Shulou(Shulou.com)05/31 Report--

Scholars have proposed a new technology that can reveal the data of users' browsers. Enough to overcome anti-fingerprint systems and browser extensions to protect privacy and provide a way to identify users through browsers and underlying platforms that have never been done before.

The new technology, called JavaScript template attack, focuses on the concept of the JavaScript property and the default values for basic JavaScript queries returned by the browser engine.

Three researchers at Gratz University of Technology in Austria have created a system that automatically queries and collects thousands of JavaScript attributes and their default values from the user's environment.

The basic idea is to automate these queries and then rotate the browser, operating system, hardware platform, and browser extensions to collect default values for all known JavaScript attributes for each environment / installation.

The researchers then build a default attribute value matrix for each environment and create a template for each possible detection scenario-- the name of the JavaScript template attack-- that lists all the attribute values related to the environment.

According to the research team, these templates can be used in the future to scan visiting users and detect specific environment details based on the default attribute values returned by the user's browser.

This data can be used to create user profiles (for traffic / user fingerprints) to break user anonymity or for fraudulent methods such as refining the target of a zero-day attack.

The research team said the tests showed that their approach could distinguish between all 40 test environments. Break browsers into precise versions; determine them based on how the installed extension modifies native property values; even determine the settings of a single extension; identify highly technical details, such as the CPU vendor and the actual operating system (rather than the operating system that the user agent can forge); determine if there is a browser private mode; even if the browser is run from a virtual machine.

This information may be helpful in tracking, or more helpful in improving vulnerabilities. It all depends on what the threat actor is trying to do, but the conclusion is that this method is reliable enough to work, even bypassing privacy-enhanced environments such as tor on android.

All in all, JavaScript template attacks are very powerful because researchers have also found a large number of JavaScript attributes that are not officially documented, thus improving the accuracy of their methods.

In addition, browser makers tend to use new web API to improve their software-all of which can be controlled by JavaScript. The number of JavaScript attributes has been increasing over the past few years and is expected to increase further, which will further improve the accuracy of JavaScript template attacks.

The research team expressed the hope that browser manufacturers and privacy extension developers will use their work to reveal differences in JavaScript attribute values according to the environment, thereby improving their products and providing users with any opportunity for fingerprint recognition.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.