New Technique Allows Remote Fingerprinting Of Computers Regardless Of IP Address

KingFish

Anonymous Internet access is now a thing of the past. A doctoral student at the University of California has conclusively fingerprinted computer hardware remotely, allowing it to be tracked wherever it is on the Internet.

In a paper on his research, primary author and Ph.D. student Tadayoshi Kohno said: "There are now a number of powerful techniques for remote operating system fingerprinting, that is, remotely determining the operating systems of devices on the Internet. We push this idea further and introduce the notion of remote physical device fingerprinting ... without the fingerprinted device's known cooperation."

The potential applications for Kohno's technique are impressive. For example, "tracking, with some probability, a physical device as it connects to the Internet from different access points, counting the number of devices behind a NAT even when the devices use constant or random IP identifications, remotely probing a block of addresses to determine if the addresses correspond to virtual hosts (for example, as part of a virtual honeynet), and unanonymising anonymised network traces."

NAT (network address translation) is a protocol commonly used to make it appear as if machines behind a firewall all retain the same IP address on the public Internet.

Kohno seems to be aware of the interest from surveillance groups that his techniques could generate, saying in his paper: "One could also use our techniques to help track laptops as they move, perhaps as part of a Carnivore-like project". Carnivore was Internet surveillance software built by the United States' Federal Bureau of Investigation. Earlier in the paper Kohno overshadowed possible forensics applications, saying that investigators could use his techniques "to argue whether a given laptop was connected to the Internet from a given access location".

Whoa. -KF

Source: ZDNet Australia

guest

all hype. give scientific details when you post scare stories.

KingFish

It's hardly a scare story. It was carried by several trusted news sources.
Here's the paper written by the PHD student:
http://www.caida.org/outreach/papers/2005/fingerprinting/KohnoBroidoClaffy05-devicefingerprinting.pdf