4 ms·

Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Fingerprinting

116 points by robin_reala 2y ago

davidsojevic 2y ago
I was impressed at the accuracy they were able to get with browser/architecture detection: > Concretely, our expression reveals differences in 1116 OS-browser combination pairs (94.9 %). Very cool to see that they've even gone as far as inferring elements like the likelihood of MS Office being installed on your computer by checking the width of a container with the font 'Leelawadee' specified: > As this font is a non-free Microsoft font for the Thai Language, we do not expect users without Microsoft Office to have it installed There is lots of really interesting information in here past what you might figure out yourself if you've played around with abusing CSS yourself before. So many things that had just never, and probably would never have, occurred to me to try. It is definitely worth a read (or skim) over the paper to see the lengths they went to in order to figure out some of the unique elements to fingerprint on.
- Narew 2y ago
  I don't remember where I read that and was not able to find it again. There is a web/desktop app (like zoom) that install a font when you install the app, and the web app check if this font is install to trigger the open in app popup.
  - sethhochberg 2y ago
    It’s a common enough technique that this surely isn’t the only example, but there was discussion here a while back about TeamViewer doing this to detect the presence and version of the client software when clicking a link to open a remote session: https://news.ycombinator.com/item?id=32165103 https://news.ycombinator.com/item?id=32165103 In their case, the (shell of a) font file goes a little further and encodes the version of the teamviewer client that installed it
ranger_danger 2y ago
Couldn't most fingerprinting techniques be thwarted by just using a stock windows install in a frozen VM with a stock browser without changing anything? Wouldn't that make you pretty boring as far as any potential variations go?
- maeil 2y ago
  Wouldn't a Macbook be the better platform to mimic as its hardware is so much more standardized? Considering techniques like Canvas fingerprinting.
  - ranger_danger 2y ago
    My understanding is that a VM should already be mimicing standardized hardware, and that apple (especially desktop) users are such a small percentage compared to windows, that you wouldn't want to base anything trying to "blend in" on that.
  - kccqzy 2y ago
    And by that logic an iPhone is an even better choice than a MacBook.
- qqqult 2y ago
  not really. webgl hardware parameters, canvas fingerprints, audio device fingerprints, javascript engine are pretty crazy. In addition if you use your device at all you probably have other fingerprints like custom fonts installed by you or apps, extensions & similar. Not to mention IP and session data like you being logged in in different services that any website can check. Try visiting something like https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ [1] on "identical" incognito mobile devices or desktops and you'll get completely different fingerprint ids [1] this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it
  - ranger_danger 2y ago
    > this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it What IS the best tool? What other techniques do you know of that it doesn't it implement? > you being logged in in different services that any website can check how so?
ranger_danger 2y ago
https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/
jamal-kumar 2y ago
CISPA is really interesting, I was just reading this on their site the other day - They're developing grey box coverage based fuzzing tools for PHP web applications, which is how I know about them in the first place. Definitely one of those entities to look out for in serious cybersecurity research going into 2025
frankfrank13 2y ago
I know this is a privacy nightmare but also kinda... cool? Or at least interesting. I don't think I would have thought of this. 1. Measure element dimensions and detect installed fonts (measure a piece of text with specific a specific font to see if its installed) 2. CSS functions (e.g calc) that produce different results across browsers/systems 3. Detecting browser-specific CSS property differences (e.g render a file input, measure it) seems like you have to allow `@container` checks or something similar for this to work in order to then make your network request `#something { background-image: url('/x-browser-y-os-detected'); }`
lobito25 2y ago
Article's date is in the future: 2025-02-02
- tsavo 2y ago
  Reading the article. First Online Date: 2024-10-09 Date Posted: 2024-12-05 Date Published: 2025-02-01 (It's being "published" at a conference)
- dazed_confused 2y ago
  As mentioned the paper was accepted in NDSS. https://www.ndss-symposium.org/ndss2025/accepted-papers/ https://www.ndss-symposium.org/ndss2025/accepted-papers/ The conference occurs in Feb, and typically, the conference proceedings are published a little earlier than the conference itself.
- 8bitbeep 2y ago
  It's very modern CSS.
- brudgers 2y ago
  That is probably the scheduled presentation date.
InvisGhost 2y ago
I wonder if you could track the usage of features known to be used for fingerprinting and disable the functionality if enough are used. I assume that most sites using advanced fingerprinting like this are also the kind that would remove it quickly if it causes the site to break.
- qqqult 2y ago
  tor tries to do this by offering different "safety" levels that the user can choose between some browsers try to randomize fignerprintable parameters but that's easy to detect
qingcharles 2y ago
This is a two-part problem. 1) You can fingerprint devices using CSS 2) You can make server calls using CSS to exfiltrate the client-side data Stopping (2) would limit the utility of (1).
davidashe 2y ago
Imagine a world where developers refused to build fingerprinting features.

116 points by robin_reala 2y ago

I was impressed at the accuracy they were able to get with browser/architecture detection: > Concretely, our expression reveals differences in 1116 OS-browser combination pairs (94.9 %). Very cool to see that they've even gone as far as inferring elements like the likelihood of MS Office being installed on your computer by checking the width of a container with the font 'Leelawadee' specified: > As this font is a non-free Microsoft font for the Thai Language, we do not expect users without Microsoft Office to have it installed There is lots of really interesting information in here past what you might figure out yourself if you've played around with abusing CSS yourself before. So many things that had just never, and probably would never have, occurred to me to try. It is definitely worth a read (or skim) over the paper to see the lengths they went to in order to figure out some of the unique elements to fingerprint on.

Narew 2y ago
I don't remember where I read that and was not able to find it again. There is a web/desktop app (like zoom) that install a font when you install the app, and the web app check if this font is install to trigger the open in app popup.
- sethhochberg 2y ago
  It’s a common enough technique that this surely isn’t the only example, but there was discussion here a while back about TeamViewer doing this to detect the presence and version of the client software when clicking a link to open a remote session: https://news.ycombinator.com/item?id=32165103 https://news.ycombinator.com/item?id=32165103 In their case, the (shell of a) font file goes a little further and encodes the version of the teamviewer client that installed it

ranger_danger 2y ago

Couldn't most fingerprinting techniques be thwarted by just using a stock windows install in a frozen VM with a stock browser without changing anything? Wouldn't that make you pretty boring as far as any potential variations go?

maeil 2y ago
Wouldn't a Macbook be the better platform to mimic as its hardware is so much more standardized? Considering techniques like Canvas fingerprinting.
- ranger_danger 2y ago
  My understanding is that a VM should already be mimicing standardized hardware, and that apple (especially desktop) users are such a small percentage compared to windows, that you wouldn't want to base anything trying to "blend in" on that.
- kccqzy 2y ago
  And by that logic an iPhone is an even better choice than a MacBook.
qqqult 2y ago
not really. webgl hardware parameters, canvas fingerprints, audio device fingerprints, javascript engine are pretty crazy. In addition if you use your device at all you probably have other fingerprints like custom fonts installed by you or apps, extensions & similar. Not to mention IP and session data like you being logged in in different services that any website can check. Try visiting something like https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ [1] on "identical" incognito mobile devices or desktops and you'll get completely different fingerprint ids [1] this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it
- ranger_danger 2y ago
  > this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it What IS the best tool? What other techniques do you know of that it doesn't it implement? > you being logged in in different services that any website can check how so?

ranger_danger 2y ago

https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/

jamal-kumar 2y ago

CISPA is really interesting, I was just reading this on their site the other day - They're developing grey box coverage based fuzzing tools for PHP web applications, which is how I know about them in the first place. Definitely one of those entities to look out for in serious cybersecurity research going into 2025

frankfrank13 2y ago

I know this is a privacy nightmare but also kinda... cool? Or at least interesting. I don't think I would have thought of this. 1. Measure element dimensions and detect installed fonts (measure a piece of text with specific a specific font to see if its installed) 2. CSS functions (e.g calc) that produce different results across browsers/systems 3. Detecting browser-specific CSS property differences (e.g render a file input, measure it) seems like you have to allow `@container` checks or something similar for this to work in order to then make your network request `#something { background-image: url('/x-browser-y-os-detected'); }`

lobito25 2y ago

Article's date is in the future: 2025-02-02

tsavo 2y ago
Reading the article. First Online Date: 2024-10-09 Date Posted: 2024-12-05 Date Published: 2025-02-01 (It's being "published" at a conference)
dazed_confused 2y ago
As mentioned the paper was accepted in NDSS. https://www.ndss-symposium.org/ndss2025/accepted-papers/ https://www.ndss-symposium.org/ndss2025/accepted-papers/ The conference occurs in Feb, and typically, the conference proceedings are published a little earlier than the conference itself.
8bitbeep 2y ago
It's very modern CSS.
brudgers 2y ago
That is probably the scheduled presentation date.

InvisGhost 2y ago

I wonder if you could track the usage of features known to be used for fingerprinting and disable the functionality if enough are used. I assume that most sites using advanced fingerprinting like this are also the kind that would remove it quickly if it causes the site to break.

qqqult 2y ago
tor tries to do this by offering different "safety" levels that the user can choose between some browsers try to randomize fignerprintable parameters but that's easy to detect

qingcharles 2y ago

This is a two-part problem. 1) You can fingerprint devices using CSS 2) You can make server calls using CSS to exfiltrate the client-side data Stopping (2) would limit the utility of (1).

davidashe 2y ago

Imagine a world where developers refused to build fingerprinting features.