Deanonymization and Uniqueization

[DronVR]

Deanonymization and Uniqueization

Deanonymization - the process of establishing the identity of the user on the network or the true place of access to the network.

The concept of deanonymization is inseparable from the concept of anonymity. Anonymity - This is an opportunity to visit sites, to perform any active actions on web resources, for example, to leave messages, without the ability to connect your actions with your real identity or your place of access to the network. Many equate anonymity with hiding a genuine IP address, but this is a very simplified approach. Firstly, an attacker could conduct a JavaScript attack and, using vulnerabilities in a web browser, gain access to your device. Then, having gained control of the device, try to determine the owner based on an analysis of the sites visited, the real IP address, documents and information in instant messengers. Secondly , through the site you can check whether you have accounts on social networks where you are authorized. If you are logged in to Facebook and your real data is indicated there, the site owner will be able to get them unnoticed by you.

Identification of a user or access point to a network by IP address or mac address is called passive deanonymization when no attacks are applied against the user. Attacks on the user, for example through a site with malicious JavaScript, or phishing - this active deanonymization . It is important to understand that there is no direct connection between the IP address and any user. The IP address belongs to the network exit point. For example, if you connect to a Wi-Fi router, then you get the IP address of this router. All other users connecting to this router will receive the same IP address. Checking the IP address can only indicate the Internet provider and the general location, after scanning, you can determine the model of the router. The Internet connection provider that connected the Internet cable to this router knows who it is designed for and where it is located, upon request from the competent authorities, it is obliged to give out this information. There is still the opportunity to analyze the logs of the provider, the logs of the router. An attacker can hack a Wi-Fi router and then begin to intercept traffic in order to find clues in it to establish an identity, for example, social network accounts, or try to infect a computer through DNS spoofing or packet splicing. All this is active deanonymization, about which we will talk a lot more. By the way, hiding an IP address is important not only for anonymity, but also for security. As mentioned above, by scanning your IP address, an attacker can hack your router or modem if you exit via Wi-Fi or a 3G / 4G modem, or directly to a computer if it is connected directly to an Internet cable. Stories like this happen too often to ignore this threat.

Uniqueization - search and collection of unique browser identifiers to create a unique fingerprint, by which you can always recognize this browser regardless of the IP address and user data provided. Uniqueization, as a rule, does not carry the task of establishing the identity of the user, and just recognize him in any situation . Website users are unique due to unique browser fingerprints, such as Canvas fingerprint, WebGL fingerprint, Front fingerprint, etc., as well as through the use of cookies. To create unique prints, you only need to visit the website once. Even if the next time you visit the site from a different IP address, provide other authorization data, the site will still recognize you, and if the site is connected to some anti-fraud or marketing system that collects user fingerprints, then other participating sites of this systems will be able to get information about you. HWID - a unique imprint of "iron", uniqueizes the user's device. It can only be obtained by installing on your computer a program that collects data for uniqueization. The device is unique due to the presence of unique serial numbers on the components of your computer. The serial number of the motherboard, the serial number of the hard drive are set by the manufacturer, and changing them is not an easy task. Unique serial numbers are even on the monitor and keyboard. Even if you delete the program, reinstall the system and reinstall the program, it will recognize you by the same HWID generated on the basis of the unique serial numbers of the hardware of your computer. HWIDs and various hardware identifiers are mainly used for licensing software and antifraud application systems. User browser uniqueization is mainly used to combat fraud, but can be used to track and even deanonymize. For example, you went to a site where you left your data, even if it is an online store. This store has installed an antifraud system designed to protect against scammers. Antifraud the system received a unique fingerprint of your browser and the data about you specified when ordering. Having received this information, she can recognize you on any site that you have opened and where her scripts are located, whether you want it or not.

Source

 

[Матушкин Андрей Николаевич]