Image: Schwarz et al.
Academics have come up with a new technique that leaks data about users' browsers; enough to defeat anti-fingerprinting systems and privacy-preserving browser extensions to provide ways to identify users by their browser and underlying platform in a way that has not been done before.
Called "JavaScript Template Attack," this new technique revolves around the concept of JavaScript properties and the default values that browser engines return for basic JavaScript queries seeking the value of a certain property.
JavaScript environment templates
The researchers, all three from the Graz University of Technology, in Austria, created a system that automates the querying and collection of thousands of JavaScript properties and their default values from a user's environment.
The basic idea was to automate these queries and then rotate browsers, operating systems, hardware platform, and browser extensions, to collect the default values of all known JavaScript properties for each environment/installation.
Researchers then built a matrix of each environment's default properties values, creating a template -- hence the name of JavaScript Template Attack -- for each possible detection scenario, listing all environment-dependent property values.
The research team says these templates can be used at a later point to scan a visiting user and detect specific environment details based on the default property values the user's browser's returns.
This data can be used for creating user profiles (for traffic/user fingerprinting) that break user anonymity or for devious means, like refining the targeting of zero-day exploits.
A pretty powerful & accurate attack
The research team said tests showed their method was able to distinguish between all 40 tested environments; distinguish browser down to exact version; determine installed extensions based on how they modified native property values; determine even individual extension settings; determine extremely technical details such as the CPU vendor, actual operating system (not the one declared by user agents, which can be faked); determine the presence of a browser private mode; and even if the browser was running from within a virtual machine.
This information might be useful for tracking or might be more useful for refining exploits. It all depends on what the threat actor is trying to do, but the conclusion is that the method is reliable enough to work and bypass even privacy-hardened environments, like Tor on Android.
All in all, JavaScript Template Attacks turned out to be very powerful, as researchers also discovered a slew of JavaScript properties that had not been officially documented, which improved the accuracy of their method.
Image: Schwarz et al.
Furthermore, because browsers makers tend to improve their software with new Web APIs -- all of which are controllable via JavaScript -- the number of JavaScript properties has grown in the past years and is expected to grow, and improve the accuracy of JavaScript Template Attacks even more.
Image: Schwarz et al.
The research team said they hoped that browser makers and privacy extension developers use their work on uncovering environment-dependent differences between JavaScript property values to improve their products and stamp out any opportunities for user fingerprinting.
Additional details about this research can be found in a white paper named "JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits," available for download from here and here. A 20-minute video presentation, which the research team gave at the NDSS 2019 security conference, is available below: