Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Background (not necessary to read; just what makes me ask):

Say someone's computer has either been hacked, or is running software run by $LARGE_EVIL_CORPORATION, and the hacker/$L wants to collect as much information as possible about the person whose hardware they've owned.

Now assume the hacker/$L also has software running on another of the person's machines. On one machine, the user does personal things (e.g. finances), and on the other machine they don't (i.e. they try to remain relatively anonymous).

But, since they're the same person, they tend to use the same mouse on both machines. And the same external HD. And the same webcam... etc., ad absurdum.

How many/which of those devices would have unique device identifiers such that the external observer could link the two identities?

Even if they had no internal drive, and only booted from live CD, would it be possible/likely that the motherboard chipset, RAM, screen, or CD drive itself could provide unique identification (assuming root privs, or their O/S's equivalent)?

Additionally...

What devices would allow a unique identifier to be set (other than mass storage; those obviously have state)? Is it possible I have a webcam which, unbeknownst to me, has some flash memory that an O/S could use to assign it a personal identifier?

share|improve this question
    
Just a question, but how did the virus come on to the live cd again? –  Lucas Kauffman Apr 3 '13 at 19:10
    
Not necessarily a virus. Say it's a company whose software has been bundled with a distro, and it phones home about whatever it damn well pleases because it can and no one's complained. And sales thought it could be helpful for demographics reasons. –  root Apr 3 '13 at 19:14
    
The spiel being "We just want to know more about who uses our product so we can improve the end-user experience, but we want to be able to personally identify users so we don't double-count in our analyses and throw off our estimates". –  root Apr 3 '13 at 19:17
    
Take the WLAN MAC if the user has WLAN or his unprotected router has. Stuff it into Google Maps, receive location data. –  thejh Apr 3 '13 at 20:12
add comment

1 Answer

up vote 2 down vote accepted

Well hardware fingerprinting is done by many rootkits, for instance it's a tool used by the famous cheat-prevention system "Punkbuster" so that even if you buy a new key for the game and even reinstal your system, you remain banned.

They collect different data from your machine of which some might be relatively unique, like:

  • MAC-address
  • Motherboard serial number
  • device GUIDs

Some of these might be unique, other's wont. Now the idea is that you collect this data and you save it somewhere remotely and assign an id to it. Let's say computer A. Now next time the machine boots some of the ids might have changed, like the MAC address, because the user was spoofing it.

Now you collect the same data again and call this computer B. Now you do this several times and you can also keep track of when the machines were online.

From here you can do a basic filter, if two machines were up at the same time, they probably are two different machines. (first decision node)

Every piece of hardware can be awarded a certain score for reliability (more reliable to stay the same (CPUID (which is disabled these days) or your motherboard serial number), less reliable to stay the same (MAC addresses). Then you can make a scoring system an attach it to a probability.

This probability can then give you a percentage of chance the systems A and B are the same. It's actually just some basic datamining.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.