Gaining information about current version of an application or operating system in order to find a vulnerability.

learn more… | top users | synonyms

0
votes
2answers
72 views

Multiple types of tracking

In a system where I have reviews of products, to avoid fake reviews I have thought about doing the following: Limit one review for each account -> To bypass this measure, the user could create ...
2
votes
3answers
68 views

Canvas fingerprinting identifies the OS?

I recently read this article, about how a journalist was hacked. She describes how they used a 'fingerprinting' technique to identify her OS. The way they use a one pixel image, it sounds like the ...
7
votes
1answer
99 views

Disable HTML5 battery features

HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
1
vote
0answers
46 views

What are the best ways for an iOS 9 user to protect against device fingerprinting?

In response to this series of questions: What unique device fingerprinting information can an iOS9 app collect? and as an update to this question: What are the best practices for maintaining privacy ...
0
votes
0answers
55 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
4
votes
1answer
42 views

Passive fingerprinting of email client, based on email headers

Are there ways to passively fingerprint (infer) the operating system or mail client that an email sender is using, based upon the headers of an email from that sender? I'm familiar with passive ...
1
vote
1answer
18 views

What TCP-level commands affect the global configuration of the stack?

I'm looking at TCP, and what options may affect the global configuration so that I can detect a repeat visitor. What TCP commands (for lack of a better word) affect the global TCP stack? Or that or ...
0
votes
2answers
52 views

Browser Fingerprinting and Passwords stored by browser

I am using the Firefox browser on a Linux system and it came to my knowledge that it is possible for sites to take a fingerprint of the user visiting their homepages. So I actually have four ...
0
votes
0answers
53 views

Can a TPM's EK's public key (hash) be used to fingerprint a device?

The question How to use TPM to perform platform authentication is basically asking if the TPM's EK can be used to "authenticate" a host/device. And one of the answers says The Endorsement Key ...
2
votes
1answer
138 views

Is an SSL/TLS HTTPS certificate 'fingerprinting' attack possible?

If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I ...
2
votes
1answer
195 views

Does HTTPS protect you from fingerprinting by the NSA?

We've established that, for all intents and purposes, HTTPS hides what page you visit on a given server from NSA backbone wiretapping, but not the domain itself. But that's only IP / domain ...
0
votes
1answer
165 views

Using OpenAppID without Snort [closed]

Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link Lets say I have a sniffer application for myself; if I ...
1
vote
2answers
470 views

How to fake a browser fingerprint?

I'm developing a browser based on Google Chromium and keeping in mind that privacy is freedom; but I need to know how to protect my browser's users against fingerprinting. I was thinking about ...
11
votes
5answers
2k views

Are photographs of fingerprints a security risk?

It should be trivial to get fingerprint patterns for many of the most important people in the world, as they frequently (enough) wave their hand, palms forward, to many HD cameras. Is it possible to ...
3
votes
4answers
2k views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
3
votes
0answers
233 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
1
vote
1answer
137 views

DPI BitTorrent fingerprinting

For limiting the usage of BitTorrent, I must identify BitTorrent traffic. For handshaking, I am simply looking for "19" and "BitTorrent protocol" string. If it is DHT I am looking for ping or id ...
0
votes
1answer
81 views

Throttle network based on OS [closed]

What do I need to learn/know to throttle a clients network based on his/her operating system. For example: Someone in my network using Kali Linux... I would like to throttle their traffic to ...
2
votes
1answer
83 views

Can we build network topology using passive fingerprinting?

Can we use the tools such as P0f, OSSIM and other passive fingerprinting tools to build a comprehensive network topology of how the devices are interconnected ? or is there a passive finger printing ...
9
votes
4answers
70 views

Fingerprinting the webpage content

I'm moderating a closed section of a forum - think 'covered by NDA' (not actually, but it's a good equivalent of the situation), with restricted access. Sometimes we find screenshots from that forum ...
1
vote
2answers
223 views

Are Internet Explorers “Tracking Protection” able to prevent AddThis canvas fingerprinting?

A paper on web tracking mechanisms identifies the web-tracking company AddThis as a major user of canvas fingerprinting. Are IE:s Tracking Protection, provided Tracking Protection Lists including ...
6
votes
1answer
663 views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
0
votes
1answer
206 views

Virtualization / Cloud-Stack fingerprinting from running VM

How can the host environment (not just the OS) be identified from a running guest VM. To determine what the underlying host and virtualization stacks being used actually are. I.e. whether there's a ...
1
vote
2answers
350 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
1
vote
1answer
105 views

Botnet fingerprinting

Does anyone know of any research of papers on fingerprinting botnets? If a given target is being brute forced or DDoSed do methods exist to determine if a brute force or DDoS on another target are ...
1
vote
0answers
60 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 ...
0
votes
1answer
85 views

Service banner checking for vulnerabilities offline

Has anybody seen a tool where you can collect Service banners from something like nmap, output them to a file, the vuln vulnerability checks offline?
2
votes
1answer
519 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
6
votes
1answer
3k views

Discovering a vulnerable service on a machine

I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are: port 25 tcp port 111 tcp For port 25, it is supposed to be running SMTP, ...
-4
votes
2answers
538 views

Defend against HTTP fingerprinting [closed]

I'm looking for ways to defend against common fingerprinting techniques used by hackers to identify what kind of setup my website is running on. I understand this is a complicated topic, and every ...
1
vote
1answer
734 views

Spoofing OS during browsing

I am using http://www.mybrowserinfo.com/ to gather some info about me while browsing. I want to change my OS to appear that its a Windows Xp machine.(No VM solutions please:D) If you have any ...
0
votes
1answer
656 views

Does google use browser fingerprinting? [closed]

I'm wondering whether besides collecting the typical tracking information (IP + cookies) google has already implemented browser fingerprinting? I read sometime not long ago about it being a ...
1
vote
1answer
120 views

How can I block flash from obtaining a list of available fonts in my browser? [closed]

How can I block Flash, at least in Chrome, from obtaining the list of available fonts in my browser? It seems that the combination of fonts available is the easiest way to fingerprint a browser.
9
votes
1answer
716 views

Can BitTorrent clients be fingerprinted?

As https://panopticlick.eff.org/ demonstrates, web browsers are very prone to fingerprinting, both active and passive (often you can fingerprint a web browser by simply monitoring the wire). My ...
7
votes
3answers
5k views

How to know if two IP addresses point to the same web server?

Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application. They are different public (accessible through Internet) IP ...
4
votes
1answer
978 views

Techniques for fingerprinting a web based content management system (CMS)

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built ...