirusTotal, we show that 1.2% of these third-parties are classified as suspicious -- although seemingly small, this limited set of suspicious third-parties have remarkable reach into the wider ecosystem. We find that 73% of websites under-study load resources from suspicious third-parties, and 24.8% of first-party webpages contain at least three third-parties classified as suspicious in their dependency chain. By running sandboxed experiments, we observe a range of activities with the majority of suspicious JavaScript codes downloading malware.