JavaScript Template Attacks expose new browser fingerprinting vectors

[The AchieVer]

JavaScript Template Attacks expose new browser fingerprinting vectors

Environment-dependent JavaScript property values allow for user fingerprinting.

 

 

 

Image: Schwarz et al.

 

Academics have come up with a new technique that leaks data about users' browsers; enough to defeat anti-fingerprinting systems and privacy-preserving browser extensions to provide ways to identify users by their browser and underlying platform in a way that has not been done before.

 

Called "JavaScript Template Attack," this new technique revolves around the concept of JavaScript properties and the default values that browser engines return for basic JavaScript queries seeking the value of a certain property.

JAVASCRIPT ENVIRONMENT TEMPLATES

The researchers, all three from the Graz University of Technology, in Austria, created a system that automates the querying and collection of thousands of JavaScript properties and their default values from a user's environment.

 

The basic idea was to automate these queries and then rotate browsers, operating systems, hardware platform, and browser extensions, to collect the default values of all known JavaScript properties for each environment/installation.

 

Researchers then built a matrix of each environment's default properties values, creating a template -- hence the name of JavaScript Template Attack -- for each possible detection scenario, listing all environment-dependent property values.

 

The research team says these templates can be used at a later point to scan a visiting user and detect specific environment details based on the default property values the user's browser's returns.

 

This data can be used for creating user profiles (for traffic/user fingerprinting) that break user anonymity or for devious means, like refining the targeting of zero-day exploits.

A PRETTY POWERFUL & ACCURATE ATTACK

 

The research team said tests showed their method was able to distinguish between all 40 tested environments; distinguish browser down to exact version; determine installed extensions based on how they modified native property values; determine even individual extension settings; determine extremely technical details such as the CPU vendor, actual operating system (not the one declared by user agents, which can be faked); determine the presence of a browser private mode; and even if the browser was running from within a virtual machine.

 

This information might be useful for tracking or might be more useful for refining exploits. It all depends on what the threat actor is trying to do, but the conclusion is that the method is reliable enough to work and bypass even privacy-hardened environments, like Tor on Android.

 

All in all, JavaScript Template Attacks turned out to be very powerful, as researchers also discovered a slew of JavaScript properties that had not been officially documented, which improved the accuracy of their method.

 

Image: Schwarz et al.

Furthermore, because browsers makers tend to improve their software with new Web APIs -- all of which are controllable via JavaScript -- the number of JavaScript properties has grown in the past years and is expected to grow, and improve the accuracy of JavaScript Template Attacks even more.

 

Image: Schwarz et al.

The research team said they hoped that browser makers and privacy extension developers use their work on uncovering environment-dependent differences between JavaScript property values to improve their products and stamp out any opportunities for user fingerprinting.

 

Additional details about this research can be found in a white paper named "JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits," available for download from here and here. A 20-minute video presentation, which the research team gave at the NDSS 2019 security conference, is available below:

 

 

Source

[steven36]

ZDNet  is a little late to the party ,  the open source tool and 1st JavaScript Template Attacks POC was released back in AUG  2018  and all that research above was done months ago FEB 2019 . So they not reporting new news really , That YouTube video was posted in April 2019  All it takes is a open source tool to preform these type of attack.

POC

https://github.com/IAIK/jstemplate

Reserch

https://www.ndss-symposium.org/ndss-paper/javascript-template-attacks-automatically-inferring-host-information-for-targeted-exploits/

 

 

 Brendan Eich wrote Java Script in just 10 days  back in the 90s

https://www.thoughtco.com/a-brief-history-of-javascript-2037675

 

There was not much thought process put into the scripting  language and it was  the browser makers who implemented  it into the internet try browsing many sites without it you want get very far and  sites that don't  require it run just fine without it . So it's there  fault for all the risk  that comes with it .  Some evil  Tech  and hackers turned it  into a way to spy on users and exploit them.