when the anonymity ends for darknets - by denis makrushin and maria garnaeva
TRANSCRIPT
![Page 1: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/1.jpg)
Tor, I2P, FreeNet… for what?
![Page 2: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/2.jpg)
When the anonymity ends for darknets
Denis Makrushin (@difezza), Maria GarnaevaGlobal Research and Analysis Team, Kaspersky Lab
![Page 3: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/3.jpg)
“I know what you did last summer”
![Page 4: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/4.jpg)
… but how?
![Page 5: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/5.jpg)
“Freedom Hosting” in jail
![Page 6: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/6.jpg)
Exploits, fingerprinting… Yep-yep.
![Page 7: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/7.jpg)
Flash, HTML5, entry-node detection… Yep-yep.
![Page 8: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/8.jpg)
But how…
… could they find my mega-private-0day forum?!… could they find me?!
![Page 9: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/9.jpg)
PASSIVE DATA COLLECTION SYSTEMHOW THEY FOUND MY MEGA-PRIVATE-0DAY-FORUM OR …
![Page 10: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/10.jpg)
![Page 11: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/11.jpg)
>> EXITPOLICY ACCEPT *:*
![Page 12: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/12.jpg)
>> TSHARK –l 1 –W DUMP.PCAP
![Page 13: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/13.jpg)
Tor-user’s psychological portrait
![Page 14: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/14.jpg)
Psychological portrait. Part two.
![Page 15: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/15.jpg)
![Page 16: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/16.jpg)
ACTIVE DATA COLLECTION SYSTEMKNOCK-KNOCK, DUDE! OR …
![Page 17: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/17.jpg)
Traffic injection… Yep-yep.
![Page 18: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/18.jpg)
From “clearnet” with love
![Page 19: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/19.jpg)
So different cookies
![Page 20: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/20.jpg)
Tell me, who are you?
![Page 21: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/21.jpg)
Fingerprint
Device fingerprinting• Tracking you after you delete your cookies.• Tracking you after you change your IP address.• Various measurements such as the User-Agent
string, screen size, time zone, fonts, browser plugins and….rendering!
![Page 22: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/22.jpg)
Source: https://www.cosic.esat.kuleuven.be/publications/article-2334.pdfYear: 2013
Web-based fingerprint
![Page 23: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/23.jpg)
![Page 24: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/24.jpg)
Meanwhile, in Tor Browser: getImageData()
var canvas = document.getElementById("canvas");if (canvas.getContext){var canvas = document.getElementById("canvas"); if (canvas.getContext) { var ctx = canvas.getContext("2d");
ctx.fillStyle = "rgb(0,127,0)"; ctx.fillRect(10,10,20,20);
var Pixel = ctx.getImageData(29,10,2,1);
![Page 25: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/25.jpg)
Fifty shades of font rendering
hinting/antialiasing
CalibriTimes New RomanArialGeorgia
![Page 26: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/26.jpg)
Let me measure your text
![Page 27: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/27.jpg)
FONT VALUEImpact 3409372Georgia 3344049Courier New 3430809Consolas 3392005MS Gothic 3383290
GetClientBoundingRect()
![Page 28: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/28.jpg)
• The <span> tag is used to group inline-elements in a document.
• The <span> tag provides no visual change by itself.• The <span> tag provides a way to add a hook to a part of a
text or a part of a document.
<span>fingerprint</span>
for (var j = 0; j < STYLES.length; j++) {
var style = STYLES[j];var div = DIVS[style];var span = SPANS[style];
// This is where the measurment occurs.span.textContent = c;var w = span.offsetWidth;var h = div.offsetHeight;
// Add to checksum.
checksum = addsum(checksum, w);checksum = addsum(checksum, h);}
![Page 29: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/29.jpg)
“Yep-Yep, we know” – Tor Project
![Page 30: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/30.jpg)
Proof-of-concept: preparing patient
![Page 31: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/31.jpg)
Proof-of-concept: inject it!
![Page 32: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/32.jpg)
Proof-of-concept: analyze it!
![Page 33: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/33.jpg)
Proof-of-concept: peace of… dump
{"Times New Roman":"c2c91d5b3c4fecd9109afe0e", "Arial":"4917211a76ddf69db033e125", "Courier New":"eb211de3b75234ea90a50c3f", "Symbol":"709ab9f882b1808b323e7d09", "Droid Sans":"fbc25f5e038a28b94454fa13", "DejaVu Sans":"c0bf2bce71e4313758d1aba8", "serif":{"d":"5daa940a38e3b137916aadcb", "fonts":["Impact","Bookman Old Style","Consolas", "MS Gothic","Constantia","Calibri","Cambria","Wingdings", "Webdings","Ubuntu Mono","Inconsolata","Inconsolata LGC", "Source Code Pro","Lucida Handwriting","Georgia","System","vgaoem"]}, "sans-serif":{"d":"46a9a2d351881662502ed793","fonts":[]}}
![Page 34: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/34.jpg)
Vector of attack
![Page 35: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/35.jpg)
XSS is a pain of .onion
45%
29%
17%
9%
MediumLowXSSOthers
![Page 36: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/36.jpg)
I know you by the font
![Page 37: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/37.jpg)
Scanning onion again
59%
36%
05%
Online
Offline
Seized
30%
70%
JS
NoJS
05%
95%
Canvas
![Page 38: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/38.jpg)
Update Aug 2015: Fonts fixed
![Page 39: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/39.jpg)
Alternatives
• Math routines with floating point?• Measuring time of calculations?• Mouse/pointing events?• Battery Status API?• Unique keystrokes traits?• Other gaps…
![Page 40: When the anonymity ends for darknets - by Denis Makrushin and Maria Garnaeva](https://reader036.vdocument.in/reader036/viewer/2022062900/58ebecc61a28aba83f8b473b/html5/thumbnails/40.jpg)