jonasstrehle/supercookie

⚠️ Browser fingerprinting via favicon!

Supercookie uses favicons to assign a unique identifier to website visitors.
Unlike traditional tracking methods, this ID can be stored almost persistently and cannot be easily cleared by the user.

The tracking method works even in the browser's incognito mode and is not cleared by flushing the cache, closing the browser or restarting the operating system, using a VPN or installing AdBlockers. 🍿 Live demo.

About

💭 Inspiration

• Paper by Scientists at University of Illinois, Chicago: www.cs.uic.edu
• Article by heise: heise.de

🌱 Purpose

This repository is for educational and demonstration purposes only!

The demo of "supercookie" as well as the publication of the source code of this repository is intended to draw attention to the problem of tracking possibilities using favicons.

📕 Full documentation

Installation

🔧 Docker

requirements: Docker daemon

1. Clone repository

git clone https://github.com/jonasstrehle/supercookie

2. Update .env file in supercookie/server/.env

HOST_MAIN=yourdomain.com #or localhost:10080
PORT_MAIN=10080

HOST_DEMO=demo.yourdomain.com #or localhost:10081
PORT_DEMO=10081

3. Run container

cd supercookie/server
docker-compose up

-> Webserver will be running at https://yourdomain.com

🤖 Local machine

requirements: Node.js

1. Clone repository

git clone https://github.com/jonasstrehle/supercookie

2. Update .env file in supercookie/server/.env

HOST_MAIN=localhost:10080
PORT_MAIN=10080

HOST_DEMO=localhost:10081
PORT_DEMO=10081

3. Run service

cd supercookie/server
node --experimental-json-modules main.js

-> Webserver will be running at http://localhost:10080

Workwise of supercookie

📖 Background

Modern browsers offer a wide range of features to improve and simplify the user experience. One of these features are the so-called favicons: A favicon is a small (usually 16×16 or 32×32 pixels) logo used by web browsers to brand a website in a recognizable way. Favicons are usually shown by most browsers in the address bar and next to the page's name in a list of bookmarks.

To serve a favicon on their website, a developer has to include an attribute in the webpage’s header. If this tag does exist, the browser requests the icon from the predefined source and if the server response contains an valid icon file that can be properly rendered this icon is displayed by the browser. In any other case, a blank favicon is shown.

<link rel="icon" href="/favicon.ico" type="image/x-icon">

The favicons must be made very easily accessible by the browser. Therefore, they are cached in a separate local database on the system, called the favicon cache (F-Cache). A F-Cache data entries includes the visited URL (subdomain, domain, route, URL paramter), the favicon ID and the time to live (TTL). While this provides web developers the ability to delineate parts of their website using a wide variety of icons for individual routes and subdomains, it also leads to a possible tracking scenario.

When a user visits a website, the browser checks if a favicon is needed by looking up the source of the shortcut icon link reference of the requested webpage. The browser initialy checks the local F-cache for an entry containing the URL of the active website. If a favicon entry exists, the icon will be loaded from the cache and then displayed. However, if there is no entry, for example because no favicon has ever been loaded under this particular domain, or the data in the cache is out of date, the browser makes a GET request to the server to load the site's favicon.

💣 Threat Model

In the article a possible threat model is explained that allows to assign a unique identifier to each browser in order to draw conclusions about the user and to be able to identify this user even in case of applied anti-fingerprint measures, such as the use of a VPN, deletion of cookies, deletion of the browser cache or manipulation of the client header information.

A web server can draw conclusions about whether a browser has already loaded a favicon or not: So when the browser requests a web page, if the favicon is not in the local F-cache, another request for the favicon is made. If the icon already exists in the F-Cache, no further request is sent. By combining the state of delivered and not delivered favicons for specific URL paths for a browser, a unique pattern (identification number) can be assigned to the client. When the website is reloaded, the web server can reconstruct the identification number with the network requests sent by the client for the missing favicons and thus identify the browser.

	conventional cookies	supercookie
Identification accuracy	-	100%
Incognito / Private mode detection	❌	✅
Persistent after flushed website cache and cookies	❌	✅
Identify multiple windows	❌	✅
Working with Anti-Tracking SW	❌	✅

🎯 Target

It looks like all top browsers ( Chrome, Firefox, Safari, Edge) are vulnerable to this attack scenario.
Mobile browsers are also affected.

Current versions

Browser	Windows	MacOS	Linux	iOS	Android	Info
Chrome (v 111.0)	✅	✅	✅	?	✅	-
Safari (v 14.0)	-	✅	-	✅	-	-
Edge (v 87.0)	✅	✅	❌	❌	✅	-
Firefox (v 86.0)	✅	✅	❌	❌	❌	Fingerprint different in incognito mode
Brave (v 1.19.92)	❌	❌	❌	❔	❌	-

Previous versions

Browser	Windows	MacOS	Linux	iOS	Android	Info
Brave (v 1.14.0)	✅	✅	✅	✅	✅	-
Firefox (< v 84.0)	✅	✅	❔	❌	✅	-

⚙ Scalability & Performance

By varying the number of bits that corresponds to the number of redirects to subpaths, this attack can be scaled almost arbitrarily. It can distinguish 2^N unique users, where N is the number of redirects on the client side. The time taken for the read and write operation increases as the number of distinguishable clients does.
In order to keep the number of redirects as minimal as possible, N can have a dynamic length. More about this here.

📌How to defend against?

The most straightforward solution is to disable the favicon cache completely. As long as the browser vendors do not provide a feature against this vulnerability it's probably the best way to clear the F-cache.

• Chrome • MacOS
  

  • Delete ~/Library/Application Support/Google/Chrome/Default/Favicons
  • Delete ~/Library/Application Support/Google/Chrome/Default/Favicons-journal

• Chrome • Windows
  

  • Delete C:\Users\username\AppData\Local\Google\Chrome\User Data\Default

• Safari • MacOS
  

  • Delete content of ~/Library/Safari/Favicon Cache

• Edge • MacOS
  

  • Delete ~/Library/Application Support/Microsoft Edge/Default/Favicon
  • Delete ~/Library/Application Support/Microsoft Edge/Default/Favicons-journal

Other

🙎‍♂️ About me

I am a twenty year old student from 🇩🇪 Germany. I like to work in software design and development and have an interest in the IT security domain.

This repository, including the setup of a demonstration portal, was created within two days as part of a private research project on the topic of "Tracking on the Web".

💖 Support the project

Spread the world!

Liked the project? Just give it a star ⭐ and spread the world!

• Bruce Schneier on schneier.com
• Matthew Gault on vice.com
• Rhett Jones on gizmodo.com
• Dev Kundaliyaon on computing.co.uk
• Barclay Ballard on techradar.com
• Discussion on ycombinator.com
• 🇩🇪 Andreas Proschofsky on derstandard.de
• 🇩🇪 Dieter Petereit on t3n.de
• 🇪🇸 ALVY on microsiervos.com
• 🇧🇷 Felipe Demartini on canaltech.com.br
• 🇧🇬 Daniel Despodov on kaldata.com
• 🇫🇷 Guillaume Belfiore on clubic.com
• 🇨🇳 study875 on cnbeta.com
• 🇷🇺 ITSumma on habr.com
• 🇷🇺 securitylab.ru
• Seytonic on YouTube

supercookie's Issues

Not working when using "Advanced clear browsing data"

If I clear all history in the last 1 hour (see example below), I get a new identifier.

I'm using Chrome 88 on latest MacOS

Not working on Chrome when using "Guest" mode

I'm getting two different identifiers when I'm using a "guest" profile on Chrome + Mac OS.

Is it working??

I had the supercookie demonstration running; since its not coming to an end, my question: Is it still working? When should it come to an end? 1 Hour? 10 Hours?
The details of my test: "OSX" or mac Monterey 10.3
Browser Firefox Nightly 100.0a1 (2022-03-15) (64-bit)
In Safari Browser it runs endlessly. Should I expect the same for Firefox Nightly?

Not working when redirecting is interrupted

Click the stop button and the refresh button on the browser (left top corner) quickly when redirecting to next page, the process will continue but I get a new identifier.(Not every time but often.)

You are an accomplice of IT companies violating User Privacy

If you can track and identify user for good by using this approach, you are depriving our right to privacy.
You said that this is only for educational usage but once it is carried out, there is no way to revert.
You are helping big companies like Google by identifying users. And you are violating First Amendment to the United States Constitution.
So I suggest you remove this repo or develop an approach to against it

Safari on macOS not affected

For me the function "Clear History..." and selecting "all history" in Safari 14.0.3 (Big Sur) clears the complete favicon cache in ~/Library/Safari/Favicon Cache/

With Safari on iOS on the other hand there appears to be no way to clear the cache short of factory resetting.

Brave and firefox 85+ are not affected by supercookies

Hi,
brave browser and firefox, since 85+, are both not affected by supercookies.

Node version and docker documentation

I tried running your docker as per your documentation, unfortunately it doesn't work for me.
I get the following error message, but it's out of the question.
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'express' imported from /home/node/app/main.js

This leads me to think I have the wrong node version. (I am no expert in JS environnement)

So would it be possible for you to update your docker-compose.yml with a specific node version ?

For example : image: "node:20.11"

Also it would be nice to know which docker version you're using and on which OS.

Last point in your documentation for docker you could add the creation of the network "main" that you use
docker network create main

(Thanks for the project, it's very interesting)

Video Walk-through

Please make a video walk-through of this project.

Not working.

@jonasstrehle help me please.

I am useing node v15.12.0, but after install dependencies have next error. How can it be resolved?

mnt/d/Projects/Dev/supercookie/server$ node --experimental-json-modules main.js
node:internal/process/esm_loader:74
    internalBinding('errors').triggerUncaughtException(
                              ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'express.js' imported from /mnt/d/Projects/Dev/supercookie/server/main.js
    at new NodeError (node:internal/errors:329:5)
    at packageResolve (node:internal/modules/esm/resolve:714:9)
    at moduleResolve (node:internal/modules/esm/resolve:755:18)
    at Loader.defaultResolve [as _resolve] (node:internal/modules/esm/resolve:869:11)
    at Loader.resolve (node:internal/modules/esm/loader:86:40)
    at Loader.getModuleJob (node:internal/modules/esm/loader:230:28)
    at ModuleWrap.<anonymous> (node:internal/modules/esm/module_job:57:40)
    at link (node:internal/modules/esm/module_job:56:36) {
  code: 'ERR_MODULE_NOT_FOUND'
}

Chrome on Incognito produces different ID

As title says!

Google Chrome | 114.0.5735.248 (Official Build) (arm64)
-- | --
Revision | 6a4d58406feefcfe55d9fa6c53bf40ebc5453342-refs/branch-heads/5735_243@{#3}
OS | macOS Version 13.3.1 (a) (Build 22E772610a)
JavaScript | V8 11.4.183.27
User agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Command Line | /Applications/Google Chrome.app/Contents/MacOS/Google Chrome --flag-switches-begin --allow-insecure-localhost --flag-switches-end
Executable Path | /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

Are WebViews affected?

Never ends :-)

Maan, I have a lot of extensions which protect my fingerprint and one for No fingerprint (that is same name for extension :-) ) .
Also, I have one extensions which makes websites think that I am using Android Browser and also ProtonVpn which hides my vpn. BTW, I am on LM 20.3, Cinnamon.
And I am using LibreWolf.
I am asking question to you, dear dev: it never ends - does that means that I have full real privacy?????

the port should not included in doamin in env config file

ServiceWorker behavior?

In your research have you explored the behavior when combined with ServiceWorkers? Possibly because it could remove the need for a server altogether by "spoofing" URLs under a specific prefix, but also because it can reduce round trip to the server by generating the response within the worker itself locally.

It forms a never ending loop in ecosia browser

after 17/17 it somewhy restarts from 1/17

Supercookie.me website is down

node_modules is checked in

I guess this happened by accident?
This lead to the situation that this repo is over 20MB huge.

Thus I guess you might want to add the directory to gitignore and remove the directory from history.

PS: I case this was added intentionally: why?

document how to clear F-Cache

Or is that impossible to clear F-Cache on affected browsers?

Chrome incognito breaks id

Loops on incognito, and once you do get the id its different that from that of a non incognito tab.

Can't fully reproduce with Firefox 85

I can't reproduce my IDs with Firefox 85 (Linux). I don't know if it is related to this, they only mention cross-site supercookie protection.

Chromium 88 seems to be still vulnerable.
Tabs underlined in blue are part of the same container (Firefox extension), others (left to right) are vanilla Firefox, private Firefox and vanilla Chromium.

First try:

After restarting my browsers:

Not Working When cookies are disabled

Your solution is supposed to work without cookies enabled, but when I turn on the Block all cookies flag on Safari I am getting an endless redirect loop on demo.supercookie.me and on my local nodejs project.
It looks like you are highly reliant on cookies.

Add habr article to "Spread the world"

https://habr.com/ru/company/itsumma/blog/542734/
There is Russian article about this repo. I am not the author, but I'd love to see it in README list.

How to distinguish between write and read

I saw the documentation but didn't really get it how can you know if this is the first time for the user to enter the site so you car write some favicon to him and give him identifier or if he already have favicons and u will then give him 404 request on all favicons. so can you please tell in details how the script distinguish? Or maybe the first redirect is always test and if the user asked for favicon "a" then he is new and if not we start reading?

Bypass ITP?

Can this solution bypass Safari's ITP?
Currently all browser storage from 1st party will only be available for 7days. This include cookies, local storage, etc.

Also how about firefox 'network partitioning'?
https://www.zdnet.com/article/firefox-to-ship-network-partitioning-as-a-new-anti-tracking-defense/

Not working)

I got one ID through chrome, another one through Tor. Opera without VPN gave a third identifier, Mozilla also showed another. This nonsense does not work and also does not run on NodeJs))