DRAWN APART : A Device Identification Technique based on Remote GPU Fingerprinting
| Autor: | Tomer Laor, Naif Mehanna, Antonin Durey, Vitaly Dyadyuk, Pierre Laperdrix, Clémentine Maurice, Yossi Oren, Romain Rouvoy, Walter Rudametkin, Yuval Yarom |
|---|---|
| Přispěvatelé: | Ben-Gurion University of the Negev (BGU), Self-adaptation for distributed services and large software systems (SPIRALS), Inria Lille - Nord Europe, Institut National de Recherche en Informatique et en Automatique (Inria)-Institut National de Recherche en Informatique et en Automatique (Inria)-Centre de Recherche en Informatique, Signal et Automatique de Lille - UMR 9189 (CRIStAL), Centrale Lille-Université de Lille-Centre National de la Recherche Scientifique (CNRS)-Centrale Lille-Université de Lille-Centre National de la Recherche Scientifique (CNRS), University of Adelaide, This research has been supported by ANR-19-CE39-0007 MIAOUS, ANR-19-CE39-00201 FP-Locker projects, an ARC Discovery Early Career Researcher Award DE200101577, an ARC Discovery Project number DP210102670, the BlavatnikICRC at Tel-Aviv University, Intel Corporation, and IsraelScience Foundation., Grid'5000, ANR-19-CE39-0002,FP-Locker,FP-Locker : Renforcer l'authentification web grâce aux empreintes de navigateur(2019), ANR-19-CE39-0007,MIAOUS,Attaques sur la micro-architecture des systèmes ubiquitaires(2019) |
| Rok vydání: | 2022 |
| Předmět: | |
| Zdroj: | Network and Distributed System Security Symposium Network and Distributed System Security Symposium, Feb 2022, San Diego, United States. ⟨10.14722/ndss.2022.24093⟩ |
| Popis: | Browser fingerprinting aims to identify users or their devices, through scripts that execute in the users' browser and collect information on software or hardware characteristics. It is used to track users or as an additional means of identification to improve security. In this paper, we report on a new technique that can significantly extend the tracking time of fingerprint-based tracking methods. Our technique, which we call DrawnApart, is a new GPU fingerprinting technique that identifies a device based on the unique properties of its GPU stack. Specifically, we show that variations in speed among the multiple execution units that comprise a GPU can serve as a reliable and robust device signature, which can be collected using unprivileged JavaScript. We investigate the accuracy of DrawnApart under two scenarios. In the first scenario, our controlled experiments confirm that the technique is effective in distinguishing devices with similar hardware and software configurations, even when they are considered identical by current state-of-the-art fingerprinting algorithms. In the second scenario, we integrate a one-shot learning version of our technique into a state-of-the-art browser fingerprint tracking algorithm. We verify our technique through a large-scale experiment involving data collected from over 2,500 crowd-sourced devices over a period of several months and show it provides a boost of up to 67% to the median tracking duration, compared to the state-of-the-art method. DrawnApart makes two contributions to the state of the art in browser fingerprinting. On the conceptual front, it is the first work that explores the manufacturing differences between identical GPUs and the first to exploit these differences in a privacy context. On the practical front, it demonstrates a robust technique for distinguishing between machines with identical hardware and software configurations. Comment: Network and Distributed System Security Symposium, Feb 2022, San Diego, United States |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|