Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual Machine Detection in the Browser (2019)

bannedit.github.io

Post reply on HN
Print view View original

71–80 of 98 posts

Re: Virtual Machine Detection in the Browser (2019)

#71

Post by maccard »

koluna wrote: post #46
pishpash wrote: post #24

Earlier quoted context omitted.

It is as much a choice as installing an .exe. Treat the web browser like the OS of old, because that's exactly what browser makers think of it.

It is not. I can open someone’s blog without knowing what trackers they have. A site has inherently a different trust boundary than an executable, and it should stay that way.

Not only that, you can vet someone's blog, decide you are ok with the trackers and revisit 24 hours later only to find that they've changed since you last visited.

Re: Virtual Machine Detection in the Browser (2019)

#72

Post by maccard »

geofft wrote: post #39
upbeat_general wrote: post #29

Earlier quoted context omitted.

True in theory but good luck explaining this to my grandma/99% of internet users. People click links freely even if they shouldn’t,

Twenty years ago they ran .exes just as freely.

20 years ago laptop weight was measured in pounds, clock speeds we're in MHz, storage was in single GB ranges, and battery life was a quarter of what it is today. Dial up was common, there was no youtube or spotify. Let's not hold ourselves to the standards of 3 generations ago of technology

Re: Virtual Machine Detection in the Browser (2019)

#73

Post by maccard »

chii wrote: post #11
emptyparadise wrote: post #3

You already get banished from half of the internet for hiding your IP address, I hope this wouldn't be used to make our lives even worse. Imagining a grim future where sites block all ad blockers (how about some detecting if an ad blocker exists at all, rather than its usage?), VPNs, virtual machines, even incognito mode. No full trust = no website.

Then do go to those websites. It's not a right that you have access to a website. Seek out only sites that don't block adblock, or has no ads. This might include a paid option (for example, youtube premium, or twitch subscription for ad-free viewing).

Even as a paying user of Amazon (via prime), google (via one), netflix, spotify, im still subjected to ads and tracking on those services.

Re: Virtual Machine Detection in the Browser (2019)

#74

Post by ninkendo »

The browser should ask permission from the user to divulge hardware information like this (something that looks like “This website wants to display 3D graphics, but this may divulge information used to track you”, etc.) We already have this for divulging your GPS location and notifications, why not add this too?

Yes, it means you’d get a lot more nagging, but to me, that’s good signal for what sites I should be avoiding in the first place.

Re: Virtual Machine Detection in the Browser (2019)

#75

Post by gruez »

mmwelt wrote: post #53
userbinator wrote: post #2

quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…

While changing the reported device names can just make the VM a little less obvious, I suspect there will always be clues that indicate a VM. For example: - Do network adapter MAC vendor ID's make sense? - Does the hard drive size make sense? - Which 3D acceleration features are supported/work correctly? - How much graphics RAM is there? - Timing-based methods It's a bit like detecting private/incognito mode in a bro…

>- Do network adapter MAC vendor ID's make sense?

>- Does the hard drive size make sense?

not detectable through browser APIs

>- Which 3D acceleration features are supported/work correctly?

vmware workstation has 3d acceleration support targeting directx 11, so I'd imagine most features are supported and are passed through to the host gpu for execution. I doubt you'll able to detect is a vm or not based on that. In addition, resistfingerprinting (on firefox) hides this kind of stuff.

>- How much graphics RAM is there?

vmware workstation has vram selectable from 32MB all the way to 8GB, so that covers the entire range of plausible vram sizes.

>- Timing-based methods

what else can you test that is both accessible via browser api and would yield big differences between a vm and a slow computer?

>It's a bit like detecting private/incognito mode in a browser. Everything worked great, until websites realised there are ways to detect it, then became a game of cat and mouse.

not really, it's a solved problem: make a new browser profile and then delete it after you're done. I've seen a few HN commenters post their (relatively short) scripts to make a new firefox/chromium, start it, and then automatically delete it once it exits.

Re: Virtual Machine Detection in the Browser (2019)

#76

Post by M277 »

WalterGR wrote: post #33
emptyparadise wrote: post #31

Earlier quoted context omitted.

And even if you can get through all this, you might eventually get locked out anyway and get told to submit a photo of your government identification.

What websites ask for that?

Facebook for sure. I don't know about the others.

I had to create a FB account for college, and somehow my account was suspicious according to them. They locked it and said that I needed to provide a picture of my national ID in order to unlock it.

I was baffled and just created another account to be honest.

Re: Virtual Machine Detection in the Browser (2019)

#77

Post by gruez »

_trampeltier wrote: post #54
userbinator wrote: post #2

quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information. I believe there are patches that can close those holes, but I've always found the fact that such infor…

I didn't know WebGL leaks so much information about my machine. I already open a browser just in ingokigno/private mode 90% of the time. Maybe is time to start just each time a different VM for browsing.

It's not limited to just webgl, there's a whole suite of browser features that can be used to "fingerprint" your browser. see: https://news.ycombinator.com/item?id=25166703

Re: Virtual Machine Detection in the Browser (2019)

#78

Post by gruez »

jmnicolas wrote: post #55
_trampeltier wrote: post #54

Earlier quoted context omitted.

I didn't know WebGL leaks so much information about my machine. I already open a browser just in ingokigno/private mode 90% of the time. Maybe is time to start just each time a different VM for browsing.

I tried it, it's highly inconvenient. Maybe QubesOS would help, not sure.

That wouldn't really help. The containers/VMs might be separated from each other, but they're running on the same hardware/software stack, so they'll behave the same should you decide to fingerprint it.

Re: Virtual Machine Detection in the Browser (2019)

#79

Post by gruez »

ninkendo wrote: post #74

The browser should ask permission from the user to divulge hardware information like this (something that looks like “This website wants to display 3D graphics, but this may divulge information used to track you”, etc.) We already have this for divulging your GPS location and notifications, why not add this too? Yes, it means you’d get a lot more nagging, but to me, that’s good signal for what sites I should be avoid…

I think you severely overestimate the resolve of the average user. They'd be very easily socially engineered into clicking yes, especially when the website is holding the content hostage. Not to mention, there's a wide array of fingerprinting techniques, and many of them have legitimate/common uses in normal sites. eg. window size, browser timezone, canvas.

Re: Virtual Machine Detection in the Browser (2019)

#80

Post by gruez »

Jonnax wrote: post #67

The fact that browsers allow websites to see whatgpu you have installed, driver version and enumerate your fonts is clearly put there for the benefit of tracking people. Otherwise browser developers would create generic classes of device that segment users into large groups based on features. The fonts thing is proof. For years, you install a custom font on your pc. Then you are unique.

Not really. Some GPU/driver implementations are simply broken, and can't be trivially detected via feature detection. That's why gpu blacklists are a thing https://wiki.mozilla.org/Blocklisting/Blocked_Graphics_Drive....
Post reply on HN