[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #14560 [Tor Browser]: Tor Browser: Font probing vulnerability using dynamically generated iframes
#14560: Tor Browser: Font probing vulnerability using dynamically generated iframes
-------------------------------+----------------------------------
Reporter: Peter_Baumann_TUD | Owner: tbb-team
Type: defect | Status: new
Priority: normal | Milestone:
Component: Tor Browser | Version: Tor: unspecified
Keywords: Fingerprinting | Actual Points:
Parent ID: | Points:
-------------------------------+----------------------------------
Hello,
I'm a computer science student at TU Darmstadt, Germany, and as a part of
my Master Thesis about the development of browser fingerprinting
countermeasures I examined the anti-fingerprinting capabilities of Tor
Browser. As a result of this examination I found a flaw in the protection
against font probing that can be used to probe for an inexhaustible amount
of fonts. I developed a small JavaScript application that can test for
more than 600 fonts in less than a second (see attached). This
vulnerability poses a risk to a user's privacy, as it can potentially be
used to track users over the course of several browser sessions and among
various websites.
'''Description:'''
Tor browser limits the total number of fonts that can be used in a
document. By default, a document can use 10 fonts. So if a fingerprinter
tries to probe for more than 10 fonts, he only gets reported that these
fonts are missing.
However, this design has a flaw, as it didn't consider that iframes also
have their own document body. Therefore, in order to circumvent this
limitation, a fingerprinting script might dynamically generate an iframe
for each package of 10 fonts, probe for their existence, until all fonts
have been probed for.
'''Note: '''The maximum number of possible fonts can be changed by the
user. The fingerprinting script could easily probe for this threshold, as
I found out that an already loaded font can't be loaded again, once this
limit is reached.
'''The script:'''
I implemented a small script based on this observation. It creates iframes
and probes for 10 fonts, using HTML 5 canvas element and the function
measureText() provided by JavaScript. I assume that this approach also
works with the classical implementation using CSS + JS, but I leave the
experiments to some one else.
For the script and a screenshot see the appended files.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/14560>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs