论文标题
通过Linux的新TCP源端口选择算法（扩展版）跟踪设备跟踪
Device Tracking via Linux's New TCP Source Port Selection Algorithm (Extended Version)
论文作者
论文摘要
我们描述了针对Linux设备的跟踪技术，利用了最近引入Linux内核的新的TCP源端口生成机制。该机制基于在RFC 6056中标准化的算法，用于通过更好的随机端口选择来提高安全性。我们的技术基于以攻击者规定方式生成的采样TCP源端口，检测到上述算法中使用的哈希函数的碰撞。这些哈希碰撞仅取决于每个设备密钥，因此碰撞组形成了一个设备ID，该设备ID允许在浏览器，浏览器隐私模式，容器和IPv4/ipv6网络（包括一些VPN）上跟踪设备。它可以区分具有相同硬件和软件的设备，并持续到设备重新启动为止。 我们实现了此技术，然后使用两个不同位置的跟踪服务器以及各种网络上的Linux设备对其进行了测试。我们还在Android设备上测试了它，我们对我们进行了修补，以引入新的端口选择算法。跟踪技术在现实生活中起作用，我们报告了有关它的详细发现，包括其停留时间，可扩展性和在不同网络类型中的成功率。我们与Linux内核团队合作，以减轻利用，从而导致2022年5月推出的安全补丁，并提供建议，以更好地确保论文中的端口选择算法。
We describe a tracking technique for Linux devices, exploiting a new TCP source port generation mechanism recently introduced to the Linux kernel. This mechanism is based on an algorithm, standardized in RFC 6056, for boosting security by better randomizing port selection. Our technique detects collisions in a hash function used in the said algorithm, based on sampling TCP source ports generated in an attacker-prescribed manner. These hash collisions depend solely on a per-device key, and thus the set of collisions forms a device ID that allows tracking devices across browsers, browser privacy modes, containers, and IPv4/IPv6 networks (including some VPNs). It can distinguish among devices with identical hardware and software, and lasts until the device restarts. We implemented this technique and then tested it using tracking servers in two different locations and with Linux devices on various networks. We also tested it on an Android device that we patched to introduce the new port selection algorithm. The tracking technique works in real-life conditions, and we report detailed findings about it, including its dwell time, scalability, and success rate in different network types. We worked with the Linux kernel team to mitigate the exploit, resulting in a security patch introduced in May 2022 to the Linux kernel, and we provide recommendations for better securing the port selection algorithm in the paper.
