Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting

Abstract

With users becoming increasingly privacy-aware and browser vendors incorporating anti-tracking mechanisms, browser fingerprinting has garnered significant attention. Accordingly, prior work has proposed techniques for identifying browser extensions and using them as part of a device's fingerprint. While previous studies have demonstrated how extensions can be detected through their web accessible resources, there exists a significant gap regarding techniques that indirectly detect extensions through behavioral artifacts. In fact, no prior study has demonstrated that this can be done in an automated fashion. In this paper, we bridge this gap by presenting the first fully automated creation and detection of behavior-based extension fingerprints. We also introduce two novel fingerprinting techniques that monitor extensions' communication patterns, namely outgoing HTTP requests and intra-browser message exchanges. These techniques comprise the core of Carnus, a modular system for the static and dynamic analysis of extensions, which we use to create the largest set of extension fingerprints to date. We leverage our dataset of 29,428 detectable extensions to conduct a comprehensive investigation of extension fingerprinting in realistic settings and demonstrate the practicality of our attack. Our in-depth analysis confirms the robustness of our techniques, as 83.6%-87.92% of our behavior-based fingerprints remain effective against a state-of-the-art countermeasure.

Tales of Favicons and Caches: Persistent Tracking in Modern Browsers

“…On the other hand, using a randomized value will result in the website calculating different identifiers across visits. As such, websites can leverage extension-fingerprinting techniques [71], [44], [77], [74] to infer the presence of these extensions and ignore the affected attributes when generating the F P ID . For Brave, websites simply need to check the User-agent header.…”

Awakening the Web's Sleeper Agents: Misusing Service Workers for Privacy Leakage

“…Tian et al [51] demonstrated how the HTML5 screen-sharing API could be used for various attacks; the proposed history sniffing attack requires the target URLs to actually be rendered on the user's screen, presenting an obstacle for the practicality of the attack and limiting the number of target URLs that can be tested. Karami et al [25] showed how the Performance API can be used to detect what browser extensions a user has installed.…”

Privacy Model: Detect Privacy Leakage for Chinese Browser Extensions

“…Starov et al [34] presented XHOUND to investigate and quantify the finger-printability of Chrome extensions through DOM-based modifications. Soroush et al [20] extended the approach by automatic generating behavioral fingerprints. Alexander et al [32] studied a class of extension revelation attacks, where extensions reveal themselves by injecting their code on web pages, and invalidated the randomized ID of Firefox, and the attacker can use the random ID as a reliable fingerprint of the users.…”