Webデバイストラッキング手法の紹介

Transcript

1. 1.

   WebσόΠετϥοΩϯάख๏ͷ
 ঺հ @kuro_m88
 ৘ใՊֶएखͷձ ౙͷਞ 2019/01/20

2. 2.

   ࣗݾ঺հ • ࠇ࡚ ༏ଠ (@kuro_m88) • ৘ใՊֶएखͷձ װࣄ • ࢓ࣄ͸αʔόαΠυΤϯδχΞ

   • झຯͰαʔόӡ༻Λ͍ͯ͠·͢
3. 3.

   ຊ೔͓࿩͢Δ͜ͱ • ݸਓతʹWebσόΠετϥοΩϯάख๏͕ͲΜͳ΋ͷ͕ ଘࡏ͢Δͷ͔ௐ΂ͯɺڵຯਂ͔ͬͨख๏ͷ঺հ

4. 4.

   σόΠετϥοΩϯάͱ͸

5. 5.

   σόΠετϥοΩϯάΛ͍ͨ͠ཧ༝ • αʔόଆ͕ಉ͡ਓͱͷ௨৴Ͱ͋ΔࣄΛ஌Γ͍ͨ • Ұൠʹ = • ෳ਺σόΠεʹ·͕ͨΔ৔߹͸ΫϩεσόΠετϥοΩϯά

6. 6.

   σόΠετϥοΩϯάͰͰ͖Δ͜ͱ (ྫ) • ηογϣϯ(ϩάΠϯ)ͷҡ࣋ • ϦεΫϕʔεೝূ • σδλϧϑΥϨϯδΫε • ߦಈλʔήςΟϯά޿ࠂ

7. 7.

   σόΠετϥοΩϯάͷͨΊʹඞཁ ͳ͜ͱ • ಉҰ୺຤Λಛఆ/ਪఆ͢ΔͨΊͷ৘ใΛूΊͳ͚Ε͹ͳΒͳ͍ • Fingerprintingͱݴ͏ͱը໘ղ૾౓΍GPUͷڍಈ΍ UserAgent͕ྫͱͯ͠Α͘ڍ͛ΒΕΔ͕ɺεϚϗͷ৔߹͸
 ΄ͱΜͲҰॹʹͳͬͯ͠·͏

8. 8.

   σόΠετϥοΩϯάख๏ʹ
 ·ͭΘΔٞ࿦ • ݱ࣮ੈքͰԿ͔͠ΒͷαʔϏεΛఏڙ͢ΔதͰσόΠεΛτϥο Ωϯά͢Δࡍ͸ϢʔβʹڐՄΛऔͬͨΓ(ΦϓτΠϯ)ɺڋ൱͢Δ ͜ͱ͕Ͱ͖ͨΓ(ΦϓτΞ΢τ)͢Δ͜ͱ͕ଟ͍ • Ϣʔβͷίϯτϩʔϧ͕ޮ͔ͳ͍ํ๏͸໰୊ʹͳΔ͜ͱ͕ଟ͍ • ࠓճ͸ٕज़ͷ࿩ͷΈ͠·͢

9. 9.

   σόΠετϥοΩϯάٕज़6બʂ • Cookie • IP Address • HSTS Super Cookie

   • TCP Timestamp • SSL Session Ticket • IP Address (࠶)
10. 10.

    Cookie

11. 11.

    Cookie • Web։ൃ͍ͯ͠ΔਓͳΒ͖ͬͱ஌͍ͬͯΔ͸ͣ# • Same Origin Policy͕͋Δ • ྫ: example.com

    ͷCookie͸example.jpͷαʔό͔Β͸ݟΒΕͳ͍ • Cookie SyncΛ͢Δ͜ͱͰτϥοΩϯάͰ͖Δൣғ͕ͻΖ͕Δ • Apple͸ITPͱ͍͏΋ͷΛಋೖ͠CookieʹΑΔτϥοΩϯάʹ
 ੍ݶΛ͔͚͍ͯΔ • εϚϗͩͱIDFA/AdIDͱ͍͏΋ͷ΋͋Δ
12. 12.

    • ޿ࠂͷDSPͱSSPͷؒͳͲͰΑ͘ߦΘΕΔॲཧ Cookie Sync example.com: AAAA example.jp: BBBB example.com: AAAA

    redirect example.jp, param: =AAAA example.jp: BBBB, param: AAAA example.com: AAAA example.jp: BBBB =
13. 13.

    IP Address

14. 14.

    IP Address • 192.168.0.1ͷΑ͏ʹॻ͖ද͞ΕΔ΋ͷ • ʮΠϯλʔωοτ্ͷॅॴ ʯͳͲͱݴΘΕΔ͜ͱ΋ • 32bit, 2^32

    ≒ 43ԯ ௨Γͷදݱ͕Ͱ͖Δ • ஍ٿਓޱ73ԯਓʹ1ׂͭͮͭΓ౰ͯΒΕͳ͍ͱ͍͏ܽ఺Λ࣋ͭ
15. 15.

    IP Address͚ͩͰ͸τϥοΩϯάෆ ೳ • ʮΠϯλʔωοτ্ͷॅॴ ʯ= Ͱ͸ͳ͍ • ͱ͍͏ΑΓ •

    ͜ͷͨΊʹૹ৴ݩIP͕෼͔ͬͯ΋ಉҰૹ৴ݩͱ͸ݶΒͳ͍'
16. 16.

    NAT • NetworkAddressTranslation • Global IPΞυϨεΛԆ໋/અ໿͢Δٕज़ • PrivateIPΛ༻͍ɺ(srcIP,srcPort,dstIP,dstPort,protocolNum)ͷ ૊Έ߹ΘͤͰΞυϨεΛ1ରଟͰϚοϐϯά͢Δ •

    ISP͕ߦ͏৔߹͸CareerGradeNATͱ͔LargeScaleNAT
 ͱݺ͹ΕΔ
17. 17.

    ͱ͍͏͜ͱ͸… • Global IPͱPrivate IP͕1ରଟͰϚοϐϯά͞Ε͍ͯΔ͔Β
 ಛఆͰ͖ͳ͍ • Global IPͱPrivate IPͷ૊Έ߹Θ͕ͤಘΒΕΕ͹


    ಛఆͰ͖ΔͷͰ͸ • ※2ஈҎ্ͷଟஈNATͷ৔߹͸ಛఆෆೳ
18. 18.

    XHRํࣜ • JavaScriptͷXHRͰద౰ͳൣғͷશͯͷPrivateIPʹϦΫΤετ Λૹ৴͠ɺฦ͖ͬͯͨ΋ͷͷϨεϙϯελΠϜΛಛ௃ྔͱ͢Δ • ύέοτΛେྔʹૹΔͱ߈ܸʹͳΓ͔Ͷͳ͍ εΩϟϯ͢Δ

19. 19.

    WebRTCํࣜ • WebRTCͷRTCPeerConnectionͷicecandidateΛར༻͢Δ • WebRTC(P2P)ͷʮNAT௒͑ʯͷͨΊͷٕज़ • Private IP͕औಘͰ͖Δ ௚઀΍ΓऔΓ͢ΔͨΊʹ͓ޓ͍ͷIPΞυϨε
 (Private/Global)


    Λަ׵͢Δ
20. 20.

    HSTS Super Cookie

21. 21.

    HSTS Super Cookie • HSTSͱ͍͏ϓϩτίϧΛར༻ͨ͠ख๏ • HSTS: webαʔό͕httpͰΞΫηε͞Εͨ࣌ʹ࣍ճ͔Β
 httpsͰ઀ଓͯ͠΄͍͠ͱ͍͏৘ใΛ෇Ճ͢Δ •

    HSTSΛೝࣝͨ͠ϒϥ΢β͸࣍ճҎ߱httpͰURL͕ೖྗ ͞Εͯ΋࠷ॳ͔ΒhttpsͰΞΫηε͢ΔΑ͏ʹͳΔ
22. 22.

    HSTS Super Cookie • HSTSΛೝࣝͨ͠ϒϥ΢β͸࣍ճҎ߱httpͰURL͕ೖྗ͞Εͯ΋
 ࠷ॳ͔ΒhttpsͰΞΫηε͢ΔΑ͏ʹͳΔ • httpͰΞΫηεͤͨ͞΋ͷͷhttpsͰ௨৴͕དྷͨ => 1bitͷ৘ใྔ

    • 32ݸͷαϒυϝΠϯΛ༻ҙͯ͠ɺHSTS͕༗ޮ/ແޮΛϥϯμϜʹ
 ੾Γସ͑Δͱ32bitͷ৘ใྔʹͳΓɺ໿43ԯσόΠε͕ࣝผͰ͖Δ
23. 23.

    HSTS Super Cookie • Super CookieΛ"هԱͤ͞Δ" HSTS ON HSTS OFF

    HSTS ON a.example.com b.example.com c.example.com
24. 24.

    HSTS Super Cookie • Super CookieΛ"ಡΈग़͢" • HTTPͰΞΫηεͤ͞Δ • HSTS͕༗ޮͳͱ͜Ζ͚ͩHTTPͷͭ΋Γ͕


    HTTPSͰϦΫΤετ͕͘Δ 1 0 1 HTTP HTTPS HTTPS ϢʔβͷID: 011 a.example.com b.example.com c.example.com
25. 25.

    ࣮ࡍͷڍಈ

26. 26.

    TCP Timestamp

27. 27.

    TCP Timestamp

28. 28.

    RFC1323 • TCP Timestampʹ͍ͭͯنఆ • Timestamp͸1msʙ1ඵִؒͰ૿΍ܾ͢·Γ • OptionalͳϑΟʔϧυ • ߋ৽ִؒ͸໌ࣔ͞Ε͍ͯͳ͍,

    ࣮૷ґଘ
29. 29.

    TCPͷγʔέϯε൪߸ͱͷҧ͍͸ʁ • TCP Timestamp ≠ TCP Sequence ' • γʔέϯε൪߸͸σʔλͷόΠτຖʹৼΒΕΔ(32bit)

    • ߴ଎ͳωοτϫʔΫͰ͸୹࣌ؒͰΧ΢ϯλ͕1िͯ͠͠·͏ • λΠϜελϯϓ+γʔέϯε൪߸ͰύέοτͷॱংΛอূ͢Δ
30. 30.

    TCP TimeStampΛτϥοΩϯάʹར༻͢Δ • ͋Δఔ౓(25msʙ10minఔ౓)ஔ͍ͨ2ͭͷTCPύέοτͷ • ౸ண࣌ࠁ(t1, t2) • TCPλΠϜελϯϓ(ts1, ts2)

    • TCPλΠϜελϯϓͷप೾਺ΛٻΊΔ freq = (ts2 - ts0) * 1000 / (t1 - t0)
31. 31.

    TCP TimeStampΛτϥοΩϯάʹར༻ ͢Δ • TCPλΠϜελϯϓΛप೾਺ͰׂΔ • σόΠεͷuptime(ىಈ࣌ؒ)͕ٻ·Δ • uptime͑͞ٻ·Ε͹IPΞυϨεͱֻ͚߹ΘͤΕ͹୺຤͕
 ਪఆՄೳʹ(ͽͬͨΓಉ࣌ࠁʹىಈ͢Δ୺຤͸͍ͳ͍ͱԾఆ)

    uptime = ts1 / freq
32. 32.

    uptimeਪఆ͕؆୯ʹࢼͤΔπʔϧ • p0f (http://lcamtuf.coredump.cx/p0f3/) • ىಈͯ͠ΠϯλʔϑΣΠεΛࢦఆ͢Δ͚ͩ .-[ 10.0.3.10/47099 -> 10.0.3.1/22

    (syn) ]- | | client = 10.0.3.10/47099 | os = Linux 3.11 and newer | dist = 0 | params = none | raw_sig = 4:64+0:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 | `---- .-[ 10.0.3.10/47099 -> 10.0.3.1/22 (uptime) ]- | | client = 10.0.3.10/47099 | uptime = 0 days 0 hrs 8 min (modulo 198 days) | raw_freq = 250.04 Hz |
33. 33.

    ͏·͍͔͘ͳͦ͞͏ͳ఺ • Linuxͷ࣮૷ΛݟͨݶΓɺtimestampͷߋ৽͸CPUͷλΠϚʔׂΓࠐΈ͕ ϕʔεͬΆ͍(jiffies) • ୺຤͕εϦʔϓͯ͠Δؒ͸λΠϜελϯϓͷߋ৽͕ࢭ·Δ…ʁ • Linux v4.10͔ΒTCP Timestamp͕ίωΫγϣϯ͝ͱʹϥϯμϜʹͳͬͨ

    • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ commit/?id=95a22caee396cef0bb2ca8fafdd82966a49367bb
34. 34.

    SSL Session Ticket

35. 35.

    SSL Handshake https://blogs.msdn.microsoft.com/kaushal/2013/08/02/ssl-handshake-and-https-bindings-on-iis/

36. 36.

    SSL Session Ticket https://techblog.yahoo.co.jp/infrastructure/ssl-session-resumption/

37. 37.

    SSL Session Ticket https://techblog.yahoo.co.jp/infrastructure/ssl-session-resumption/

38. 38.

    SSL Session TicketΛτϥοΩϯάʹ ࢖͏ ౉ͨ͠νέοτΛ࢖ͬͯ࠶઀ଓͯ͘͠ΔͷͰ
 ಉҰϢʔβͩͱΘ͔Δ

39. 39.

    IP Address (࠶)

40. 40.

    IPv6 • ͖͞΄Ͳͷྫ͸IPv4 • IPv4͔ΒҠߦதͷٕज़(ͱݴΘΕ͍ͯΔ) • 2001:240:2401:4f7f:d051:d1bf:544e:cfc0 ͜Μͳײ͡Ͱද͞ΕΔ • 128bit,

    2^128 ≒ 340׾ݸ • ਓྨͷ൅ͷໟ1ຊ1ຊʹΞυϨεΛׂΓ౰ͯͯ΋શ͘৺഑ͳ͍
 εέʔϥϏϦςΟ(ͱݴΘΕ͍ͯΔ)
41. 41.

    IPv6͸NAT͠ͳ͍ͷ͔ʁ • NAT͸ෆཁ (NAT as a Firewallͷ࣌୅΋ऴΘΔ…ʁ) • → 1IP

    = ͷ࣌୅͕͖͍ͯΔ • සൟʹม͑Δͱ௨৴͕੒ཱ͠ͳ͘ͳΔ • !୹໋ͳIDͱͯ͠ػೳ͠͏Δ
42. 42.

    IPv6ͷσϓϩΠঢ়گ • Appleͷ৹ࠪͰIPv6ରԠ͕ඞਢʹ • ೔ຊͷܞଳΩϟϦΞ͸IPv6σϓϩΠʹফۃతͩͬͨ • ૯຿লౖ͕ͬͯ2017೥౓தͷ
 ಋೖΛཁ੥ • ࠓͰ͸ΘΓͱ


    ීٴ͖͍ͯͯ͠Δ͸ͣ
43. 43.

    ·ͱΊ • ༷ʑͳσόΠεͷτϥοΩϯάख๏Λௐࠪ͠·ͨ͠ • ཁૉٕज़ͷ໨త͔Β͢ΔͱҙਤͤͣτϥοΩϯάͰ͖ ͯ͠·͏΋ͷʹؔͯ͠͸ηΩϡϦςΟ্ͷཧ༝͔Βम ਖ਼͕Ճ͑ΒΕ͍ͯΔ΋ͷ΋͋Δ