12

Assume that a visitor to a website has changed his useragent to something like the following, but he's using linux:

Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0

Assume that the website is in the hands of an evil hacker. Is this trick enough to make the expolit-kit nonfunctioning, or is it possible for the hacker to gain control over the visitor (Assume that the visitor's flash-module and browser is outdated)?

Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed?

8

If you allow the website to run Javascript which can send code back to the server there are probably multiple ways to detect the browser as different browsers handle things slightly different.

Apart from that there are also user variables besides the user agent with identify the browser. See http://www.quirksmode.org/js/detect.html and http://www.quirksmode.org/js/support.html

8

If you look at the information collected by panopticlick, you can see that the useragent is just one of the pieces of data they collect. It's possible that other pieces of data could be used to effectively fingerprint you in the absense of an precise useragent.

There also additional techniques as used by products like Beef to fingerprint users, where a Java Applet can (if allowed to run by the user) pull a wide range of information off a PC.

So I'd say that, in isolation, blocking useragent alone wouldn't always be sufficient to obfuscate the browser/OS combination that you're using.

4

Without wanting to add too much to what's already been said - it wouldn't be hard to write some javascript which checks the features are available in your browser and compares them to browsers on html5test to find the most likely browser.

  • Similarly, many exploit kits detect, via Javascript, the Flash version, Java version etc and deliver a corresponding exploit when old versions are detected – niilzon Feb 23 '16 at 14:56
3

As others have noted, forging user-agent won't protect you. I concur that using NoScript and Adblock Plus, and avoiding Java browser plugins, are key steps.

For high-risk browsing, it's safer to work in virtual machines. Safer still is using LiveCDs in diskless computers. Network and USB-drive isolation are also crucial.

2

Honestly, it depends on the exploit being used. If it's a browser based exploit, more often than not, an attacker isn't going to care about the User-Agent that you're sending, as long as there is an exploit for that browser. There are certain exploits in Metasploit that don't send payloads whenever they detect an incompatible browser (via the UserAgent), but an attacker can easily modify those scripts to blindly attack.

If you're looking to protect yourself from drive-by attacks, or when you click on a malicious link by mistake, I would recommend installing NoScript to prevent script execution except on trusted websites. Even extensions such as AdBlock help - a lot of exploits are delivered via ad-delivery networks, and AdBlock will block some of these as well.

Rory mentions using Beef and Java applets - while the latest update of Java does provide protection against unsigned applets, letting Java execute on your browser is the surest way of getting exploited. I've used this during penetration tests far too many times, and I've seen it in action as a payload used by attackers too.

The point is that there is no way to really "obfuscate" yourself on the Internet completely. You can do certain things that make you safer, but at the end of the day, the best way to protect yourself from such attacks is by simply being careful of what links you click on, and remembering that the Internet is a dangerous place.

2

Even when not using Javascript or any further communication it is possible to fingerprint browsers by other characteristics of their HTTP requests alone.

A HTTP request can contain much more than just the User-Agent. There are a lot more headers. The order in which these headers are sent isn't standardized, so every browser has its own order. This behavior-difference can be used to fingerprint browsers.

The Accept header, for example, is the first header sent in Internet Explorer, comes after User-Agent in Firefox and after Connection: keep-alive in Chrome.

When the Accept-Encoding header includes sdch, you can be sure it's a webkit-based browser, because currently only webkit supports sdch compression.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.