JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits

Abstract

Today, more and more web browsers and extensions provide anonymity features to hide user details. Primarily used to evade tracking by websites and advertisements, these features are also used by criminals to prevent identification. Thus, not only tracking companies but also law-enforcement agencies have an interest in finding flaws which break these anonymity features. For instance, for targeted exploitation using zero days, it is essential to have as much information about the target as possible. A failed exploitation attempt, e.g., due to a wrongly guessed operating system, can burn the zero-day, effectively costing the attacker money. Also for side-channel attacks, it is of the utmost importance to know certain aspects of the victim's hardware configuration, e.g., the instruction-set architecture. Moreover, knowledge about specific environmental properties, such as the operating system, allows crafting more plausible dialogues for phishing attacks. We found environment-dependent properties in Firefox, Chrome, Edge, and mobile Tor, allowing us to reveal the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version. We stress that our method should be used in the development of browsers and privacy extensions to automatically find flaws in the implementation.

SoK: In Search of Lost Time: A Review of JavaScript Timers in Browsers

“…Sanchez-Rola et al [50] showed a method relying on computer internal clock imperfections to fingerprint unique machines. Schwarz et al [51] presented JavaScript template attacks to create fingerprints and retrieved the instruction-set architecture and the used memory allocator.…”

A Machine Learning Based Monitoring Framework for Side-Channel Information Leaks

“…In addition to /proc file system data, and unprivileged API calls, side-channels may be formed by the methods exposed to unprivileged browser JavaScript. In [17], the authors perform a statistical analysis on these browser properties and demonstrate the detection of the; underlying operating system, CPU architecture, privacy-enhancing browser extensions, and exact browser version.…”

Detection of Advanced Web Bots by Combining Web Logs with Mouse Behavioural Biometrics

“…Rule-based web bot detection techniques that use browser fingerprints include font detection, plugin enumeration, WebGL fingerprinting, examination of unique to browser automation software strings in JavaScript variables, and more [5,23,31]. Furthermore, more advanced fingerprinting techniques have been proposed that can extract low level properties, such as the instruction-set architecture, and the used memory allocator [31]. However, research has shown that current commercial tools that detect web bots based on their fingerprint present several flaws [5].…”

“…Such web bots can crawl web servers in a humanlike manner to collect information making them harder to detect. Additionally, we can assume that the malicious web bots exhibit a fingerprint that is indistinguishable from that of a browser as in the opposite case, such bots could be deterministically detected using advanced fingerprinting techniques [5,22,23,31]. This is a logical assumption, as the respective Indicators of Compromise have a low pain threshold (i.e., they require low effort to be changed) [8].…”