Lantern to the Underworld - Following User Actions Using Bing URL Parameters When Child Exploitation Terms Are Suggested by the Search Engine

Lantern to the Underworld - Following User Actions Using Bing URL Parameters When Child Exploitation Terms Are Suggested by the Search Engine

Online

During a 2016 criminal investigation overseen by the authors, a discovery was made that the Bing search engine was suggesting search terms known to be associated with child exploitation materials. This was in response to a non-contraband search by a subject, leading to increasingly explicit suggestions. This information led to the discovery that, with a user’s browser history files, the specific actions taken by a user could be isolated and tracked using Bing’s own unique URL parameters. While the suggestion of contraband terms by the Bing search engine has since ceased, there has been little to no research conducted on analyzing a user’s browser activity in order to determine their specific actions behind the keyboard through the use of these unique URL parameters. The purpose of this paper is to document Bing’s URL parameters related to image searches (specifically the FORM parameter) in order to detail how a user’s actions during searching may be determined by an analyst. The authors also provide a new tool for creating a timeline of Bing image search events when an analyst possesses a user’s browser history files.

https://aisel.aisnet.org/hicss-55/st/digital_forensics/3