CPU fingerprinting (cat proc/cpuinfo & cpuid)

procShield · February 23, 2023, 2:10am

      -> Eliminating ever deeper "cookies" -> identifying marks ->

Any media with JavaScript can potentially fingerprint the CPU of a device and nothing works with LibreJS although it is a good concept. Java is a significant privacy risk. Apparently, hardware information can even be obtained past virtualizers. Is anyone working on developing obfuscation for physical, fabrication process specific frequency identifiers of CPU and other hardware? Benchmarking resistance? Can anyone explain how there are indelible, immutable characteristics of hardware that can be identified through connection since encryption should be able to mask any specific characteristic. CPU to software connections are not like electromagnetic spectrum analysis that cannot be changed only shielded unlike code structure.

see:

crkorg · February 23, 2023, 2:30am

Is this something that is being done already on popular websites or with certain programs?

If I run something closed-source, like a Windows Standalone VM, is it getting my processor serial number (and sending it to Microsoft, since Windows sends stuff like that to Microsoft)?

If I am on a website using sophisticated fingerprinting, like Google or Facebook, are they able to get hardware identifiers when I am on the website using javascript?

If I run a closed source program in an App VM, if it is trying to do CPU fingerprinting, is it able to do that?

renehoj · February 23, 2023, 7:18am

Doesn’t the page you linked say the oppersite

A) Remote CPUID: Even if the user has JavaScript enabled in their browser, websites cannot remotely detect the user’s CPU model and capabilities.

crkorg · February 23, 2023, 1:25pm

I saw that too. I read the links as saying any program that is run, including within a virtualized environment, can access the CPU ID.

If this is true, it means any virtualized Windows is going to be getting the CPU ID of the system (most likely) and sending it to Microsoft, since they collect a large amount of such information via telemetry.

I almost never run closed source software, but I have occasionally run closed source software in a virtualized environment and then deleted the virtualized environment after. According to this, those closed source programs could be getting my CPU ID, sending it somewhere, and then even if I delete the program the CPU ID can be used to continue to track me.

Also, the links didn’t really address whether highly sophisticated technology companies that track people as their business model have properietary javascript technology that is fingerprinting the CPU. Most fingerprinting techniques involve canvas fingerprinting, audio context fingerprinting, domRects fingerprinting, WebGL fingerprinting, and font fingerprinting, and then combines that with characteristics of a web browser to identify a particular user. If you distort those fingerprinting metrics slightly, and don’t have unique browser characteristics, it becomes harder to fingerprint your browser. However I am not sure whether the larger companies like Google and Facebook have moved on to some sort of proprietary fingerprinting technology that they aren’t sharing. If Google or Facebook had a proprietary fingerprinting technology that utilized javascript, would that javascript be something that could be inspected when loading a page? Would developers and programmers be able to see it, or is there a way they could keep it proprietary? There are other theoretical ways of fingerprinting people involving different types of calculations that I believe cannot be modified, and I think it involves hashes related to RAM or other calculations and the hash in unique and consistent ways. I am not sure if big tech has deployed those methods and if developers and programmers would be able to see it when visiting websites.

If javascript is running on a website, is the javascript code something that is open and can be read, or is it in some way compiled and closed where a website reader doesn’t know what it is doing?

crkorg · February 23, 2023, 1:25pm

replied to your post, even if @procShield is stating something slightly incorrectly, the post still brings up some really valid and interesting concerns.

Also, if a website were to try to do a unique fingerprint of a user using a RAM hash, would that RAM hash hold as consistent in a disposable Qubes AppVM in which the total allocated RAM could vary but is always less than the total RAM?

edit: I am not being able to make more posts until 7 hours has elapsed. @renehoj you are probably right. I think I was using the term “CPU ID” as my way of saying unique CPU identifier (like a CPU serial number), but that might not be a risk at all. Even if that can’t be determined, I have seen some new hardware based fingerprinting on GIT that can’t really be spoofed yet, but I am not sure whether big technology is deploying that because it seems like probably 95 percent of users don’t understand canvas fingerprinting, and of the 5 percent that do, probably almost all 5 percent is only blocking canvas fingerprinting and not any of the other fingerprinting types. I think the amount of users who alter metrics to try to block most of the standard fingerprinting methods is probably less than 1/10,000 and it’s so small that it doesn’t affect their profit enough to deploy new methods.

renehoj · February 23, 2023, 1:42pm

Doesn’t all CPUs from that same production batch have exactly the same CPU ID?

adw · February 23, 2023, 2:43pm

Related issue (see comments):

github.com/QubesOS/qubes-issues

Stop telling VMs the exact physical CPU model in the computer

opened 12:21AM - 21 Aug 15 UTC

closed 11:45PM - 17 Oct 18 UTC

qubesuser

T: enhancement C: core C: Xen privacy R: won't do

Currently Qubes lets VMs execute CPUID and get the exact model and microcode rev…ision of the physical CPU installed in the system. This is bad for anonymity and unexpected. Already discussed in https://groups.google.com/forum/#!msg/qubes-devel/Q8h-RGH5YoA/fzWbi7c-kfoJ but there seems to be no open issue, and it's a critical issue at least for anonymous VMs. Possible solutions: 1. Run all VMs in Xen PVHVM mode, fix libvirt so that it allows to set the CPUID for Xen and do so 2. Run all VMs in Xen PVH mode, fix Xen so that CPUID hiding works in PVH mode and fix libvirt as well to support PVH and allow to set CPUID 3. Replace Xen with KVM and then it just works with no additional effort The CPUID chosen should be the default libvirt one for the physical CPU microarchitecture (i.e. one for Skylake, one for Haswell, one for Sandy Bridge, etc.) which allows using all CPU instruction set extensions while not giving any more information and should be changeable to a less featureful one (Core 2 or Athlon 64) for increased anonymity if desired. Ideally Qubes should wait until a few months have passed from the release of a new CPU architecture before it starts advertising it by default, to ensure that the anonymity set is big enough, and it should also wait a random amount of time before changing it on upgrades, to avoid leaking the exact time the user installed the new CPU or changed computers. It would also be nice to look at whether it's possible to prevent applications indirectly detecting the size of the cache, size of TLBs, the speed of the CPU and other characteristics, although it may not be practical to avoid those.

procShield · February 25, 2023, 2:40pm

I don’t know what precisely is going on, but I have observed machine behavior.

Java constantly gets interfered with even if I am using tor. I’m not sure how this happens, but I know it is highly repeatable and persistent.

I have noticed CPU “bursts” with multimedia. Google through invidious .onions. That processing reaction must be fairly specific, although maybe only so far as the CPU series.

If I understand correctly, the CPU frequencies, however, are slightly unique due to variations in the fabrication process. I know Mozilla can get proc/cpuinfo and can lifetime ban someone without any due process, but if you virtualize or essentially alter your system, then Mozilla corp functions suddenly work again. So they must get individual IDs connected to hardware properties somehow.

BEBF738VD · February 25, 2023, 2:43pm

Hide hardware info: Hardware information masking and spoofing with hypervisor - #5 by BEBF738VD

renehoj · February 25, 2023, 2:48pm

Does that make any difference?

The appVM doesn’t have access to any hardware, except for the CPU, and even with kicksecure there is no way you can hide CPUID.

BEBF738VD · February 25, 2023, 2:50pm

https://www.deviceinfo.me/

CPU:
Architecture:
Unknown. Detection blocked by browser setting(s)/extension(s) or not supported.
Number of cores:
2

procShield · February 25, 2023, 3:03pm

what do you think of this:
https://cpuid.apps.poly.nomial.co.uk/

I got a lot of specifics using tor browser with standard safety.

renehoj · February 25, 2023, 3:12pm

You need to post the CPUID info in the textbox, and it will parse it for you, it can’t read the CPUID from your system.

procShield · February 25, 2023, 3:24pm

I got the same result from deviceinfo. I have to study the question some more before answering. poly.nomial is not a detector, just a sample. There may be a way for Java Servers to get remote CPU info from what I’m reading, but I’ll have to look into this further. Thanks.

BEBF738VD · February 25, 2023, 3:26pm

No worries. Keep in mind that for best protection you may want to disable javascript entirely.

procShield · February 25, 2023, 3:28pm

http://forums.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/t/remote-detection-of-cpu-capabilities-cpuid-by-any-web-server-using-javascript-js/14261/8

what do you think?

renehoj · February 25, 2023, 3:36pm

It says the same thing, you can’t use JavaScript to read CPUID:

I am now certain that CPUID cannot be detected from within a browser using JavaScript.

procShield · February 25, 2023, 3:51pm

Then how do you think Mozilla Corp and Ubuntu Canonical Corp can identify a new computer and new software that I have not logged into any social media or email from? My identity should be unknown to them but somehow they have deep targeting capabilities I think must be connected to hardware specs. Ideas?

renehoj · February 25, 2023, 4:06pm

All software running in the appVM can read the CPUID, but that doesn’t mean that you can read it with JavaScript.

I doubt anyone is using CPUID for fingerprinting, it’s probably one of the weakest hardware identifiers in most systems. My laptop is the Lenovo T480 with the 8650U, the model number of the laptop is many times more unique than the CPU model, and the MAC address is 100% unique.

CPUID can be used to “break out” of the appVM and fingerprint the actual hardware, but knowning person X is using a CPU with a production run in the high millions isn’t really going to compromise your anonymity.

tripleh · February 25, 2023, 5:33pm

Nowadays some ISPs just sell your identity or a pseudonymized marketing ID of your identity to advertisers. It all happens in the backend based on your IP & port.
Obviously VPN & Tor etc. help.