Detection of Browser Fingerprinting by Static JavaScript Code - - PowerPoint PPT Presentation

▶

Feb 02, 2024 31 likes •335 views

Detection of Browser Fingerprinting by Static JavaScript Code Classification Sjors Haanen & Tim van Zalingen UvA February 6, 2018 Supervisors (KPMG): Aidan Barrington & Ruben de Vries Research Project 82 Sjors Haanen & Tim van

SLIDE 1

Detection of Browser Fingerprinting by Static JavaScript Code Classification

Sjors Haanen & Tim van Zalingen

UvA

February 6, 2018

Supervisors (KPMG): Aidan Barrington & Ruben de Vries Research Project 82

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 1 / 30

SLIDE 2

Tracking users on the Web

Figure 1: Third party cookies source: Mozilla - Lightbeam for Firefox

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 2 / 30

SLIDE 3

Browser fingerprinting

Browser settings Hardware characteristics        Unique fingerprint OS characteristics Stateless Often even unnoticed by user Recent study could uniquely identify 89.4% out of 118,934 browsers1

1Laperdrix, Pierre 2017. Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 3 / 30

SLIDE 4

Fingerprint example

Table 1: Excerpt fingerprinting results from https: // amiunique. org

Attribute Similarity ratio Value User agent <0.1% ”Mozilla/5.0 (X11; Ubuntu; Linux x86 64; rv:58.0) Gecko...” Accept 54.78% ”text/html,application/xhtml+xml,application/...” Content encoding 40.54% ”gzip, deflate, br” Content language 27.53% ”en-US,en;q=0.5” List of plugins 25.61% ”” Platform 10.64% ”Linux x86 64” Cookies enabled 79.63% ”yes” Do Not Track 30.51% ”yes” Timezone 20.66% ”-60” Screen resolution 21.29% ”1920x1080x24”

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 4 / 30

SLIDE 5

Defences against browser fingerprinting

Disable functionality N:1 - Many Browsers, One Configuration (Tor) 1:N - One Browser, Many Configurations

Randomise data per request/session

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 5 / 30

SLIDE 6

Motivation

Privacy Existing detection and prevention solutions often criticised

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 6 / 30

SLIDE 7

Prior work

Previous attempts to detect fingerprinting: Blacklists2 Dynamic analysis: detection at runtime3 Static analysis: counting4

2Kontaxis, Georgios and Chew, Monica 2015. 3Acar, Gunes and Juarez, Marc and Nikiforakis, Nick and Diaz, Claudia and G¨

urses, Seda and Piessens, Frank and Preneel, Bart 2013; FaizKhademi, Amin and Zulkernine, Mohammad and Weldemariam, Komminist 2015.

4Rausch, Michael and Good, Nathan and Hoofnagle, Chris Jay 2014. Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 7 / 30

SLIDE 8

Research question

Can the action of browser fingerprinting be detected before execution by analysing JavaScript code with machine learning?

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 8 / 30

SLIDE 9

Method overview

Collect sets of scripts Deobfuscation Member expressions expansion Count suspicious calls SVM classification Gathering Processing Detection

Figure 2: Process of analysing JavaScript (JS) source code for a given set of websites to find fingerprinting practices

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 9 / 30

SLIDE 10

Method overview

Collect sets of scripts Deobfuscation Member expressions expansion Count suspicious calls SVM classification Gathering Processing Detection

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 10 / 30

SLIDE 11

Collect sets of scripts

Predefined sets (by manual search): Set of 12 fingerprinting scripts Set of 20 non-fingerprinting scripts

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 11 / 30

SLIDE 12

Method overview

Collect sets of scripts Deobfuscation Member expressions expansion Count suspicious calls SVM classification Gathering Processing Detection

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 12 / 30

SLIDE 13

Deobfuscation: The problem

e v a l ( f u n c t i o n (p , a , c , k , e , d){ e=f u n c t i o n ( c ){ r e t u r n c . t o S t r i n g (36) }; i f ( ! ’ ’ . r e p l a c e (/ˆ/ , S t r i n g )){ while ( c−−){d [ c . t o S t r i n g ( a)]=k [ c ] | | c . t o S t r i n g ( a )} k=[ f u n c t i o n ( e ){ r e t u r n d [ e ] } ] ; e=f u n c t i o n (){ return ’\\w+ ’}; c=1}; while ( c−−){ i f ( k [ c ] ) { p=p . r e p l a c e (new RegExp ( ’\\b’+e ( c )+ ’\\b ’ , ’ g ’ ) , k [ c ])}} r e t u r n p }( ’0 1=3;8 4(){0 a =1.2; 0 b=a ;0 5=b . 6 ; 0 7=1.9} ’ ,12 ,12 , ’ var | nav | p l u g i n s | n a v i g a t o r | f i n g e r p r i n t | c | length | d | f u n c t i o n | userAgent | | ’ . s p l i t ( ’ | ’ ) , 0 , { } ) )

Figure 3: An example of JS code obfuscated by www. danstools. com/ javascript-obfuscate/

Who can tell us what this piece of code does?

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 13 / 30

SLIDE 14

Deobfuscation: JSBeautifier

Requirements: Counter obfuscation Counter minification Counter packing var nav = n a v i g a t o r ; f u n c t i o n f i n g e r p r i n t () { var a = nav . p l u g i n s ; var b = a ; var c = b . length ; var d = nav . userAgent }

Figure 4: The JS code in figure 3 deobfuscated by http: // jsbeautifier. org/

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 14 / 30

SLIDE 15

Method overview

Collect sets of scripts Deobfuscation Member expressions expansion Count suspicious calls SVM classification Gathering Processing Detection

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 15 / 30

SLIDE 16

Expanding member expressions: The problem

var nav = n a v i g a t o r ; f u n c t i o n f i n g e r p r i n t () { var a = nav . p l u g i n s ; var b = a ; var c = b . length ; var d = nav . userAgent ; }

Figure 5: Example JS code with split member expressions

⇒

n a v i g a t o r . p l u g i n s n a v i g a t o r . p l u g i n s . length n a v i g a t o r . userAgent

Figure 6: Expanded member expressions for the code in figure 5

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 16 / 30

SLIDE 17

Expanding member expressions: Abstract Syntax Tree (AST)

Parse code Traverse AST Analyse scope

var nav = n a v i g a t o r ; f u n c t i o n f i n g e r p r i n t () { var a = nav . p l u g i n s ; } Figure 7: Example JS code with split member expressions

Program var = nav navigator function fingerprint() { .. } var = a . nav plugins

Figure 8: The Abstract Syntax Tree of the code in figure 7

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 17 / 30

SLIDE 18

Method overview

Collect sets of scripts Deobfuscation Member expressions expansion Count suspicious calls SVM classification Gathering Processing Detection

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 18 / 30

SLIDE 19

Count suspicious calls

Counting calls in processed files aggregated per domain Examples of suspicious JS calls: navigator.userAgent navigator.plugins.name navigator.javaEnabled() window.screen.colorDepth Date().getTimezoneOffset()

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 19 / 30

SLIDE 20

Inspecting JS calls

Figure 9: Comparing different JS calls that can be used as a feature to differentiate scripts

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 20 / 30

SLIDE 21

Method overview

Collect sets of scripts Deobfuscation Member expressions expansion Count suspicious calls SVM classification Gathering Processing Detection

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 21 / 30

SLIDE 22

Support Vector Machine (SVM)

Supervised learning methods Classification Relevant advantages:

Effective in high dimensional spaces Effective with more dimensions than samples

Avoid over-fitting with small number of samples

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 22 / 30

SLIDE 23

2D SVM Classification

Figure 10: SVM Classification example for two features

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 23 / 30

SLIDE 24

2D SVM Classification (Cont’d)

Figure 11: SVM Classification example for two features. These two features are not easily distinguishable

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 24 / 30

SLIDE 25

Support Vector Machine: Prevent overfitting

Partition data into training and test set Cross-validation Stratified k-fold preserves positive and negative ratio

Figure 12: Visualised example of k-fold cross-validation with k=4 (source: Wikipedia - Cross-validation (statistics))

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 25 / 30

SLIDE 26

Results: Full dimensional classification

Figure 13: Receiver Operating Characteristic curve to illustrate the performance of the classifier F1-score=0.80

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 26 / 30

SLIDE 27

Discussion

Observable difference, SVM can detect fingerprinting scripts Combining features and using a classifier improves on earlier research Future implementation of proposed method might aid in detection False positives

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 27 / 30

SLIDE 28

Future work

Refine list of suspicious JS calls Include other signs of fingerprinting in the analysis, e.g.:

Hashing values Sending fingerprintable data to a remote server

Bigger dataset Other machine learning algorithms

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 28 / 30

SLIDE 29

References I

Acar, Gunes and Juarez, Marc and Nikiforakis, Nick and Diaz, Claudia and G¨ urses, Seda and Piessens, Frank and Preneel, Bart (2013). “FPDetective: dusting the web for fingerprinters”. In: Proceedings of the 2013 ACM SIGSAC conference on Computer & communications

security. ACM, 1129–1140.

FaizKhademi, Amin and Zulkernine, Mohammad and Weldemariam, Komminist (2015). “FPGuard: Detection and prevention of browser fingerprinting”. In: IFIP Annual Conference

n Data and Applications Security and Privacy. Springer, 293–308.

Kontaxis, Georgios and Chew, Monica (2015). “Tracking protection in firefox for privacy and performance”. In: arXiv preprint arXiv:1506.04104. Laperdrix, Pierre (2017). “Browser Fingerprinting: Exploring Device Diversity to Augment Authentication and Build Client-Side Countermeasures”. PhD thesis. INSA Rennes.

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 29 / 30

SLIDE 30

References II

Rausch, Michael and Good, Nathan and Hoofnagle, Chris Jay (2014). “Searching for Indicators of Device Fingerprinting in the JavaScript Code of Popular Websites”. In: Proceedings, Midewest Instruction and Computing Symposium.

Sjors Haanen & Tim van Zalingen (UvA) RP82: Browser Fingerprinting February 6, 2018 30 / 30