Webデバイストラッキング手法の紹介

Transcript

1. WebσόΠετϥοΩϯάख๏ͷ
 ঺հ @kuro_m88
 ৘ใՊֶएखͷձ ౙͷਞ 2019/01/20

2. ࣗݾ঺հ • ࠇ࡚ ༏ଠ (@kuro_m88) • ৘ใՊֶएखͷձ װࣄ • ࢓ࣄ͸αʔόαΠυΤϯδχΞ

   • झຯͰαʔόӡ༻Λ͍ͯ͠·͢

3. ຊ೔͓࿩͢Δ͜ͱ • ݸਓతʹWebσόΠετϥοΩϯάख๏͕ͲΜͳ΋ͷ͕ ଘࡏ͢Δͷ͔ௐ΂ͯɺڵຯਂ͔ͬͨख๏ͷ঺հ

4. σόΠετϥοΩϯάͱ͸

5. σόΠετϥοΩϯάΛ͍ͨ͠ཧ༝ • αʔόଆ͕ಉ͡ਓͱͷ௨৴Ͱ͋ΔࣄΛ஌Γ͍ͨ • Ұൠʹ = • ෳ਺σόΠεʹ·͕ͨΔ৔߹͸ΫϩεσόΠετϥοΩϯά

6. σόΠετϥοΩϯάͰͰ͖Δ͜ͱ (ྫ) • ηογϣϯ(ϩάΠϯ)ͷҡ࣋ • ϦεΫϕʔεೝূ • σδλϧϑΥϨϯδΫε • ߦಈλʔήςΟϯά޿ࠂ

7. σόΠετϥοΩϯάͷͨΊʹඞཁ ͳ͜ͱ • ಉҰ୺຤Λಛఆ/ਪఆ͢ΔͨΊͷ৘ใΛूΊͳ͚Ε͹ͳΒͳ͍ • Fingerprintingͱݴ͏ͱը໘ղ૾౓΍GPUͷڍಈ΍ UserAgent͕ྫͱͯ͠Α͘ڍ͛ΒΕΔ͕ɺεϚϗͷ৔߹͸
 ΄ͱΜͲҰॹʹͳͬͯ͠·͏

8. σόΠετϥοΩϯάख๏ʹ
 ·ͭΘΔٞ࿦ • ݱ࣮ੈքͰԿ͔͠ΒͷαʔϏεΛఏڙ͢ΔதͰσόΠεΛτϥο Ωϯά͢Δࡍ͸ϢʔβʹڐՄΛऔͬͨΓ(ΦϓτΠϯ)ɺڋ൱͢Δ ͜ͱ͕Ͱ͖ͨΓ(ΦϓτΞ΢τ)͢Δ͜ͱ͕ଟ͍ • Ϣʔβͷίϯτϩʔϧ͕ޮ͔ͳ͍ํ๏͸໰୊ʹͳΔ͜ͱ͕ଟ͍ • ࠓճ͸ٕज़ͷ࿩ͷΈ͠·͢

9. σόΠετϥοΩϯάٕज़6બʂ • Cookie • IP Address • HSTS Super Cookie

   • TCP Timestamp • SSL Session Ticket • IP Address (࠶)

10. Cookie

11. Cookie • Web։ൃ͍ͯ͠ΔਓͳΒ͖ͬͱ஌͍ͬͯΔ͸ͣ# • Same Origin Policy͕͋Δ • ྫ: example.com

    ͷCookie͸example.jpͷαʔό͔Β͸ݟΒΕͳ͍ • Cookie SyncΛ͢Δ͜ͱͰτϥοΩϯάͰ͖Δൣғ͕ͻΖ͕Δ • Apple͸ITPͱ͍͏΋ͷΛಋೖ͠CookieʹΑΔτϥοΩϯάʹ
 ੍ݶΛ͔͚͍ͯΔ • εϚϗͩͱIDFA/AdIDͱ͍͏΋ͷ΋͋Δ

12. • ޿ࠂͷDSPͱSSPͷؒͳͲͰΑ͘ߦΘΕΔॲཧ Cookie Sync example.com: AAAA example.jp: BBBB example.com: AAAA

    redirect example.jp, param: =AAAA example.jp: BBBB, param: AAAA example.com: AAAA example.jp: BBBB =

13. IP Address

14. IP Address • 192.168.0.1ͷΑ͏ʹॻ͖ද͞ΕΔ΋ͷ • ʮΠϯλʔωοτ্ͷॅॴ ʯͳͲͱݴΘΕΔ͜ͱ΋ • 32bit, 2^32

    ≒ 43ԯ ௨Γͷදݱ͕Ͱ͖Δ • ஍ٿਓޱ73ԯਓʹ1ׂͭͮͭΓ౰ͯΒΕͳ͍ͱ͍͏ܽ఺Λ࣋ͭ

15. IP Address͚ͩͰ͸τϥοΩϯάෆ ೳ • ʮΠϯλʔωοτ্ͷॅॴ ʯ= Ͱ͸ͳ͍ • ͱ͍͏ΑΓ •

    ͜ͷͨΊʹૹ৴ݩIP͕෼͔ͬͯ΋ಉҰૹ৴ݩͱ͸ݶΒͳ͍'

16. NAT • NetworkAddressTranslation • Global IPΞυϨεΛԆ໋/અ໿͢Δٕज़ • PrivateIPΛ༻͍ɺ(srcIP,srcPort,dstIP,dstPort,protocolNum)ͷ ૊Έ߹ΘͤͰΞυϨεΛ1ରଟͰϚοϐϯά͢Δ •

    ISP͕ߦ͏৔߹͸CareerGradeNATͱ͔LargeScaleNAT
 ͱݺ͹ΕΔ

17. ͱ͍͏͜ͱ͸… • Global IPͱPrivate IP͕1ରଟͰϚοϐϯά͞Ε͍ͯΔ͔Β
 ಛఆͰ͖ͳ͍ • Global IPͱPrivate IPͷ૊Έ߹Θ͕ͤಘΒΕΕ͹


    ಛఆͰ͖ΔͷͰ͸ • ※2ஈҎ্ͷଟஈNATͷ৔߹͸ಛఆෆೳ

18. XHRํࣜ • JavaScriptͷXHRͰద౰ͳൣғͷશͯͷPrivateIPʹϦΫΤετ Λૹ৴͠ɺฦ͖ͬͯͨ΋ͷͷϨεϙϯελΠϜΛಛ௃ྔͱ͢Δ • ύέοτΛେྔʹૹΔͱ߈ܸʹͳΓ͔Ͷͳ͍ εΩϟϯ͢Δ

19. WebRTCํࣜ • WebRTCͷRTCPeerConnectionͷicecandidateΛར༻͢Δ • WebRTC(P2P)ͷʮNAT௒͑ʯͷͨΊͷٕज़ • Private IP͕औಘͰ͖Δ ௚઀΍ΓऔΓ͢ΔͨΊʹ͓ޓ͍ͷIPΞυϨε
 (Private/Global)


    Λަ׵͢Δ

20. HSTS Super Cookie

21. HSTS Super Cookie • HSTSͱ͍͏ϓϩτίϧΛར༻ͨ͠ख๏ • HSTS: webαʔό͕httpͰΞΫηε͞Εͨ࣌ʹ࣍ճ͔Β
 httpsͰ઀ଓͯ͠΄͍͠ͱ͍͏৘ใΛ෇Ճ͢Δ •

    HSTSΛೝࣝͨ͠ϒϥ΢β͸࣍ճҎ߱httpͰURL͕ೖྗ ͞Εͯ΋࠷ॳ͔ΒhttpsͰΞΫηε͢ΔΑ͏ʹͳΔ

22. HSTS Super Cookie • HSTSΛೝࣝͨ͠ϒϥ΢β͸࣍ճҎ߱httpͰURL͕ೖྗ͞Εͯ΋
 ࠷ॳ͔ΒhttpsͰΞΫηε͢ΔΑ͏ʹͳΔ • httpͰΞΫηεͤͨ͞΋ͷͷhttpsͰ௨৴͕དྷͨ => 1bitͷ৘ใྔ

    • 32ݸͷαϒυϝΠϯΛ༻ҙͯ͠ɺHSTS͕༗ޮ/ແޮΛϥϯμϜʹ
 ੾Γସ͑Δͱ32bitͷ৘ใྔʹͳΓɺ໿43ԯσόΠε͕ࣝผͰ͖Δ

23. HSTS Super Cookie • Super CookieΛ"هԱͤ͞Δ" HSTS ON HSTS OFF

    HSTS ON a.example.com b.example.com c.example.com

24. HSTS Super Cookie • Super CookieΛ"ಡΈग़͢" • HTTPͰΞΫηεͤ͞Δ • HSTS͕༗ޮͳͱ͜Ζ͚ͩHTTPͷͭ΋Γ͕


    HTTPSͰϦΫΤετ͕͘Δ 1 0 1 HTTP HTTPS HTTPS ϢʔβͷID: 011 a.example.com b.example.com c.example.com

25. ࣮ࡍͷڍಈ

26. TCP Timestamp

27. TCP Timestamp

28. RFC1323 • TCP Timestampʹ͍ͭͯنఆ • Timestamp͸1msʙ1ඵִؒͰ૿΍ܾ͢·Γ • OptionalͳϑΟʔϧυ • ߋ৽ִؒ͸໌ࣔ͞Ε͍ͯͳ͍,

    ࣮૷ґଘ

29. TCPͷγʔέϯε൪߸ͱͷҧ͍͸ʁ • TCP Timestamp ≠ TCP Sequence ' • γʔέϯε൪߸͸σʔλͷόΠτຖʹৼΒΕΔ(32bit)

    • ߴ଎ͳωοτϫʔΫͰ͸୹࣌ؒͰΧ΢ϯλ͕1िͯ͠͠·͏ • λΠϜελϯϓ+γʔέϯε൪߸ͰύέοτͷॱংΛอূ͢Δ

30. TCP TimeStampΛτϥοΩϯάʹར༻͢Δ • ͋Δఔ౓(25msʙ10minఔ౓)ஔ͍ͨ2ͭͷTCPύέοτͷ • ౸ண࣌ࠁ(t1, t2) • TCPλΠϜελϯϓ(ts1, ts2)

    • TCPλΠϜελϯϓͷप೾਺ΛٻΊΔ freq = (ts2 - ts0) * 1000 / (t1 - t0)

31. TCP TimeStampΛτϥοΩϯάʹར༻ ͢Δ • TCPλΠϜελϯϓΛप೾਺ͰׂΔ • σόΠεͷuptime(ىಈ࣌ؒ)͕ٻ·Δ • uptime͑͞ٻ·Ε͹IPΞυϨεͱֻ͚߹ΘͤΕ͹୺຤͕
 ਪఆՄೳʹ(ͽͬͨΓಉ࣌ࠁʹىಈ͢Δ୺຤͸͍ͳ͍ͱԾఆ)

    uptime = ts1 / freq

32. uptimeਪఆ͕؆୯ʹࢼͤΔπʔϧ • p0f (http://lcamtuf.coredump.cx/p0f3/) • ىಈͯ͠ΠϯλʔϑΣΠεΛࢦఆ͢Δ͚ͩ .-[ 10.0.3.10/47099 -> 10.0.3.1/22

    (syn) ]- | | client = 10.0.3.10/47099 | os = Linux 3.11 and newer | dist = 0 | params = none | raw_sig = 4:64+0:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 | `---- .-[ 10.0.3.10/47099 -> 10.0.3.1/22 (uptime) ]- | | client = 10.0.3.10/47099 | uptime = 0 days 0 hrs 8 min (modulo 198 days) | raw_freq = 250.04 Hz |

33. ͏·͍͔͘ͳͦ͞͏ͳ఺ • Linuxͷ࣮૷ΛݟͨݶΓɺtimestampͷߋ৽͸CPUͷλΠϚʔׂΓࠐΈ͕ ϕʔεͬΆ͍(jiffies) • ୺຤͕εϦʔϓͯ͠Δؒ͸λΠϜελϯϓͷߋ৽͕ࢭ·Δ…ʁ • Linux v4.10͔ΒTCP Timestamp͕ίωΫγϣϯ͝ͱʹϥϯμϜʹͳͬͨ

    • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ commit/?id=95a22caee396cef0bb2ca8fafdd82966a49367bb

34. SSL Session Ticket

35. SSL Handshake https://blogs.msdn.microsoft.com/kaushal/2013/08/02/ssl-handshake-and-https-bindings-on-iis/

36. SSL Session Ticket https://techblog.yahoo.co.jp/infrastructure/ssl-session-resumption/

37. SSL Session Ticket https://techblog.yahoo.co.jp/infrastructure/ssl-session-resumption/

38. SSL Session TicketΛτϥοΩϯάʹ ࢖͏ ౉ͨ͠νέοτΛ࢖ͬͯ࠶઀ଓͯ͘͠ΔͷͰ
 ಉҰϢʔβͩͱΘ͔Δ

39. IP Address (࠶)

40. IPv6 • ͖͞΄Ͳͷྫ͸IPv4 • IPv4͔ΒҠߦதͷٕज़(ͱݴΘΕ͍ͯΔ) • 2001:240:2401:4f7f:d051:d1bf:544e:cfc0 ͜Μͳײ͡Ͱද͞ΕΔ • 128bit,

    2^128 ≒ 340׾ݸ • ਓྨͷ൅ͷໟ1ຊ1ຊʹΞυϨεΛׂΓ౰ͯͯ΋શ͘৺഑ͳ͍
 εέʔϥϏϦςΟ(ͱݴΘΕ͍ͯΔ)

41. IPv6͸NAT͠ͳ͍ͷ͔ʁ • NAT͸ෆཁ (NAT as a Firewallͷ࣌୅΋ऴΘΔ…ʁ) • → 1IP

    = ͷ࣌୅͕͖͍ͯΔ • සൟʹม͑Δͱ௨৴͕੒ཱ͠ͳ͘ͳΔ • !୹໋ͳIDͱͯ͠ػೳ͠͏Δ

42. IPv6ͷσϓϩΠঢ়گ • Appleͷ৹ࠪͰIPv6ରԠ͕ඞਢʹ • ೔ຊͷܞଳΩϟϦΞ͸IPv6σϓϩΠʹফۃతͩͬͨ • ૯຿লౖ͕ͬͯ2017೥౓தͷ
 ಋೖΛཁ੥ • ࠓͰ͸ΘΓͱ


    ීٴ͖͍ͯͯ͠Δ͸ͣ

43. ·ͱΊ • ༷ʑͳσόΠεͷτϥοΩϯάख๏Λௐࠪ͠·ͨ͠ • ཁૉٕज़ͷ໨త͔Β͢ΔͱҙਤͤͣτϥοΩϯάͰ͖ ͯ͠·͏΋ͷʹؔͯ͠͸ηΩϡϦςΟ্ͷཧ༝͔Βम ਖ਼͕Ճ͑ΒΕ͍ͯΔ΋ͷ΋͋Δ