Firewalls under fire: Redoubts or beachheads?
We know what you’re thinking. Should the word “beachhead” be “breachhead”?
There are some curiously excellent words in English, a language that has never been hampered by petty National Academies or pedantic Vocabulary Commissars.
Even though English is a Germanic language, it has tons of words sucked in from Romance languages, notably Anglo-Norman and French, liberally borrowed from every country where English is used, and deliberately concocted as highbrow terms from Latin or Ancient Greek roots.
One awesome neo-classical word is the mathematical formalism idempotent, from the Latin words “idem” (the same) and “potentia” (power).
The idea here is that if you have a mathematical formula that gives the same result no matter how often you repeat it, you have idempotence.
For example, if you start with the number 1, then no matter how many times you multiply it by 1, you keep getting 1.
In computer science, this word also has an important meaning relating to reliability and repeatability, such as being sure that you will get the same answer from the same database every time for the same query – a level of determinism, if you like, on which you can provably rely.
Significantly, when Sir Tim Berners-Lee invented the World Wide Web and the first version of the HTTP protocol, he specified that HTTP requests to GET a specific URL should be idempotent, so that two different users, at different times and places, with different browsers, would nevertheless reliably get the same content back.
If you’re a scientific researcher looking to retrieve a paper, or a file full of data used to draw conclusions, you can see why this sort of repeatability is important.
In technical jargon, HTTP requests and replies are supposed to be stateless, meaning that they they don’t keep a record of your previous activities and inclinations.
That’s by design, so they maintain that aforementioned idempotence, and don’t tweak the replies you see between visits because the server already knows something about you and decides to treat you differently from other visitors.
Sadly, the commercial internet didn’t warm to statelessness, for a mixture of reasons varying from desirable to treacherous.
For example, online sellers don’t want the URL they’ve promoted to the world to spit out the same products at the same prices every time.
A good reason is that old products go out of stock and new products become available; a bad reason is that what you see is manipulated by money, and depends on which supplier is paying the biggest fee to be “chosen” as the “best product” every time you visit.
Also, statelessness means that useful settings such as which language you prefer, whether you want the light or dark theme, and whether you’ve logged in or not, can’t be remembered – imagine needing to put in your password over and over for every web page or image on a site.
The initial compromise involved what are known as cookies, simple name=value data strings that are each associated with a specific site, and that the site can use to keep track of what you’ve done and which choices you’ve made so far, for example by setting language=en-GB, textsize=large, or logintoken=C7XEYR7JVV.
Along with cookies, modern browsers also have a similar way of tracking users via a proper database known as local storage, which is more efficient (and allows much more tracking data to be kept by each site), but in common speech, we generally still just talk about cookies for all browser-managed storage of this sort.
Strictly speaking, all cookies are tracking cookies, because their very purpose is to make browsing stateful. However, we generally use “tracking cookies” these days as a term for website data that identifies you fairly closely, such as being able to say, “Here’s Duck back again,” rather than just, “This user would like British English.”
As we alluded to above, tracking cookies vary from useful and tolerable to devious and dangerous, depending on who’s collecting them, and what they’re doing with them.
For that reason, most browsers have built-in features to help you control the proliferation of cookies, some of which are tagged to stay valid for years.
For example, you might choose to trigger the Delete browsing data or Clear browsing data and cookies option in your browser’s settings to purge all cookies (and local storage) in one go, or even turn on an option to delete all cookies automatically every time you exit the browser.
Some users find auto-deleting cookies to be inconvenient (it forcibly logs you out from your favorite sites, even if you’ve told them to “remember me,” because it throws away the cookies they’d use to identify you next time), but the fact that this option exists is a good reminder that not all websites have your privacy and personal interests at heart.
Annoyingly, if not unexpectedly, website operators, including surprisingly many huge and legitimate vendors of software, products and services, have spent many years trying to figure out how to generate what are generally known as supercookies or browser fingerprints.
These are unofficial yet unique measurements and “signals” that can be leeched from your browser, and that help sites recognize you again, even if you log out, clear all your genuine cookies, and reboot between visits.
Example browser data that companies have used for underhand “re-identification” purposes include: the exact screen size your browser occupies in pixels; the set of plugins and extensions you’ve installed; the collection of fonts on your system (some programmers like Source Code Pro, others prefer IBM Plex Mono, but how many have both installed?); the precision of built-in timers; the range of media formats supported; and more.
Numerous details of this sort often vary subtly from system to system, to the point that when all of them are combined into what is effectively a single digital fingerprint, your browser can reliably be told apart from everyone else’s, even though there are probably more than 5 billion actively-used browser installations worldwide.
Browser makers have responded to this sort of mostly legal but widely hated behavior by deliberately reducing the accuracy and precision of some of the data they fed back to websites, so that supercookies and browser fingerprints are less likely to be unique.
These countermeasures include rounding off screen dimensions to a limited set of sizes, and deliberately adding random noise to timing measurements so that the results are good enough to be useful but not precise enough to be distinctive.
As you can imagine, that hasn’t stopped vendors and service providers from trying to come up with counter-countermeasures that bypass the browser makers’ supercookie protections, in the same sort of cat-and-mouse game that cybercriminals play with anti-malware and threat-blocking companies.
Sneaky new fingerprinting tricks that work to a company’s commercial benefit can always be justified, or at least explained away, by also using those tricks to detect fraud, scams, bots, and so on.
Alibaba seems to be the latest online juggernaut to get caught out, with blogger and technophile Matt Callaghan claiming to have spotted the Chinese e-commerce giant messing with his Bluetooth audio playback while taking digital fingerprints of his browser’s audio processing behavior.
Firefox contributor and security expert Tom Ritter then weighed in with an analysis of how the alleged Alibaba supercookie code works.
Ritter included a safe reimplementation of the offending code that you can use to test your own browser without feeding any data back to Alibaba, and commented on how well it actually fingerprints users in real life.
Alibaba’s code was deliberately and heavily obfuscated to disguise its behavior, but even though this is a technique much loved by malware authors, the cybercriminal world has copied this practice from legitimate sites, many of whom use scrambling tricks like this to “protect” their code.
(Callaghan notes that Alibaba’s files “appear to be part of Alibaba’s browser security and anti-abuse tooling.”)
The trick here is surprisingly simple.
First, use the browser’s audio generation code to produce a known tone – in this case, a simple sawtooth sound.
Then use the browser’s audio analysis function to split that tone back into the spectrum of frequencies it includes – this is what’s known as a Fourier transform, the mathematical basis of almost all compression and filtering tools for audio and video.
(Spectral analysis is a useful and desirable part of real-time audio processing for web chats and meetings, for example for removing background noise, boosting tinny voices by adding bass, and cutting out hiss from cheap microphones.)
A SHA-256 cryptographic hash of the output of that frequency analysis is then calculated and sent back to Alibaba to act as a sonic digital fingerprint of your specific combination of computer, audio algorithms, operating system, and browser version, all of which theoretically affect the results.
By simply generating and then analyzing the sound behind the scenes, there’s no giveaway sawtooth buzz noise while you’re loading the page, and even if you’ve muted that page or turned your speakers or headphones off, the processing nevertheless goes ahead and produces its results.
The theory is apparently that this fingerprint should act as a supercookie that’s affected by sufficiently many variables unique to your computer that no two users will end up with the same result. (Remember that a one-bit difference in the input gives a completely and randomly different SHA-256 output).
But if Alibaba really intended to use this secretly-concocted hash as a fingerprint, Ritter suggests that the method won’t work, at least in Firefox:
[B]rowser fingerprinting is a far-too-pervasive method of tracking users across the web, but at least for WebAudio specifically, it’s not very effective. Firefox has largely eliminated this fingerprinting vector․․․ We made the WebAudio [features] constant in Firefox 118 three years ago as part of our initial round of Fingerprinting Protection features.
In my admittedly limited tests, neither Firefox nor Ungoogled-chromium gave a single result in all environments, but Firefox at least produced an identical hash for different versions of the browser running on the same operating system.
Unfortunately, there’s not a lot that users can do to detect and prevent this sort of supercookie.
They’re designed to be unobtrusive and to rely on the kind of code used widely in legitimate web pages, and they’re intended to be regenerated automatically without relying on any regular cookies or local storage that you can easily detect, examine, and delete.
Callaghan, it seems, only noticed the Alibaba code because it happened to interfere with his multi-input Bluetooth headphones, which he’d set up to switch between his laptop and his phone based on which one the system thought might be about to produce audio output.
By chance, the sneaky Alibaba script triggered the output from his phone to be muted, even though no sound was ultimately played in his browser, and he was intrigued enough to wonder why.
Your best bet is to understand and get on top of managing regular cookies first, because any website setting traditional tracking cookies that you never get round to deleting can tell who you are anyway, without needing supercookies.
To learn more about cookies, local storage, and browser fingerprinting, try these links, which cover the Firefox, Chrome/Chromium, and Safari browser families:
Where we can all help is to let legitimate vendors know that unwanted and unmanageable browser trackers and fingerprinting code are unacceptable.
When browser makers introduce new features to rein in tracking and fingerprinting of this sort, be sure to like, share and comment positively in public when these features are announced.
Keeping the pressure on legitimate companies to stop using tricks and techniques that feel as though they’re more at home in the cybercriminal underworld․․․
․․․means that those very tricks and techniques become more useful as indicators of security compromise.
Why not ask how SolCyber can help you do cybersecurity in the most human-friendly way? Don’t get stuck behind an ever-expanding convoy of security tools that leave you at the whim of policies and procedures that are dictated by the tools, even though they don’t suit your IT team, your colleagues, or your customers!
Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!
Featured image of bitten biscuit (crunched cookie) by Vyshnavi Bisani via Unsplash.
We know what you’re thinking. Should the word “beachhead” be “breachhead”?
Do you back yourself to spot the scams that drop into your email inbox?
Could you teach your friends, family and colleagues to do the same?
Social engineering, evolved: Believable lies on a grand scale
By subscribing you agree to our Privacy Policy and provide consent to receive updates from our company.
