3

For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. Companies can create a fingerprint about a user. The Flash plugin serves much information, like:

  • installed fonts,
  • IP-address (original one behind a proxy) or
  • the used OS and kernel system / version

So my question is:
Is it possible to fake such information and how?

When I use for example Firefox, does Firefox serve these system information for the Flash plugin and then I can fake them with a Firefox addon which registers the call event of the Flash extension and returns wrong data? Or has the Flash plugin direct access to the operating system? If yes, can I build software which runs in the OS background and registers the Flash plugin call and then serves faked information?
I know that NPAPI is the interface between the browser and the OS, but I have no idea if it is possible to manipulate the called information in any way and if such information (like installed fonts) are parameters stored in the browser or served by the OS.

[Update]

Example:

Original data: Windows 8.1, Firefox 24, English language, 23 fonts installed

  1. Step: i call a random website with flash fingerprinting tool
  2. Step: the tracking tool starts to collect my fingerprint with flash, calls action script functions to get installed fonts etc.
  3. Step: through the action script functions, the Flash plugin tries to get the information from Firefox or OS (NPAPI)
  4. Step: Before the flash plugin calls the data from Firefox or OS, my own developed firefox addon, which is installed, detetct and catch the event, prevent the system call and returns instead of the original data, spoofed data (OSX, Firefox 24, English language, 12 fonts installed) from my firefox addon

Result data for Flash plugin: OSX, Firefox 24, English language, 12 fonts installed

At 4. step i want to spoof system parameter. And the question is, if this is possible in general (with a Firefox extension or a OS native application) and how. And: from where does the Flash plugin get the system information? From Firefox parameter? Through the NPAPI interface from the system?

I know, that there are other fingerprinting opportunities (JavaScript, User Agent, CSS with Cache, Flash Cookies, HTTP-Cookies, etc.), but the focus of this question are the system parameters (installed fonts list, OS, etc) of the Firefox Flash extension.

2

Is it possible to fake such information and how?

You want to fake such information in order to evade browser fingerprinting done by some websites but you have to know that the simplest fingerprinting algorithm deployed today is able to detect, follow and even guess a fingerprint's changes. Also, you have no idea about the fingerprinting algorithm you want to foil.

An other problem fired by your question is how to fake such information. Well, there is no solution that fits for all the cases. I mean depending on the information you want to fake different solutions and tools may exist or not. For example, I can mention you the Firfox User Agent Switcher which is an addon that performs what its name says.

When I use for example Firefox, does Firefox serve these system information for the Flash plugin and then I can fake them with a Firefox addon which registers the call event of the Flash extension and returns wrong data? Or has the Flash plugin direct access to the operating system? If yes, can I build software which runs in the OS background and registers the Flash plugin call and then serves faked information?

From the way you worded these question, I feel there are important things you need to know first in order to avoid some erroneous (if I may say so) questions you made:

  1. Can I get hardware and operating system information with Flash?

    You need to look to the Capabilities class and see what information it can get from your operating system and hardware. For instance, the cpuArchitecture property specifies the current CPU architecture. The cpuArchitecture property can return the following strings: "PowerPC", "x86", "SPARC", and "ARM". The server string is ARCH. while the os property specifies the current operating system.

Note: This paragraph does respond to the question whether such data may be sent using a Flash web application over Internet or not. That will be discussed later on.

  1. What is a Flash web application?

    A Flash web application is any SWF/FLV content that can vary from a video you want to view on your browser to a full fledged and complex application where Flash plays a very important role such as in sharedtalk.com

  2. What are local shared objects?

    The problem with running Flash web application (apart from the Flash vulnerabilities that you are not addressing here) resides in what we call local shared objects (LSOs) better known as Flash cookies. Flash cookies are relatively unknown (Schneier on Security: Flash Cookies).

    While an HTTP stores only around 4KB of data, a Flash cookie contains up to 100KB data (ActionScript3.0 Cookbook). You can even enhance the storage capacity of a Flash cookie at your will. A Flash cookie is not stored in a file within the browser space but in a separate Adobe file with a .sol file extension: this means the browser has no control over Flash cookies and when you clear your browser's cookies, Flash cookies are still there on your computer (but there are tools to delete them).

  3. Which content may be stored within a Flash cookie?

    For HTTP cookies where contents are determined by the specific website that created that cookie. Contents vary from site to site. This applies for Flash cookies.

    The Flash cookie is used generally to save user's settings (for example when you watch a video on Youtube and change the dimensions of the video screen: the dimensions are stored in the Flash cookie).

  4. What are the main privacy issues inherent to LSOs?

    Flash cookies contain the information that may be hold in an HTTP cookie and much more except the field related to expiration date: Flash cookies do not have an expiration date by default as it is the case with HTTP cookies (where the common practice of companies' websites set it usually set to 30 days); and one of the reasons for this is because when companies tracking users noticed that lot of users clear their cookies at least once per month lead to overestimate the number of true unique visitors to websites, and thus to the overpayment for advertising companies (The Impact of Cookie Deletion on the Accuracy of Site- Server and Ad-Server Metric s: An Empirical Comscore Study).

    But what is worse, is that a Flash cookie may recreate HTTP cookies you previously deleted (respawning cookie, persistent identification element)

    Note that the less aggressibe LSO contains the globally unique identifier that identifies your computer for the web application that tracks you.

  5. What is Flash hardware acceleration and why to mention it?

    Hardware acceleration is when you have hardware designed to accelerate a specific function. So, for example, when you decode or encode video you do it on the CPU. Some video cards allow you to do this on their GPU instead, so you now have "hardware accelerated video decoding". (What does “hardware acceleration” refer to?). Flash hardware acceleration is a hardware acceleration for Flash (Performance or display issues with certain Flash videos). In most browsers this feature is disabled by default, but activating it to better visualize a given web Flash application exposes you to reveal more information about your hardware. But why to mention this? Because such information is stored in LSOs.

  6. So may my OS and hardware information be leaked out?

    I prefer to quote you this directly from the official documentation (Flash player help)

    Note that it is the person or company that has created the application you are using that is requesting such access, not Adobe (unless Adobe has created the application that wants to save the information). It is the responsibility of the person or company requesting access to make it clear to you why they want access and how they plan to use the information they save. You should be aware of the privacy policy of anyone who is requesting access to your computer. For example, see the Adobe privacy policy. Contact the website requesting access for information on their privacy policy.

    Also, one important thing to read from that documentation:

    (Flash Player 8 and later) If you have downloaded SWF or FLV content to your computer, a dialog box might appear alerting you that the content is trying to communicate with the Internet. Flash Player 8 and later versions do not allow the local SWF or FLV content to communicate with the Internet, by default.

    And since it is possible to retrieve both OS and hardware information using the Capibilities class described in the first point, and a Flash web application may require, under your permission as you can read from the same last link, more than 100KB, and if the web application is nefarious the definite answer to your question is that it is likely, I mean possible, to happen especially with a misinformed user about security issues.

Given these information, you may achieve what you asked (surely no one will tell you how) after digging deeper. But remember: if you want to do that in the purpose of evading brwoser fingerprinting then better forget the idea and use traditional methods.

  • Thank you for your detailed response. You correctly mentioned the FF UA Switcher. If you switch your UA, fingerprinting companies also collect redundant information, for example with the Flash plugin. The point is, if you spoof your agent, the fingerprinting tool get different data (spoofed one, correct one in Flash). They compare them and now have a unique fingerprint, because u are one of the rare people who serve inconsistet data. So, there are FF extensions available, which serve spoofed information for JS or HTTP and to delete LSOs but nothing for spoofing Flash? Thats what i want to do. – Zeussi Oct 13 '15 at 12:28
  • Yes, there are others, depending on which info you want to change (look here for example) but products recommendations are off-topic questions on this website. You can ask for tools on softwarerecs.stackexchange.com instead @Zeussi – user45139 Oct 13 '15 at 12:33
  • Well, sorry for my ambiguous phraseology. I don't want a tool recommondation. I want to develope a new Firefox addon, which spoofs the UA, JavaScript, etc. and - now the asked part - the input for some relevant parameters to the Flash browser extension. I have e.g. a Windows 8.1 OS with 300 installed fonts, now i want to change for Firefox the UA, JS parameters (navigator, screen objects) and the Flash extension parameters to OSX with 12 installed fonts. And my question is, if it is possible to spoof the Flash extension parameter for installed fonts, used OS, etc. and how i can do this. – Zeussi Oct 13 '15 at 12:51
  • 1
    @Zeussi Random Agent Spoofer. – Freedo Oct 20 '15 at 7:47
  • @Freedo Random Agent Spoofer just spoofs the User Agent and not the data from the flash plugin. You can test it this way: check in options "Use document fonts" on / off and go to Panopticlick (panopticlick.eff.org). The parameter "System Fonts" (via Flash) would be the same. So it spoofs not the flash values, and thats what i want to do - and seems to be impossible. – Zeussi Oct 23 '15 at 16:31
1

Edit flash with Privacy Manager from Ivan Iovation. I am the owner.

You can set Flash to read your custom data.

Flash Version
Operating System
Manufacturer
Language
Player Type
Pixel Aspect Ratio
Flash Architecture
Screen Resolution 
Screen Color
Screen DPI
Max Level IDC
System 32 Bit
System 64 Bit

PLUGIN Name
PLUGIN Version
PLUGIN FileName
PLUGIN Description
MIME Type 
MIME Suffixes
MIME Description

www.ivanovation.ro/manager

View Flash Privacy Manager

  • While this product does technically address the question, it looks a little like an ad. Are you in any way affiliated with this product? – schroeder Feb 9 '18 at 17:53
  • You are responsible for disclosing your relationship with the products you promote. In order for this to be less of an ad, it would help if you also listed products that do something similar to your own. – schroeder Mar 4 '18 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.