Picasso: Light-weight device class fingerprinting for web clients - PowerPoint PPT Presentation

Picasso: Light-weight device class fingerprinting for web clients Elie Bursztein , Artem Malyshev, Tadek Pietraszek, Kurt Thomas

Title Interesting story here Subpoint g.co/research/protect

Keeping online interactions meaningful g.co/research/protect

Different interaction requires distinct level of trust Bank transfer Account recovery Interaction Impact Content creation Content like Content consumption Trust required g.co/research/protect

Verification methods trade-off Phone call Human interaction SMS Hard captcha No captcha Picasso Trust g.co/research/protect

Goals Remote device class attestation Allow to enforce quotas and help anomaly detection Proof of work Enforce that attacker will expend 20ms of iOS time per request g.co/research/protect

Requirements Cross-platform and cross-language Any platform (Android, iOS) and any language (Javascript, SWIFT) Accurate browsers and OS discrimination Chrome OSX vs Safari OSX, Chrome Windows vs Chrome OSX Emulators detection Safari on iPhone vs Safari on an emulator g.co/research/protect

Constraints No device modification Must run on off-the-shelf devices Fast and lightweight Can be downloaded/executed often even on low-end devices Tamper proof Code to be shipped to clients and potentially executed offline g.co/research/protect

Mission Impossible? g.co/research/protect

System overview

Use the graphical stack as a physically unclonable function g.co/research/protect

Principle Graphical instruction Graphical instruction Graphic Challenge id rendering Graphical instruction Image unique to device type Graphical instruction g.co/research/protect

Graphical primitives used Quadratic curve Bezier curve Circle F Font g.co/research/protect

Telling apart bots from devices g.co/research/protect

Why Picasso? g.co/research/protect

Evaluation

Demo

Is the graphical stack really a PUF? g.co/research/protect

Browser difference heatmap Chrome vs Firefox Chrome vs Safari Firefox vs Safari g.co/research/protect

Safari on iPhone vs Safari on an emulator Red imply pixels are differents g.co/research/protect

Evaluation metrics Uniqueness Fraction of challenge response which are unique to a given device class Stability Number of distinct challenges response generated by a given class of device g.co/research/protect

Stability illustrated Picasso Stability g.co/research/protect

Uniqueness illustrated Picasso Uniqueness g.co/research/protect

Uniqueness confusion matrix g.co/research/protect

Chrome uniqueness confusion matrix g.co/research/protect

Windows uniqueness confusion matrix g.co/research/protect

Stability g.co/research/protect

War story

Brute-force attempts from EC2 via proxies g.co/research/protect

Proxies geo-distribution g.co/research/protect

Thanks g.co/research/protect