3 ms·

Fingerprinting systems with TCP source-port selection

53 points by signa11 4y ago

eternalban 4y ago
10 seconds to id: -- ... It evidently takes about 40 connection attempts per counter-table entry to generate enough collisions, so about 10,000 attempts to identify a system. (The paper describes how to calculate "enough" but doesn't give a number). The time required to carry out this attack is about ten seconds, and the resources used are small enough that chances are good that it will go undetected. (Naturally, this discussion has passed over a lot of important details and is almost certainly wrong somewhere along the way; see the paper for the full story). This unique identifier has some interesting characteristics. It is entirely independent of the software being run, so it will remain the same even if the user switches browsers. or just fetches a page with a tool like curl. It is also the same regardless of the site that is being connected to, so it works well for tracking users across multiple sites. Different containers running on the same host will all have the same identifier. Even systems with identical hardware and software configurations will produce different identifiers. In other words, this ability to identify a system looks like a gift to the surveillance capitalists out there. It does have a few limitations, though. It does not work through networks like Tor, since connections are terminated within the Tor network and initiated anew at an exit node. Network-address translation (NAT) systems, which reassign port numbers, can also interfere with the identification. As the authors point out, though, increasing use of IPv6 is likely to reduce the use of NAT, making NAT interference less of a problem. ...
- metadat 4y ago
  Aren't most systems hooked up through a NAT these days?
  - jeroenhd 4y ago
    About 50% of the USA is on IPv6 which doesn't do NAT (unless you go out of your way to hack it back in). Most customer IPv4 networks are probably behind NAT, although there are plenty of exceptions. For example, the university network I'm on has a publicly reachable IP address for every authenticated device with the most basic firewall and no NAT, just the way Internet was originally designed to be like.
- WirelessGigabit 4y ago
  SLAAC with privacy protections (which MacOS and Windows both use by default) negate this. I only use a /128 for a short duration.
Helmut10001 4y ago
The title should be "fingerprinting Linux systems", since this doesn't seem to affect Windows or Mac etc.
- jeroenhd 4y ago
  It also doesn't work on recent Linux kernels, only on the older versions that didn't get their fixes backported.
jeroenhd 4y ago
I wonder if the next step of the browser privacy war will be to generate an IP address for every application or web page where SLAAC is used to prevent IP address based fingerprinting. With separate IP addresses could come a separate hash table as there will be no other services using that IP, defeating fingerprinting efforts on IPv6. It's not like we're lacking IPv6 address space for this as the /64 provided to an IPv6 network is enormous.
- tinus_hn 4y ago
  As if noone will think to combine the /32.
  - jeroenhd 4y ago
    But that doesn't work, because the port number algorithm won't have collisions between different IP addresses. Sure, they're already combining whole /48 blocks into a single tracking point just like they're combining a /32 IPv4 address, but at least on IPv6 it'll prevent this type of passive monitoring. On IPv4 the fact there's a NAT gateway with its own hashing table for multiple devices will already defeat this this type of tracking most of the time.
- _trampeltier 4y ago
  I also did think about that and wrote it somewhere here a while ago. A new IPv6 address for eatch tab or so.
nikau 4y ago
ergh, this reminds me of the days when an ISP here didn't allow Linux as part of their TOS as it allowed people to share the link between multiple devices. They ended up detecting people using IP masquerading as the default TTL differed from a typical Windows/Mac directly attached to their modem. Of course word spread and in no time there was instructions on how to set the TTL to not stand out and setup ipchains rules to ensure no services were detectable.
- detaro 4y ago
  The TTL tweaking is also a thing with mobile providers banning tethering/mobile hotspots.

53 points by signa11 4y ago

10 seconds to id: -- ... It evidently takes about 40 connection attempts per counter-table entry to generate enough collisions, so about 10,000 attempts to identify a system. (The paper describes how to calculate "enough" but doesn't give a number). The time required to carry out this attack is about ten seconds, and the resources used are small enough that chances are good that it will go undetected. (Naturally, this discussion has passed over a lot of important details and is almost certainly wrong somewhere along the way; see the paper for the full story). This unique identifier has some interesting characteristics. It is entirely independent of the software being run, so it will remain the same even if the user switches browsers. or just fetches a page with a tool like curl. It is also the same regardless of the site that is being connected to, so it works well for tracking users across multiple sites. Different containers running on the same host will all have the same identifier. Even systems with identical hardware and software configurations will produce different identifiers. In other words, this ability to identify a system looks like a gift to the surveillance capitalists out there. It does have a few limitations, though. It does not work through networks like Tor, since connections are terminated within the Tor network and initiated anew at an exit node. Network-address translation (NAT) systems, which reassign port numbers, can also interfere with the identification. As the authors point out, though, increasing use of IPv6 is likely to reduce the use of NAT, making NAT interference less of a problem. ...

metadat 4y ago
Aren't most systems hooked up through a NAT these days?
- jeroenhd 4y ago
  About 50% of the USA is on IPv6 which doesn't do NAT (unless you go out of your way to hack it back in). Most customer IPv4 networks are probably behind NAT, although there are plenty of exceptions. For example, the university network I'm on has a publicly reachable IP address for every authenticated device with the most basic firewall and no NAT, just the way Internet was originally designed to be like.
WirelessGigabit 4y ago
SLAAC with privacy protections (which MacOS and Windows both use by default) negate this. I only use a /128 for a short duration.

Helmut10001 4y ago

The title should be "fingerprinting Linux systems", since this doesn't seem to affect Windows or Mac etc.

jeroenhd 4y ago
It also doesn't work on recent Linux kernels, only on the older versions that didn't get their fixes backported.

jeroenhd 4y ago

I wonder if the next step of the browser privacy war will be to generate an IP address for every application or web page where SLAAC is used to prevent IP address based fingerprinting. With separate IP addresses could come a separate hash table as there will be no other services using that IP, defeating fingerprinting efforts on IPv6. It's not like we're lacking IPv6 address space for this as the /64 provided to an IPv6 network is enormous.

tinus_hn 4y ago
As if noone will think to combine the /32.
- jeroenhd 4y ago
  But that doesn't work, because the port number algorithm won't have collisions between different IP addresses. Sure, they're already combining whole /48 blocks into a single tracking point just like they're combining a /32 IPv4 address, but at least on IPv6 it'll prevent this type of passive monitoring. On IPv4 the fact there's a NAT gateway with its own hashing table for multiple devices will already defeat this this type of tracking most of the time.
_trampeltier 4y ago
I also did think about that and wrote it somewhere here a while ago. A new IPv6 address for eatch tab or so.

nikau 4y ago

ergh, this reminds me of the days when an ISP here didn't allow Linux as part of their TOS as it allowed people to share the link between multiple devices. They ended up detecting people using IP masquerading as the default TTL differed from a typical Windows/Mac directly attached to their modem. Of course word spread and in no time there was instructions on how to set the TTL to not stand out and setup ipchains rules to ensure no services were detectable.

detaro 4y ago
The TTL tweaking is also a thing with mobile providers banning tethering/mobile hotspots.