Georgia Institute of Technology
Modern web services routinely personalize content to appeal to the specific interests, viewpoints, and contexts of individual users. Ideally, personalization allows sites to highlight information uniquely relevant to each of their users, thereby increasing user satisfaction - and, eventually, the service's bottom line. Unfortunately, as the authors demonstrate in this paper, the personalization mechanisms currently employed by popular services have not been hardened against attack. They show that third parties can manipulate them to increase the visibility of arbitrary content - whether it is a new YouTube video, an unpopular product on Amazon, or a low-ranking website in Google search returns.