DRAWNAPART: A Device Identification Technique based on ...

1 DRAWNAPART: A Device Identification Techniquebased on Remote GPU FingerprintingTomer Laor*Ben-Gurion Univ. of the Mehanna*Univ. Lille, CNRS, DureyUniv. Lille, CNRS, DyadyukBen-Gurion Univ. of the LaperdrixUniv. Lille, CNRS, ementine MauriceUniv. Lille, CNRS, OrenBen-Gurion Univ. of the RouvoyUniv. Lille, CNRS, Inria / RudametkinUniv. Lille, CNRS, YaromUniv. of Browser fingerprinting aims to identify users ortheir devices, through scripts that execute in the users browserand collect information on software or hardware is used to track users or as an additional means of iden-tification to improve security.

2 Fingerprinting techniques haveone significant limitation: they are unable to track individualusers for an extended duration. This happens because browserfingerprints evolve over time, and these evolutions ultimatelycause a fingerprint to be confused with those from other devicessharing similar hardware and this paper , we report on a new Technique that can signif-icantly extend the tracking time of fingerprint- based trackingmethods. Our Technique , which we call DRAWNAPART, is anewGPU fingerprintingtechnique that identifies a Device fromthe unique properties of its GPU stack.

3 Specifically, we showthat variations in speed among the multiple execution unitsthat comprise a GPU can serve as a reliable and robust devicesignature, which can be collected using unprivileged investigate the accuracy of DRAWNAPART under two sce-narios. In the first scenario, our controlled experiments confirmthat the Technique is effective in distinguishing devices withsimilar hardware and software configurations, even when theyare considered identical by current state-of-the-art fingerprintingalgorithms. In the second scenario, we integrate aone-shotlearningversion of our Technique into a state-of-the-art browserfingerprint tracking algorithm.

4 We verify our Technique througha large-scale experiment involving data collected from over 2,500crowd-sourced devices over a period of several months and showit provides a boost of up to 67% to the median tracking duration,compared to the state-of-the-art two contributions to the state of theart in browser fingerprinting. On the conceptual front, it is thefirst work that explores the manufacturing differences between*Both authors are considered co-first GPUs and the first to exploit these differences in aprivacy context. On the practical front, it demonstrates a robusttechnique for distinguishing between machines with identicalhardware and software configurations, a Technique that deliverspractical accuracy gains in a realistic is dignity.

5 It is a human right. In the domain ofweb browsing, the right to privacy should prevent websitesfrom tracking user browsing activity without consent. This isthe case in particular for cross-site tracking, in which websiteowners collude to build browsing profiles spanning multiplewebsites over extended periods of time. Unfortunately forusers, the right to privacy conflicts with business owners are highly interested in tracking users for thepurpose of showing them ads they are more likely to click on,or to recommend products they are more likely to focus on the common scenario where identifying abrowser is equivalent to tracking a user.

6 The traditional wayto track users is with cookies, small files that are stored bythe browser at the request of the website, and forwarded tothe website on demand [50]. Recent regulations restrict andsupervise the acquisition of private data by websites [4, 31],and in particular require that users consent to the use ofcookies. Furthermore, in an effort to protect users privacy andcurb tracking, modern browsers restrict cookie- based tracking,especiallythird-party trackersthat attempt to track users acrossmultiple unrelated overcome the limitations of cookies, less scrupulouswebsites often resort to an approach calledbrowser fingerprint-ing.

7 To fingerprint a browser, the website provides a script thatqueries the browser s software and hardware configuration tocollect attributes, such as the browser s version, OS, timezone,screen, language, list of fonts, or even the way the browserrenders text and graphics. The diversity of configurationsallows websites to discriminate devices and, hence, to trackusers, without the use of cookies [52], even in a collectionspanning millions of fingerprints [43]. Surveying the InternetNetwork and Distributed Systems Security (NDSS) Symposium 202227 February - 3 March 2022, San Diego, CA, USAISBN 1-891562-74-6 [ ] 24 Jan 2022demonstrates that browser fingerprinting techniques are preva-lent and used by many websites, no matter their category orranking [38, 40, 59].

8 A significant difficulty of fingerprint- based tracking is thatbrowser fingerprints evolve. As shown by Vastel et al. [73],fingerprints change frequently, sometimes multiple times perday, due to software updates and configuration changes. Totrack a user, an adversary must link fingerprint evolutionsinto a single coherent chain. This process is made difficult bythe existence of devices with identical hardware and softwareconfigurations. It is difficult for an adversary to correctly linka fingerprint if there is a set of identical devices to which itmight belong.

9 This limits the adversary s tracking Vastel et al. s evaluation over a dataset of nearly 100,000fingerprints collected from 1,905 distinct browser instances,with a wide variety of fingerprinting attributes, their state-of-the-art machine learning Technique was able to deliver amedian tracking time of less than two this work, we bring a new insight to the challengeof browser fingerprinting identical computers, by observingthat even nominally identical hardware devices have slightdifferences induced by their manufacturing process.

10 Thesemanufacturing variations are shown to enable the extraction ofunique and robust fingerprints from a variety of devices, bothlarge and small, in other settings [44, 71]. If an adversarywere able to extract such a hardware fingerprint from theuser s Device , it would significantly extend the adversary sability to track them. Extracting a hardware fingerprint froma browser, however, is far from trivial since the attackerhas little control. In particular, the attacker can only interactwith the system through unprivileged JavaScript code andWebGL graphics primitives the attacker has no control overthe runtime environment of the system, including backgroundprocesses and simultaneous user activity and the attacker hasvery limited exposure to the system, making classical machinelearning pipelines that rely on long training phases all butuseless.