Covert Ops: Device Fingerprinting Tracks Users

Friday, October 11, 2013 @ 03:10 PM gHale

Using hidden scripts to extract a device fingerprint from users’ browsers, 145 of the Internet’s 10,000 top websites track users without their knowledge or consent, a new study found.

Device fingerprinting circumvents legal restrictions imposed on the use of cookies and ignores the Do Not Track HTTP header. The findings suggest that secret tracking is more widespread than previously thought, said researchers in the study by Netherlands-based KU Leuven-iMinds.

Manual to Bypass Fingerprinting
Grant to Boost Wireless Security
DoE Awards to Boost Security Tools
Petrobras Moves to Hike Security

Device fingerprinting, also known as browser fingerprinting, is the practice of collecting properties of PCs, smartphones and tablets to identify and track users. These properties include the screen size, the versions of installed software and plugins, and the list of installed fonts.

A 2010 study by the Electronic Frontier Foundation (EFF) showed for the vast majority of browsers, the combination of these properties is unique, and thus functions as a ‘fingerprint’ that can track users without relying on cookies. Device fingerprinting targets either Flash, the ubiquitous browser plugin for playing animations, videos and sound files, or JavaScript, a common programming language for web applications.

This is the first comprehensive effort to measure the prevalence of device fingerprinting on the Internet. The team of KU Leuven-iMinds researchers analyzed the Internet’s top 10,000 websites and discovered that 145 of them (almost 1.5 percent) use Flash-based fingerprinting. Some Flash objects included questionable techniques such as revealing a user’s original IP address when visiting a website through a third party (a so-called proxy).

The study also found that 404 of the top 1 million sites use JavaScript-based fingerprinting, which allows sites to track non-Flash mobile phones and devices. The fingerprinting scripts were probing a long list of fonts – sometimes up to 500 – by measuring the width and the height of secretly-printed strings on the page.

The researchers identified 16 new providers of device fingerprinting, only one of which was available in prior research. Also, the researchers found users end up tracked by these device fingerprinting technologies even if they explicitly requested no tracking by enabling the Do Not Track (DNT) HTTP header.

The researchers also evaluated Tor Browser and Firegloves, two privacy-enhancing tools offering fingerprinting resistance. New vulnerabilities, some of which give access to users’ identity, were available.

Device fingerprinting can see use for various security-related tasks, including fraud detection, protection against account hijacking and anti-bot and anti-scraping services. But it is also works for analytics and marketing purposes via fingerprinting scripts hidden in advertising banners and web widgets.

To detect websites using device fingerprinting technologies, the researchers developed a tool called FPDetective. The tool crawls and analyses websites for suspicious scripts. This tool will be freely available for other researchers to use and build upon.

The findings from the study will be available at the 20th ACM Conference on Computer and Communications Security this November in Berlin.

Leave a Reply

You must be logged in to post a comment.