We have seen everything in recent years to promote a simple act that at the same time and depending on what situations could be criminal: monitoring and tracking of users or PCs. Well, as if it were science fiction and in the purest Mission style Impossible A group of researchers has found a method to use the GPU or iGPU of your PC and turn it into a unique fingerprint that would leave a specific trace on the Internet, so that they can know what you do, when you do it and how you do it, whatever activity it is. That’s how it is DrawnApart.
No less than 2,550 devices with a whopping 1,605 different CPU configurations (with their corresponding iGPUs) have left some chilling data in terms of tracking and security. A technique that has been developed by a team of researchers from French, Australian and Israeli universities that allows you to track your PC with an improved average duration of 67%.
DrawnApart: This is how your PC creates a fingerprint with the GPU
When you enter a website by law you have to skip a floating or fixed notice about the famous cookies, where we have to give our consent (or not) to be able to enter said website or see part of the content. Each one manages it in a different way, but you always have to ask for permission, although this is really just a legal cover that leaves a lot of room for maneuver to the most rogue.
A website can collect even your time zone or OS version, not to mention language and a thousand other things, but once you leave said website the tracking ends, at least in theory.
What would happen if you didn’t need to enter a website to be able to track a PC? It would certainly be a problem, but what if it also did it faster and better than traditional systems where you can’t escape tracking while you’re on the Internet? Which is very scary.
Well, the research of these three universities focused on those margins and the result is the creation of a distinctive fingerprint that is based on what your iGPU or GPU does and how it does it, always within the Internet.
WebGL is the key, real threat or just test?
The system is tracked by the GPU thanks to WebGL, an Internet graphics library that all browsers have, so it is impossible to escape the registry if we look for something in the cloud. DrawnApart use this to use GLSL programs executed by the graphics card and based on the calculations it has to do, a workload pattern is generated that is predictable and standardized for a specific PC, being more specific for a specific GPU.
Two working modes determine the fingerprint of the graphics card: non-intensive and brief versus a more relaxed and elongated one in time. With this they generate 176 measurements taken from 16 points, which gives a pattern (like the one shown below) where at first glance and taking into account that they are the same graph model, they offer different and unique results.
In addition, the patterns are not affected by restarts, tabs in the browser or different changes, the tracking will continue no matter what happens and thanks to the use of GPU and not CPU as such it extends from 17.5 days to 28 days, which allows us to extract so much information and patterns that makes our GPU unique, being able to follow it anywhere on the Internet without doubting who it is.
But if this doesn’t sound alarming to you, with WebGL 2.0 (now deprecated) it was discovered that DrawnApart achieved a GPU rating accuracy of 98% in just 150 ms, that is, in less than the time it takes to blink, they already know where our graphics card is and with it our PC throughout the Internet .
The investigation is already in the hands of the Khronos group, developers of WebGL, since even if we change PCs, change any component or software, the graphics card will be tracked almost immediately. In short, an attacker with DrawnApart would have a full trace without us being able to do anything, at least until the API is changed.
