Virtual Machine Detection in the Browser (2019)
bannedit.github.io
Virtual Machine Detection in the Browser (2019)
1–10 of 98 posts
Re: Virtual Machine Detection in the Browser (2019)
#2quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information.
I believe there are patches that can close those holes, but I've always found the fact that such information is exposed by default and can thus make a VM obviously not look more like real hardware is puzzling. Ideally, a VM should be indistinguishable from real hardware, and in practice that ideal is difficult to achieve --- especially with timing-based detections --- but you'd think such obvious signs wouldn't appear.
Also, the amount of information that can be gathered via JS is disturbingly immense. To me, this is just further validation of the fact that JS needs to be off by default and whitelisted only for the (very few) sites that one truly trusts.
Re: Virtual Machine Detection in the Browser (2019)
#3You already get banished from half of the internet for hiding your IP address, I hope this wouldn't be used to make our lives even worse.
Imagining a grim future where sites block all ad blockers (how about some detecting if an ad blocker exists at all, rather than its usage?), VPNs, virtual machines, even incognito mode. No full trust = no website.
Re: Virtual Machine Detection in the Browser (2019)
#4quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…
There's a lot of paravirtualized devices even within an HVM type of VM. This is necessary for performance. You don't want to have to emulate a lot of things if you don't have to.
Re: Virtual Machine Detection in the Browser (2019)
#5quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…
> I've always found the fact that such information is exposed by default and can thus make a VM obviously not look more like real hardware is puzzling.
Eh, it seems to me that software ought to be cooperative by default. Plenty of programs will detect whether you have AMD or nVidia graphics and optimize itself for your hardware—why not VMWare graphics?
Where I agree is that there ought to be an easy checkbox to hide it.
Re: Virtual Machine Detection in the Browser (2019)
#6quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…
> I've always found the fact that such information is exposed by default and can thus make a VM obviously not look more like real hardware is puzzling. Eh, it seems to me that software ought to be cooperative by default. Plenty of programs will detect whether you have AMD or nVidia graphics and optimize itself for your hardware—why not VMWare graphics? Where I agree is that there ought to be an easy checkbox to hide…
And most importantly, it should be checked by default IMO
Re: Virtual Machine Detection in the Browser (2019)
#7Earlier quoted context omitted.
> I've always found the fact that such information is exposed by default and can thus make a VM obviously not look more like real hardware is puzzling. Eh, it seems to me that software ought to be cooperative by default. Plenty of programs will detect whether you have AMD or nVidia graphics and optimize itself for your hardware—why not VMWare graphics? Where I agree is that there ought to be an easy checkbox to hide…
And most importantly, it should be checked by default IMO
...no, that's where I don't agree. Again, software should attempt to be truthful by default. There's a reason we allow programs to detect the hardware they're running on—it allows for all sorts of optimizations.
Does the VM claim it's network driver was manufactured by Broadcom, or does it go with Cambridge Silicon Radio? Or does it decline to provide a vendor, and if it does, how long until software starts assuming that is the sign of a VM, except this time with potential false positives for users of niche hardware?
Re: Virtual Machine Detection in the Browser (2019)
#8quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…
> I've always found the fact that such information is exposed by default and can thus make a VM obviously not look more like real hardware is puzzling. Eh, it seems to me that software ought to be cooperative by default. Plenty of programs will detect whether you have AMD or nVidia graphics and optimize itself for your hardware—why not VMWare graphics? Where I agree is that there ought to be an easy checkbox to hide…
I agree with this in most cases, but when it comes to Javascript and fingerprinting, I think systems should be as generic as possible. This isn't even a VM versus bare metal thing.
Re: Virtual Machine Detection in the Browser (2019)
#9Earlier quoted context omitted.
> I've always found the fact that such information is exposed by default and can thus make a VM obviously not look more like real hardware is puzzling. Eh, it seems to me that software ought to be cooperative by default. Plenty of programs will detect whether you have AMD or nVidia graphics and optimize itself for your hardware—why not VMWare graphics? Where I agree is that there ought to be an easy checkbox to hide…
I agree with this in most cases, but when it comes to Javascript and fingerprinting, I think systems should be as generic as possible. This isn't even a VM versus bare metal thing.
Right, and so browsers need to fix this! Not because of VMs but because a web page, unlike desktop software, has no business knowing my graphics card.
Re: Virtual Machine Detection in the Browser (2019)
#10Long time ago a popular storage vendor automatically put their software into dev or test mode when it detected a vmware bios.
I had a really awesome storage array at home.