Picasso: Light-weight device class fingerprinting for web clients - - PowerPoint PPT Presentation

picasso light weight device class fingerprinting for web
SMART_READER_LITE
LIVE PREVIEW

Picasso: Light-weight device class fingerprinting for web clients - - PowerPoint PPT Presentation

Picasso: Light-weight device class fingerprinting for web clients Elie Bursztein , Artem Malyshev, Tadek Pietraszek, Kurt Thomas Title Interesting story here Subpoint g.co/research/protect Keeping online interactions meaningful


slide-1
SLIDE 1

Picasso: Light-weight device class fingerprinting for web clients

Elie Bursztein, Artem Malyshev, Tadek Pietraszek, Kurt Thomas

slide-2
SLIDE 2

g.co/research/protect

Title

Interesting story here

Subpoint

slide-3
SLIDE 3

g.co/research/protect

Keeping online interactions meaningful

slide-4
SLIDE 4

g.co/research/protect

Different interaction requires distinct level of trust

Trust required Interaction Impact

Account recovery Bank transfer Content creation Content consumption Content like

slide-5
SLIDE 5

g.co/research/protect

Trust

Verification methods trade-off

Human interaction

Phone call SMS Hard captcha No captcha Picasso

slide-6
SLIDE 6

g.co/research/protect

Goals

Remote device class attestation

Allow to enforce quotas and help anomaly detection

Proof of work

Enforce that attacker will expend 20ms of iOS time per request

slide-7
SLIDE 7

g.co/research/protect

Requirements

Cross-platform and cross-language

Any platform (Android, iOS) and any language (Javascript, SWIFT)

Emulators detection

Safari on iPhone vs Safari on an emulator

Accurate browsers and OS discrimination

Chrome OSX vs Safari OSX, Chrome Windows vs Chrome OSX

slide-8
SLIDE 8

g.co/research/protect

Constraints

No device modification

Must run on off-the-shelf devices

Tamper proof

Code to be shipped to clients and potentially executed offline

Fast and lightweight

Can be downloaded/executed often even on low-end devices

slide-9
SLIDE 9

g.co/research/protect

Mission Impossible?

slide-10
SLIDE 10

System overview

slide-11
SLIDE 11

g.co/research/protect

Use the graphical stack as a physically unclonable function

slide-12
SLIDE 12

g.co/research/protect

Principle

Challenge id

Graphical instruction Graphical instruction Graphical instruction Graphical instruction Graphic rendering

Image unique to device type

slide-13
SLIDE 13

g.co/research/protect

Graphical primitives used

Quadratic curve Bezier curve Circle Font F

slide-14
SLIDE 14

g.co/research/protect

Telling apart bots from devices

slide-15
SLIDE 15

g.co/research/protect

Why Picasso?

slide-16
SLIDE 16

Evaluation

slide-17
SLIDE 17

Demo

slide-18
SLIDE 18
slide-19
SLIDE 19

g.co/research/protect

Is the graphical stack really a PUF?

slide-20
SLIDE 20

g.co/research/protect

Browser difference heatmap

Chrome vs Firefox Chrome vs Safari Firefox vs Safari

slide-21
SLIDE 21

g.co/research/protect

Safari on iPhone vs Safari on an emulator

Red imply pixels are differents

slide-22
SLIDE 22

g.co/research/protect

Evaluation metrics

Uniqueness

Fraction of challenge response which are unique to a given device class

Stability

Number of distinct challenges response generated by a given class of device

slide-23
SLIDE 23

g.co/research/protect

Stability illustrated

Stability

Picasso

slide-24
SLIDE 24

g.co/research/protect

Uniqueness illustrated

Uniqueness

Picasso

slide-25
SLIDE 25

g.co/research/protect

Uniqueness confusion matrix

slide-26
SLIDE 26

g.co/research/protect

Chrome uniqueness confusion matrix

slide-27
SLIDE 27

g.co/research/protect

Windows uniqueness confusion matrix

slide-28
SLIDE 28

g.co/research/protect

Stability

slide-29
SLIDE 29

War story

slide-30
SLIDE 30

g.co/research/protect

Brute-force attempts from EC2 via proxies

slide-31
SLIDE 31

g.co/research/protect

Proxies geo-distribution

slide-32
SLIDE 32

Thanks

g.co/research/protect