New Attack Let Attacker Collect and Spoof Browser's Digital Fingerprints

guest · Oct 25, 2021

New Attack Let Attacker Collect and Spoof Browser's Digital Fingerprints
October 25, 2021
https://thehackernews.com/2021/10/new-attack-let-attacker-collect-and.html

A "potentially devastating and hard-to-detect threat" could be abused by attackers to collect users' browser fingerprinting information with the goal of spoofing the victims without their knowledge, thus effectively compromising their privacy.

Academics from Texas A&M University dubbed the attack system "Gummy Browsers," likening it to a nearly 20-year-old "Gummy Fingers" technique that can impersonate a user's fingerprint biometrics.

"The idea is that the attacker first makes the user connect to his website (or to a well-known site the attacker controls) and transparently collects the information from that is used for fingerprinting purposes (just like any fingerprinting website collects this information)," the researchers outlined. "Then, orchestrates a browser on his own machine to replicate and transmit the same fingerprinting information when connecting to , fooling to think that is the one requesting the service rather than ."
Click to expand...

Browser fingerprinting, also called machine fingerprinting, refers to a tracking technique that's used to uniquely identify internet users by gathering attributes about the software and hardware of a remote computing system — such as the choice of browser, timezone, default language, screen resolution, add-ons, installed fonts, and even preferences — as well as behavioral characteristics that emerge when interacting with the web browser of the device.
Click to expand...

arXiv: Gummy Browsers: Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques

We present a simple yet potentially devastating and hard-to-detect threat, called Gummy Browsers, whereby the browser fingerprinting information can be collected and spoofed without the victim's awareness, thereby compromising the privacy and security of any application that uses browser fingerprinting.

We design and implement the Gummy Browsers attack using three orchestration methods based on script injection, browser settings and debugging tools, and script modification, that can successfully spoof a wide variety of fingerprinting features to mimic many different browsers (including mobile browsers and the Tor browser). We then evaluate the attack against two state-of-the-art browser fingerprinting systems, FPStalker and Panopticlick.
Click to expand...

Log in or Sign up

New Attack Let Attacker Collect and Spoof Browser's Digital Fingerprints

guest Guest

Log in or Sign up

New Attack Let Attacker Collect and Spoof Browser's Digital Fingerprints

guest Guest

Useful Searches