DrawnApart: A Device Identification and Spoofing Detection Technique based on Remote GPU Fingerprinting

Abstract

Browser fingerprinting aims at identifying users or their devices, through scripts that execute in the users’ browser and collect information on software or hardware characteristics. It is used to track users or as an additional means of identification to improve security. Fingerprinting techniques have one significant limitation: they are unable to track individual users for an extended duration. This happens because browser fingerprints evolve over time, and these evolutions ultimately cause a fingerprint to be confused with those from other devices sharing similar hardware and software.
Our technique, DrawnApart, advances the field of browser fingerprinting in three significant ways. First, it is the pioneering work that investigates and exploits manufacturing variances in identical GPUs in the context of privacy protection. Second, it provides a robust method for differentiating between devices with identical hardware and software configurations, achieving practical accuracy improvements in real-world scenarios. In a setting with diverse hardware and software configurations, DrawnApart is most effective when combined with traditional fingerprinting techniques such as FP-Stalker. Third, DrawnApart introduces a capability to verify the GPU renderer string, enabling the detection of spoofing attempts aimed at bypassing two-factor authentication by mimicking the victim’s device attributes.