12 ms·

The way it works is that accelerometers, gyroscopes and magnetometers all have some degree of systematic error from the manufacturing process so phone makers ca

The way it works is that accelerometers, gyroscopes and magnetometers all have some degree of systematic error from the manufacturing process so phone makers calibrate them at the factory. This attack is able to derive the calibration values from about 1 second of sensor data. As these values are unique to each phone, they can form a fingerprint that's impossible to erase or alter.

zaroth 7y ago
That’s a really neat trick but actually not so obscure. I would have thought Apple would catch it, this is actually a huge miss by their security team. It’s not the first abuse of browser APIs used to fingerprint a device (e.g. Battery API) and won’t be the last. Any kind of ability to sample data from a device should be thoroughly analyzed for fingerprinting side-channels as part of the underlying specification as a mandatory section. Is this not actually done? Is there any kind of similar calibration that is done on thr camera sensor (e.g. for color correction) that can be teased out of the resultant image files? What about in RAW mode? How about a sound recording? Does the microphone have any kind of correction factors you might be able to observe somehow? Similarly for color temperature of the screen. Maybe there is an unexpected side-channel to get at those correction values as well, although this one seems trickier because how would you sample the screen output remotely?
- maddyboo 7y ago
  The distinction with accelerometer data is that some platforms do not require the user to grant permission to access, as opposed to camera/microphone access. Apparently, prior to iOS 12.2, Apple did not require the user to grant a website permission to access motion & orientation sensor data [1]. They have since introduced an off-by-default toggle to globally enable access to this sensor data. Unfortunately, it seems to be all-or-nothing - if you want to allow any site access to this data, you need to allow every site access to this data. Hopefully this is a temporary band-aid fix and Apple will introduce per-site permission a la camera/microphone/location permission prompts. I wonder if any other data sources exist which don’t require user permission. [1] https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-orientation-access-toggle/ https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-...
  - blattimwind 7y ago
    > I wonder if any other data sources exist which don’t require user permission. There really should not. Apple should know better than this and give these sensors the same permission requirements as direct GPS location, i.e. per app / per website.
- dividuum 7y ago
  Dust or other scratches on taken pictures can be a side channel. See the previous discussion: https://news.ycombinator.com/item?id=18835377 https://news.ycombinator.com/item?id=18835377
PascLeRasc 7y ago
I wonder if this could be used to verify a device is who it claims to be, like an alternative MAC with additional security by obscurity. It seems like it'd be useful for apps like password managers or OTP/2FA, though I know next to nothing about this stuff.
- tlb 7y ago
  It wouldn't add much security. If any web page can read the configuration data, an attacker can capture it by tricking you into opening a web page.

zaroth 7y ago

That’s a really neat trick but actually not so obscure. I would have thought Apple would catch it, this is actually a huge miss by their security team. It’s not the first abuse of browser APIs used to fingerprint a device (e.g. Battery API) and won’t be the last. Any kind of ability to sample data from a device should be thoroughly analyzed for fingerprinting side-channels as part of the underlying specification as a mandatory section. Is this not actually done? Is there any kind of similar calibration that is done on thr camera sensor (e.g. for color correction) that can be teased out of the resultant image files? What about in RAW mode? How about a sound recording? Does the microphone have any kind of correction factors you might be able to observe somehow? Similarly for color temperature of the screen. Maybe there is an unexpected side-channel to get at those correction values as well, although this one seems trickier because how would you sample the screen output remotely?

maddyboo 7y ago
The distinction with accelerometer data is that some platforms do not require the user to grant permission to access, as opposed to camera/microphone access. Apparently, prior to iOS 12.2, Apple did not require the user to grant a website permission to access motion & orientation sensor data [1]. They have since introduced an off-by-default toggle to globally enable access to this sensor data. Unfortunately, it seems to be all-or-nothing - if you want to allow any site access to this data, you need to allow every site access to this data. Hopefully this is a temporary band-aid fix and Apple will introduce per-site permission a la camera/microphone/location permission prompts. I wonder if any other data sources exist which don’t require user permission. [1] https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-orientation-access-toggle/ https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-...
- blattimwind 7y ago
  > I wonder if any other data sources exist which don’t require user permission. There really should not. Apple should know better than this and give these sensors the same permission requirements as direct GPS location, i.e. per app / per website.
dividuum 7y ago
Dust or other scratches on taken pictures can be a side channel. See the previous discussion: https://news.ycombinator.com/item?id=18835377 https://news.ycombinator.com/item?id=18835377

PascLeRasc 7y ago

I wonder if this could be used to verify a device is who it claims to be, like an alternative MAC with additional security by obscurity. It seems like it'd be useful for apps like password managers or OTP/2FA, though I know next to nothing about this stuff.

tlb 7y ago
It wouldn't add much security. If any web page can read the configuration data, an attacker can capture it by tricking you into opening a web page.