Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Webデバイストラッキング手法の紹介

Kurochan
January 20, 2019

 Webデバイストラッキング手法の紹介

Kurochan

January 20, 2019
Tweet

More Decks by Kurochan

Other Decks in Technology

Transcript

  1. σόΠετϥοΩϯάٕज़6બʂ • Cookie • IP Address • HSTS Super Cookie

    • TCP Timestamp • SSL Session Ticket • IP Address (࠶)
  2. Cookie • Web։ൃ͍ͯ͠ΔਓͳΒ͖ͬͱ஌͍ͬͯΔ͸ͣ# • Same Origin Policy͕͋Δ • ྫ: example.com

    ͷCookie͸example.jpͷαʔό͔Β͸ݟΒΕͳ͍ • Cookie SyncΛ͢Δ͜ͱͰτϥοΩϯάͰ͖Δൣғ͕ͻΖ͕Δ • Apple͸ITPͱ͍͏΋ͷΛಋೖ͠CookieʹΑΔτϥοΩϯάʹ
 ੍ݶΛ͔͚͍ͯΔ • εϚϗͩͱIDFA/AdIDͱ͍͏΋ͷ΋͋Δ
  3. • ޿ࠂͷDSPͱSSPͷؒͳͲͰΑ͘ߦΘΕΔॲཧ Cookie Sync example.com: AAAA example.jp: BBBB example.com: AAAA

    redirect example.jp, param: =AAAA example.jp: BBBB, param: AAAA example.com: AAAA example.jp: BBBB =
  4. IP Address • 192.168.0.1ͷΑ͏ʹॻ͖ද͞ΕΔ΋ͷ • ʮΠϯλʔωοτ্ͷॅॴ ʯͳͲͱݴΘΕΔ͜ͱ΋ • 32bit, 2^32

    ≒ 43ԯ ௨Γͷදݱ͕Ͱ͖Δ • ஍ٿਓޱ73ԯਓʹ1ׂͭͮͭΓ౰ͯΒΕͳ͍ͱ͍͏ܽ఺Λ࣋ͭ
  5. HSTS Super Cookie • HSTSΛೝࣝͨ͠ϒϥ΢β͸࣍ճҎ߱httpͰURL͕ೖྗ͞Εͯ΋
 ࠷ॳ͔ΒhttpsͰΞΫηε͢ΔΑ͏ʹͳΔ • httpͰΞΫηεͤͨ͞΋ͷͷhttpsͰ௨৴͕དྷͨ => 1bitͷ৘ใྔ

    • 32ݸͷαϒυϝΠϯΛ༻ҙͯ͠ɺHSTS͕༗ޮ/ແޮΛϥϯμϜʹ
 ੾Γସ͑Δͱ32bitͷ৘ใྔʹͳΓɺ໿43ԯσόΠε͕ࣝผͰ͖Δ
  6. HSTS Super Cookie • Super CookieΛ"هԱͤ͞Δ" HSTS ON HSTS OFF

    HSTS ON a.example.com b.example.com c.example.com
  7. HSTS Super Cookie • Super CookieΛ"ಡΈग़͢" • HTTPͰΞΫηεͤ͞Δ • HSTS͕༗ޮͳͱ͜Ζ͚ͩHTTPͷͭ΋Γ͕


    HTTPSͰϦΫΤετ͕͘Δ 1 0 1 HTTP HTTPS HTTPS ϢʔβͷID: 011 a.example.com b.example.com c.example.com
  8. TCPͷγʔέϯε൪߸ͱͷҧ͍͸ʁ • TCP Timestamp ≠ TCP Sequence ' • γʔέϯε൪߸͸σʔλͷόΠτຖʹৼΒΕΔ(32bit)

    • ߴ଎ͳωοτϫʔΫͰ͸୹࣌ؒͰΧ΢ϯλ͕1िͯ͠͠·͏ • λΠϜελϯϓ+γʔέϯε൪߸ͰύέοτͷॱংΛอূ͢Δ
  9. uptimeਪఆ͕؆୯ʹࢼͤΔπʔϧ • p0f (http://lcamtuf.coredump.cx/p0f3/) • ىಈͯ͠ΠϯλʔϑΣΠεΛࢦఆ͢Δ͚ͩ .-[ 10.0.3.10/47099 -> 10.0.3.1/22

    (syn) ]- | | client = 10.0.3.10/47099 | os = Linux 3.11 and newer | dist = 0 | params = none | raw_sig = 4:64+0:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 | `---- .-[ 10.0.3.10/47099 -> 10.0.3.1/22 (uptime) ]- | | client = 10.0.3.10/47099 | uptime = 0 days 0 hrs 8 min (modulo 198 days) | raw_freq = 250.04 Hz |
  10. IPv6 • ͖͞΄Ͳͷྫ͸IPv4 • IPv4͔ΒҠߦதͷٕज़(ͱݴΘΕ͍ͯΔ) • 2001:240:2401:4f7f:d051:d1bf:544e:cfc0 ͜Μͳײ͡Ͱද͞ΕΔ • 128bit,

    2^128 ≒ 340׾ݸ • ਓྨͷ൅ͷໟ1ຊ1ຊʹΞυϨεΛׂΓ౰ͯͯ΋શ͘৺഑ͳ͍
 εέʔϥϏϦςΟ(ͱݴΘΕ͍ͯΔ)
  11. IPv6͸NAT͠ͳ͍ͷ͔ʁ • NAT͸ෆཁ (NAT as a Firewallͷ࣌୅΋ऴΘΔ…ʁ) • → 1IP

    = ͷ࣌୅͕͖͍ͯΔ • සൟʹม͑Δͱ௨৴͕੒ཱ͠ͳ͘ͳΔ • !୹໋ͳIDͱͯ͠ػೳ͠͏Δ