1396468 - Spoof navigator.oscpu as 'Windows NT 6.1; Win64; x64' when resisting fingerprinting is enabled

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Ethan Tseng [:ethan]]

This is a follow-up of bug 1333651.

https://bugzilla.mozilla.org/show_bug.cgi?id=1383495#c23
This comment pointed out the value of navigator.oscpu should be spoofed as
"Windows NT 6.1; Win64; x64" instead of "Window NT 6.1".


Reference of navigator.oscpu:
https://developer.mozilla.org/en-US/docs/Web/API/Navigator/oscpu

Comment 1

[Ethan Tseng [:ethan]]

Attachment: bug-1396468.patch

Just as bug 1383495, we might want to uplift this to Beta 56.

Comment 2

[Ethan Tseng [:ethan]]

Comment on attachment 8904105 [details] [diff] [review]
bug-1396468.patch

Cancel the review request.
I forgot to change the test case.

Comment 3

[Ethan Tseng [:ethan]]

Attachment: bug-1396468.patch

Hi Ehsan,

Could you review this patch?

It's a follow-up of bug 1383495.
According to https://developer.mozilla.org/en-US/docs/Web/API/Navigator/oscpu,
the oscpuInfo string on Windows 64-bit should be Windows NT 6.1; Win64; x64.

Comment 4

[Thorin [:thorin]]

https://bugzilla.mozilla.org/show_bug.cgi?id=1333933#c13

> Is anyone going to address the issue of the UA navigator.* spoofing items
> that are not fully spoofed? UA http header will not match JS's value when it
> queries navigator.userAgent. Or JS pulling the real values for say
> navigator.platform or navigator.oscpu. Not to mention some of these "spoofs"
> leak over iframes.

Thanks for someone finally picking up on oscpu as mentioned. I suggest you double check platform, and test everything over iframes [1], seriously, go check them (I have not tested lately). I'll also assume you have headers covered to match any JS spoofing [2].

[1] https://browserleaks.com/javascript - click the iframe button
[2] http://browserspy.dk/useragent.php

Comment 5

[Thorin [:thorin]]

FYI:

https://trac.torproject.org/projects/tor/ticket/23104 - CSS line height query leaks OS
https://www.hackerfactor.com/blog/index.php?/archives/761-Exploiting-the-TOR-Browser.html - notably scrollbar thickness / Viewport Size

eg my results:
> Scrollbar thickness: right 17px, bottom 0px; Detected Windows

Comment 6

[(no longer active)]

Comment on attachment 8904310 [details] [diff] [review]
bug-1396468.patch

Review of attachment 8904310 [details] [diff] [review]:
-----------------------------------------------------------------

Oops, this needs to be backported to beta, right?

Comment 7

[Ethan Tseng [:ethan]]

(In reply to :Ehsan Akhgari (needinfo please, extremely long backlog) from comment #6)
> Oops, this needs to be backported to beta, right?

Yes!  Hope we could make it.

Comment 8

[Ethan Tseng [:ethan]]

Attachment: bug-1396468.patch

Refresh the commit message "r=ehsan".

Comment 9

[Ethan Tseng [:ethan]]

(In reply to Simon Mainey from comment #4)
> Thanks for someone finally picking up on oscpu as mentioned. I suggest you
> double check platform, and test everything over iframes [1], seriously, go
> check them (I have not tested lately). I'll also assume you have headers
> covered to match any JS spoofing [2].
> [1] https://browserleaks.com/javascript - click the iframe button
> [2] http://browserspy.dk/useragent.php

Simon,

Thanks for the information! Really helpful!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/38323ec9e5da
Spoof navigator.oscpu as 'Windows NT 6.1; Win64; x64' when resisting fingerprinting is enabled. r=ehsan

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/38323ec9e5da

Comment 12

[Thorin [:thorin]]

(In reply to Simon Mainey from comment #5)
> https://trac.torproject.org/projects/tor/ticket/23104 - CSS line height query leaks OS
> https://www.hackerfactor.com/blog/index.php?/archives/761-Exploiting-the-TOR-Browser.html - notably scrollbar thickness / Viewport Size

Do you want me to do anything with these two issues, eg filing new tickets?

Comment 13

[Ethan Tseng [:ethan]]

(In reply to Simon Mainey from comment #12)
> (In reply to Simon Mainey from comment #5)
> > https://trac.torproject.org/projects/tor/ticket/23104 - CSS line height query leaks OS
> > https://www.hackerfactor.com/blog/index.php?/archives/761-Exploiting-the-TOR-Browser.html - notably scrollbar thickness / Viewport Size 
> Do you want me to do anything with these two issues, eg filing new tickets?

That would be great.  Please file bugs and add me to the CC list.
Thanks!

Comment 14

[Ethan Tseng [:ethan]]

Comment on attachment 8905120 [details] [diff] [review]
bug-1396468.patch

Approval Request Comment
[Feature/Bug causing the regression]: N/A
[User impact if declined]: A weakness in fingerprinting protection
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: N/A
[Is the change risky?]: No
[Why is the change risky/not risky?]: We only changed one constant definition
[String changes made/needed]: N/A

Comment 15

[Thorin [:thorin]]

(In reply to Ethan Tseng [:ethan] from comment #13)
> That would be great.  Please file bugs and add me to the CC list.
> Thanks!

I don't know how to CC someone, so I flagged them both as needinfo from you: Bug 1397994 and Bug 1397996

Comment 16

[Ethan Tseng [:ethan]]

(In reply to Simon Mainey from comment #15)
> I don't know how to CC someone, so I flagged them both as needinfo from you:
> Bug 1397994 and Bug 1397996

That is fine. Thanks for filing those bugs.
I set some flags so we will triage and process them in the near future.

p.s. How to CC people?
[Edit Bug] > [People] > [CC] > [Add]

Comment 17

[Gerry Chang [:gchang]]

Comment on attachment 8905120 [details] [diff] [review]
bug-1396468.patch

Fix a fingerprinting protection issue. Beta56+.

Comment 18

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/715dcb4d80a6

Comment 19

[Cyrus Patel]

The patch introduced here causes websites to assume that the client is running on a desktop OS. That has unintended side effects on Firefox for Android. See Bug 1409001

Comment 20

[Ethan Tseng [:ethan]]

(In reply to Cyrus Patel from comment #19)
> The patch introduced here causes websites to assume that the client is
> running on a desktop OS. That has unintended side effects on Firefox for
> Android. See Bug 1409001

Cyrus, thanks for reporting the issue.
We are aware of it and already track it in bug 1404608.