4 ms·
Pixel phones are also affected (and probably many others), and Google did not publicly patch them 163 days after disclosure. To be fair, Apple had a 129 days h
by Aissen 7y ago
Pixel phones are also affected (and probably many others), and Google did not publicly patch them 163 days after disclosure.
To be fair, Apple had a 129 days head start, and took 234 days to issue a fix:
> How did vendors respond to this attack?
> We followed a coordinated disclosure procedure and reported this vulnerability to Apple on 3rd August 2018. On iOS 12.2, Apple adopted our suggestion and added random noise to the ADC outputs (CVE-2019-8541). Apple also removed access to motion sensors from Mobile Safari by default. This vulnerability was disclosed to Google on 10th December 2018. Google has contacted us and is investigating this issue.
https://sensorid.cl.cam.ac.uk/ https://sensorid.cl.cam.ac.uk/
- samirm 7y agoThe Pixel fingerprints aren't as unique since only the accelerometer is factory calibrated. >In the case of iOS devices, the SensorID includes both the calibration fingerprint of the gyroscope (GyroID) and magnetometer (MagID). In the case of Google Pixel 2 and 3, the SensorID includes the calibration fingerprint of the accelerometer (AccelID). You can also stop websites from doing this by turning off JS in browsers like Firefox Focus or using something like NoScript. >We only have access to a few Pixel devices,and therefore we are unable to perform the same analysis as we have done on iOS devices to determine whether the fingerprint we obtain for Pixel devices is globally unique or not. The IMU in other Android devices is also likely factory calibrated but the calibration is typically restricted to offsets(i.e., bias compensation). Our approach targets the gain matrix and cannot recover bias compensation. If you want "to be fair", why not mention all these details too?
- Aissen 7y agoThanks for the additional details.
- Scoundreller 7y agoHow well does random noise work? With enough samples, and a fixed phone, the randomness will average out, no? Hopefully the random value isn’t being changed for each sample, but every minute or hour or such. They can only add so much noise before impacting the actual results, right?
- Skunkleton 7y agoI would like details, but I am sure the thought it through.
- js2 7y agoDetails in the research paper[1]: Recall that our approach to recover the gain matrix is based on the fact that the values in the ADC output, A, are all integers. This property allows us to recover the values of ΔA using Equation 6. However, if we add random noise ε ∈ R3×1, from the uniform distribution in the range [−0.5, 0.5], to each ADC output A. Then we have: O = G(A + ε) + B (12) It is clear to see that the application of random noise with distribution ε ∼ U (−0.5, 0.5) followed by a truncation of the output down to 16-bit resolution means there is no easy way to recover the values of ΔA. Therefore, attackers can no longer generate the SENSORID using the approach described in this paper. The cost of adding ε is negligible in most cases, but it offers significant advantages in terms of user privacy. Alternatively, we could round the factory calibrated sensor output to the nearest multiple of the nominal gain to prevent recovering the gain matrix. This approach is more practical to apply and it does not require knowing the gain matrix in advance. Therefore, mobile browsers can adopt this approach to protect user privacy. 1. https://www.ieee-security.org/TC/SP2019/papers/405.pdf https://www.ieee-security.org/TC/SP2019/papers/405.pdf
- js2 7y agoMods: suggestion to update to the URL and title of the above site. The submitted link provides little beyond a link to the research paper.
- baybal2 7y ago> Apple adopted our suggestion and added random noise to the ADC outputs It will not stop Kalman filter Just axe it away Apple