Browser-Based CPU Fingerprinting” by Leon Trampert, Christian Rossow, and Michael Schwarz at the ESORICS 2022 conference, with proceedings published on September 26, 2022.
Virtualization is insufficient protection for your identity.
You at risk if your government is displeased: Reporters, Activists, Lawyers, Politicians, Law Enforcement.
Be safe out there…
Edit: CPU fingerprint, whelp..
Pauls hardware just touched on this. A valorant player got banned for a blacklisted 2nd hand cpu.
CPUs don’t have unique serial numbers, how did the CPU get blacklisted?
A cpu with tpm inside it? The article doesn’t go into details… HWID something something
https://cybernews.com/security/second-hand-cpu-unable-to-play-valorant-hardware-hwid-ban/
So perhaps some kind of HASH of the hardware configuration ?
Paul also mentioned in the video that other components maybe part of the same hardware banning too.
Yes they do. Most stuff in a pc has a serial number for obvious reasons.
You need to use software to read it sometimes
Fingerprinting is not the same thing as just reading a serial number.
The thing in the op is figuring out what cpu type and model by doing tricks to figure out core number, cache size and some other techincal details. Thats because you cant just interrogate hardware ids from a browser web application.
Anticheat runs with highest possible privileges (often kernel), so it can read whatever, thats not news nor scary, you expect anticheat to be extremely invasive like that.
That said love to see valorant being extremely dumb with the power they have. Hwid bans are a joke and only end up screwing over random people thag buy used hardware.
What unique ID does consumer CPU have?
Serial number
It just tells you the model, it’s not unique for each unit.
The irony…
sigh While I did temporarily allow JS for this particular domain to access the paper, I did not disable my Ublock Origin or pihole, GFY…
I feel like some here haven’t actually read it, as it’s more to do with javascript based cache timing heuristics, than anything to do with TPM’s (CTRL+F “tpm” no results). It’s running benchmarks and analyzing the performance to guess the probable CPU.
This can in theory be mitigated by the JS sandbox applying certain limits and randomization, and an effort to make machines act unpredictably (or better yet closer to each other to blend in with the herd), at the cost of performance. And may still not be sufficient, as there are many variables and mechanisms to consider…
PS: you can disable WebAssembly without disabling Javascript entirely, to at least reduce the attack surface:
javascript.options.baselinejit = false
javascript.options.asmjs = false
javascript.options.ion = false
javascript.options.wasm = false
PPS: you can also disable Web Worker API / Service Workers without fully disabling JS:
dom.serviceWorkers.enabled = false
Those are firefox about:config but similar flags exist for chrome, you’ll have to find those yourself.
Mitigating fingerprinting is a very complex issue; if you simply disable Javascript you’re that one weirdo not running JS making you stand out (yes I am one of those weirdos but I no longer care), or your a bot / scraping. That’s why tools like Anubus run JS puzzles for the browser to solve.
Speaking of client challenges such as Anubis and captcha’s and such; many discorse / l1t thread link embeds have been breaking due to client checks in the last years or so:
BTW, similar mechanisms exist for determining your GPU via canvas and various rendering API’s.
While this paper is not to do with TPM’s, unfortunately there are some API’s for accessing the TPM from JS
TBH, I haven’t actually explored browser based TPM access until this thread reminded me of the possibility. I have more reading to do…
Don’t even get me started on Web Environment Integrity (WEI) that was thankfully abandoned…for now… we’ll see what the future holds.
However, cancerous kernel mode anticheat systems weaponizing the Endorsement Key (EK) against the consumer is absolutely a thing and has been for years now. A bit outdated now, but an interesting POC on this topic:
Without getting too ranty about remote attestation; if you don’t own the keys to your own lock, you don’t own your computer.
