Researchers from Ben-Gurion University (Israel), Lille University (France), and the University of Adelaide (Australia) have developed a new technique for identifying user devices by analyzing GPU performance parameters in web browsers. The method, named 'Drawn Apart,' utilizes WebGL to generate a GPU performance profile, significantly enhancing the accuracy of passive tracking methods that operate without cookies and without storing an identifier on the user's system.
Methods that consider rendering features, GPU, graphics stack, and drivers for identification have been used before, but they were limited to distinguishing devices only at the level of different graphics card models and GPUs, thus serving merely as an additional factor to increase the likelihood of identification. The key feature of the new 'Drawn Apart' method is that it does not limit itself to distinguishing between different GPU models but aims to identify differences among identical GPUs of the same model, resulting from the variability in the chip manufacturing process designed for massive parallel computations. It has been noted that variations occurring during production allow for the formation of unique fingerprints for the same device models.
It was found that these differences can be detected through the count of execution blocks and performance analysis in the GPU. As primitives for distinguishing different GPU models, checks based on a set of trigonometric functions, logical operations, and floating-point computations were used. To identify differences in identical GPUs, the number of concurrently executing threads during vertex shader execution was evaluated. It is suggested that the observed effect is caused by variations in temperature conditions and power consumption among different chip instances (a similar effect was previously demonstrated for CPUs—identical processors executing the same code exhibited different power consumption).
Since operations via WebGL are executed asynchronously, it is not possible to directly use the JavaScript API performance.now() for measurement of their execution time. Thus, three tricks were proposed for measuring time:
- onscreen — rendering the scene in an HTML canvas while measuring the time of the callback function triggered via the API Window.requestAnimationFrame, called after rendering completion.
- offscreen — utilizing a worker and rendering the scene in an OffscreenCanvas object while measuring the execution time of the convertToBlob command.
- GPU — rendering in an OffscreenCanvas object, but using the timer provided in WebGL that accounts for the duration of command execution on the GPU side.
During the creation of the identifier on each device, 50 checks were performed, each covering 176 measurements of 16 different characteristics. An experiment collecting information on 2500 devices with 1605 different GPUs demonstrated a 67% increase in the efficiency of combined identification methods with the addition of support for Drawn Apart. Specifically, the combined method FP-STALKER averaged identification within 17.5 days, while in conjunction with Drawn Apart, the identification period increased to 28 days.
- The accuracy of separating 10 systems with Intel i5-3470 (GEN 3 Ivy Bridge) chips and Intel HD Graphics 2500 GPU in the onscreen test was 93%, while in offscreen it was 36.3%.
- For 10 systems with Intel i5-10500 (GEN 10 Comet Lake) and an NVIDIA GTX1650 graphics card, the accuracy was 70% and 95.8%.
- For 15 systems with Intel i5-8500 (GEN 8 Coffee Lake) and Intel UHD Graphics 630 GPU, the accuracy was 42% and 55%.
- For 23 systems with Intel i5-4590 (GEN 4 Haswell) and Intel HD Graphics 4600 GPU, the accuracy was 32.7% and 63.7%.
- For six Samsung Galaxy S20/S20 Ultra smartphones with Mali-G77 MP11 GPU, the accuracy of identification in the onscreen test was 92.7%, while for Samsung Galaxy S9/S9+ smartphones with Mali-G72 MP18, it was 54.3%.
It was noted that the accuracy was affected by the GPU temperature, and for some devices, a system reboot led to distortion of the identifier. When using the method in combination with other indirect identification methods, the accuracy can be significantly increased. There are also plans to enhance accuracy through the use of compute shaders after stabilizing the new WebGPU API.
Companies like Intel, ARM, Google, Khronos, Mozilla, and Brave were notified about the issue back in 2020, but the method's details have only now been revealed. Researchers also published working examples written in JavaScript and GLSL, which can operate with and without screen output. Additionally, datasets for classifying extracted information in machine learning systems have been released for Intel GEN 3/4/8/10 based GPU systems.
Source: opennet.ru
