Browser-based CPU Fingerprinting
In brief
Browser sandboxes hide many details about the underlying CPU, but timing benchmarks can recover them indirectly. This paper evaluates eight browser-based benchmarks across 834 participants and shows how they reveal CPU properties and models.
Abstract
Mounting microarchitectural attacks, such as Spectre or Rowhammer, is possible from browsers. However, to be realistically exploitable, they require precise knowledge about microarchitectural properties. While a native attacker can easily query many of these properties, the sandboxed environment in browsers prevents this. In this paper, we present eight side-channel-related benchmarks that reveal CPU properties, such as cache sizes or cache associativities. Our benchmarks are implemented in JavaScript and run in unmodified browsers on multiple platforms. Based on a study with 834 participants using 297 different CPU models, we show that we can infer microarchitectural properties with an accuracy of up to 100%. Combining multiple properties also allows identifying the CPU vendor with an accuracy of 97.5%, and the microarchitecture and CPU model each with an accuracy of above 60%. The benchmarks are unaffected by current side-channel and browser fingerprinting mitigations, and can thus be used for more targeted attacks and to increase the entropy in browser fingerprinting.
Talks and coverage
- Browser-based CPU Fingerprinting ↗ Black Hat MEA 2022 · talk
Citation
@inproceedings{trampert2022uarchfp,
title = {Browser-based CPU Fingerprinting},
author = {Leon Trampert and Christian Rossow and Michael Schwarz},
booktitle = {27th European Symposium on Research in Computer Security},
year = {2022},
address = {Copenhagen, Denmark}
}