"Officers, arrest that GPU" - Researchers use GPU fingerprinting to track users online

[Lightwreather]

Summary

A team of researchers from French, Israeli, and Australian universities has explored the possibility of using people's GPUs to create unique fingerprints and use them for persistent web tracking.

The results of their large-scale experiment involving 2,550 devices with 1,605 distinct CPU configurations show that their technique, named 'DrawnApart,' can boost the median tracking duration to 67% compared to current state-of-the-art methods.

 

Quotes

Quote

The researchers considered the possibility of creating distinctive fingerprints based on the GPU (graphics processing unit) of the tracked systems with the help of WebGL (Web Graphics Library).

WebGL is a cross-platform API for rendering 3D graphics in the browser, and it's present on all modern web browsers.

Using this library, the DrawnApart tracking system can count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more.

DrawnApart uses short GLSL programs executed by the target GPU as part of the vertex shader to overcome the challenge of having random execution units handling the computations. Hence, the workload allocation is predictable and standardized.

The team developed both an on-screen measurement method that executes a small number of computationally intensive operations and an offscreen method that puts the GPU through a lengthier and less intensive test.

This process generates traces consisting of 176 measurements taken from 16 points that are used to create a fingerprint. Even when evaluating the individual raw traces visually, one can notice differences and distinct timing variations between devices.

This evaluation was based on the testing conditions that the GPU operational temperature range is between 26.4 °C and 37 °C, with no voltage variations.

Apart from these conditions, workload variations, GPU payloads from other web browser tabs, system restarts, and other runtime changes don't affect DrawnApart.

The next-gen GPU APIs currently in development, most notably WebGPU,  features compute shaders which come in addition to the existing graphics pipeline.

As such, the upcoming API may introduce even more ways to fingerprint internet users, and quite likely faster and far more accurate too.

When the researchers tested compute shaders in the now-abandoned WebGL 2.0, they found that DrawnApart delivered 98% classification accuracy in just 150 milliseconds, much faster than the 8 seconds used to collect fingerprinting data through the WebGL API.

"We believe that a similar method can also be found for the WebGPU API once it becomes generally available. The effects of accelerated compute APIs on user privacy should be considered before they are enabled globally," concludes the research paper.

Potential countermeasures to this fingerprinting method include attribute value changes, parallel execution prevention, script blocking, API blocking, and time measurement prevention.

The developer of the WebGL API, Khronos group, has received the researchers' disclosure on the above and formed a technical study group to discuss potential solutions with browser vendors and other stakeholders.

 

My thoughts

Oh bother. Another method of tracking us, and even more so with our precious GPUs. You know this is an awfully convienient time for just such a method of tracking, especially since we can't burn our GPUs. /s Jokes aside, this is honestly a bit frightening. Apparently, we can be tracked with the minor (seriously minor) performance differences of our GPU. This seems to be able to use any GPU that uses the WebGL API, thus meaning that literally everyone can be tracked using this (since practically every GPU (i or d) every web browser uses (or at least supports) the WebGL API (Correct me if I'm wrong). Thankfully this does also provide a way to counteract this. Namely scriptblockers and I should think that temperature and voltage changes should affect this as well (again, correct me if I'm wrong). Full research paper is linked below incase you want to read that. Well, hopefully Khronos gets a fix or patch out (if it's even possible).

 

Sources

Bleeping computer

Research paper - arxiv

[Dabombinable]

Fuck it, I'm breaking out my FX5500 and switching to Fedora.

[greenhorn]

That method is interesting, but it can be abused (as can all tracking methods). From what I have read, I think it could be also be circumvented by randomizing some GPU parameters like clock and voltage in a small range, so that it is not noticeable for the user but still manages to throw off that tracking algorithm.

[porina]

Without looking at the details, there has already been concern in the past that just looking at browser reported details was already a large fingerprint. Depending on software versions, plugins etc, it was quite easy to have a near unique footprint. So I'd see this GPU technique as possibly extending upon that.

 

I wonder if the only way we might get past this is to have some standard browser profiles, so everyone looks as similar as possible regardless of the underlying hardware. It'll never happen as long as data tracking companies are involved with the most used browsers, but I can dream.

[leadeater]

So basically disable GPU acceleration?

[Sauron]

Well, time to block webGL I guess.

[grg994]

The sad truth is that researchers must overhype their discoveries for academic reasons.

 

This is a 8+ years old problem: https://en.wikipedia.org/wiki/Canvas_fingerprinting

 

There is nothing now about it, someone just found a more efficient algorithm to exploit.

[Quackers101]

*gets SLI in VM* oh

[porina]

1 hour ago, leadeater said:

So basically disable GPU acceleration?

Looks like Lynx is still a thing.

[BuckGup]

3 hours ago, porina said:

Without looking at the details, there has already been concern in the past that just looking at browser reported details was already a large fingerprint. Depending on software versions, plugins etc, it was quite easy to have a near unique footprint. So I'd see this GPU technique as possibly extending upon that.

 

I wonder if the only way we might get past this is to have some standard browser profiles, so everyone looks as similar as possible regardless of the underlying hardware. It'll never happen as long as data tracking companies are involved with the most used browsers, but I can dream.

Yes I actually have a solution I'm working on that essentially does what you are asking. The website is currently under development but it was spawned from knowledge I learned regarding carding. Essentially you can use AntiDetect browser which allows you to download someones cookies and fingerprint and clone it. Paired with a residential IP from a proxy you now look exactly like the person online. You look so much like them you actually are automatically signed in to all their accounts and it doesn't set off anti-fruad/bot detection. Now this is typically done for malicious use but combined with a crawler like Noizy you can now spawn virtual clones of yourself online that look identical to you. Which clouds your advertising profile and makes it meaningless as the ads will no longer be targeted. It's one of the biggest flaws online at the moment. There's an absolute assumption everything you do online is done by you with intent. 

 

A stretch goal is to have the crawler be trained by you browsing the web so the mouse cursor interaction and site navigation is valid for you. As well as implementing online training so the bots can slowly evolve over time to have their own interests. Honestly depending on how well it can learn it's borderline giving birth to your virtual children since the starting seed is based upon you. 

[Beerzerker]

Isn't that what Nvidia Telemetry is for?
Comes with every Nvidia driver nowadays and I believe there is something else that's called "Nvidia Experience" or something along those lines too.

AMD isn't any different but can't recall or say what their thing is.

[darknessblade]

I wonder what would happen if you put a DUMMY GPU in your system?

 

Would their system still be able to track you or would it get weird conflicting data, as it detects multiple GPU's

[maplepants]

9 hours ago, greenhorn said:

That method is interesting, but it can be abused (as can all tracking methods). From what I have read, I think it could be also be circumvented by randomizing some GPU parameters like clock and voltage in a small range, so that it is not noticeable for the user but still manages to throw off that tracking algorithm.

This is probably what Safari and probably other browsers will end up doing. Safari circumvents fingerprinting mostly by just lying to the web page in some innocuous way about a random number of the typical fingerprinting values. I think Firefox does this too, and there are probably also others. 
 

To me, this is where the future is going. Web browsers will basically report estimates instead of exact values for as many things as they can get away with, and trackers will continue to find more ways to interact directly with your hardware in a way that tells them something about your config. 

[WhitetailAni]

But which one, officer?

 

I'm not kidding, I can decide which GPU I use for WebGL simply by dragging my window. Main is on the 690, secondary is on the 650 Ti, tertiary is on the P620.

[Beerzerker]

11 hours ago, FakeKGB said:

But which one, officer?

"I want to see your license, registration and proof of insurance for each of those cards".....

You can't go out on the web's information superhighway without all that.

[AndreiArgeanu]

I'm not very worried since I use firefox and they have features that already blocks things like social media trackers, cross site cookies, fingerprinters and so on, and I don't doubt that this will be added to the list of things that you can block.

[Fasterthannothing]

But this is pointless. Let's say they do use it as a fingerprint as soon as you change your overclock it's worthless. I don't know about others but I change my overclock a lot I swap between ones for mining, ones for games, and then sometimes I'll run on a high stability clock etc.

[Alcarin]

Hurray MORE methods to track and profit off our online activity. As if there weren't enough.

 

Big Tech will absolutely abuse this the first chance they get.

[porina]

23 minutes ago, SlidewaysZ said:

But this is pointless. Let's say they do use it as a fingerprint as soon as you change your overclock it's worthless. I don't know about others but I change my overclock a lot I swap between ones for mining, ones for games, and then sometimes I'll run on a high stability clock etc.

It doesn't have to be that exact. Say they have 30 bits of information about you. They then see a device with 29/30 matching, there's still a fair chance it's you. The point about this technique is to extract another potential identifier. It is not the sole identifier.

[Kisai]

On 1/31/2022 at 12:51 AM, J-from-Nucleon said:

Summary

A team of researchers from French, Israeli, and Australian universities has explored the possibility of using people's GPUs to create unique fingerprints and use them for persistent web tracking.

The results of their large-scale experiment involving 2,550 devices with 1,605 distinct CPU configurations show that their technique, named 'DrawnApart,' can boost the median tracking duration to 67% compared to current state-of-the-art methods.

 

 

We were all warned about this when both WebGL  and WASM became things. Turn that stuff off by default. Don't run without a user interaction.

 

[Beerzerker]

I've heard before they already have a way to get around changes in settings you'd make to try and throw them off.
This would mean each component has it's own unique serial number in the BIOS/Firmware so they can pin it down with ease.
How To Find My Computer's Serial Number

This does pertain to the PC but also shows about such serials concerning individual components too.
If this means what it appears to and is accurate, you know what it means.

[WhitetailAni]

1 hour ago, Beerzerker said:

"I want to see your license, registration and proof of insurance for each of those cards".....

You can't go out on the web's information superhighway without all that.

"I got these cards used, sir, and they didn't come with any of that."

[SolarNova]

They may be able to track that place X , Y and Z have been visited by the same GPU, but that means nothing if they cant track down the location of said GPU.

[whm1974]

20 minutes ago, SolarNova said:

They may be able to track that place X , Y and Z have been visited by the same GPU, but that means nothing if they cant track down the location of said GPU.

Shh don't give them any ideas please. I'm sure some group of "Researchers" somewhere are working on that right now.