I'm currently spending a significant amount of my time on fraud investigations at work. I've written some code which collates logs and transactional data then mashes it up to find patterns. It is accurately predicting the majority of the fraud. (I keep telling my boss I want to work on commission but so far I'm stuck with a salary). Although this is a huge leap forward from the position before I was involved, I'd like to reduce the remaining losses further.

My program relies heavily on IP addresses to identify individual client devices while the groups carrying out the fraud are mostly using mobile dongles or proxying via vulnerable webservers in an effort to obscure their identity. So I've been looking at alternative methods for identifying whom is at the far end of the wire.

(I should point out that in order to carry out a transaction on our system, the users must authenticate themselves therefore anonymity is not an issue for our legitimate users).

While evercookie looks to be ideal for our purposes, it's high profile means that our attackers may be specifically on the lookout for this - as well as the risk that it may be detected as malware by legitimate users with the right software. And despite the fact that our legitimate users have a thouroughly verified identity, I think
undermining the security of their computers to be a step too far. The methods described in the Panopticlick project seem to be a more appropriate so I've been looking at these in some detail.

Which User Agent?

The obvious starting point is the user-agent. From the data I have already, the common user-agent suggests that I can link transactions from different IP addresses. They do change over time. Google Chrome is particularly troublesome - it appears to upgrade itself on the fly - even mid-session! And of course most browsers have tools for easily switching the user-agent reported in Javascript and in HTTP requests.

The only people publishing stats regarding faked user agents are, not surprisingly, people developing code in this area - and their sites are more likely to be visitied by technically sophisticated users, deliberately trying to test out the detection. I think it's reasonable to surmise that faking of user agents in the wild is relatively rare - so if I can reliably detect a faked user agent, knowing what the real user agent is does not help significantly with generating a unique fingerprint. A further consideration, is that even were this possible, sending the real user-agent back serverside increases the visibility of the fingerprinting process to an attacker.

It's worth noting that the navigator object has other properties / methods indicating the identity of the browser. Notably
appCodeName
appName
appVersion
platform

With the user-agent switcher on Safari, navigator.userAgent and navigator.appVersion matches the selected user agent in the switcher, and this is what is sent in the request. appName and appCodeName are always Netscape and Mozilla resp. However navigator.platform always reports win32, regardless.

With a Firefox user agent switcher, all the properties were changed.

Pedro Laguna provides a method for detecting the browser type by using the text of javascript exception messages. I'd previously found such an approach to be very effective when fingprinting SMTP servers, so I was optimistic that this could be used to detect most instances of UA faking. However although it works up to a point, it can produce nasty security warnings in some browsers and I had trouble accurately detecting MSIE v6 and Google Chrome. YMMV.

Robert Accettura has a nice writeup of the detection implemented in jquery, Prototype and
Yui which parse the user agent string while Mootols uses feature detection. The Mootools implementation only differentiates between different suppliers of browsers - not between versions of browser from the same supplier.

A paper by Mowery, Bogonerif, Yilek and Shacham describes a methodology for identifying browsers based on the javascript execution characterisitics. However they don't publish the exact code they used for their fingerprinting. I'm also sceptical of how effective the resolution would be on a wide variety of client machines running other applications concurrently - and without access to their code it'd be a lot of effort to test myself.

The engimatic Norbert proposes variations in Javascript parsing metrics (via arguments.callee.toString().length ) - this led me to some more specific articles on the subject, notably those by Bojan Zdrnja on SANS (1)(2)

Again it differentiates between parsing engines families rather than individual versions. Using a test script I got the following values:
115 - Safari 3
116 - Firefox 10
187 - Chrome 5, MSIE 6

Another approach is to simply look at what functionality is exposed by the javascript API. In general, developers usually add features - they rarely get retired. However this seems to be a fairly effective approach for detecting specific versions of browsers. These pages
have some more details on feature detection.(3)(4)(5)


So based on my research I used feature detection as the primary driver for my user agent checker, but did have to fall back on the Javascript parsing metrics to apply Firefox specific tests. My script includes the parser check, screen size / depth, language as well as the availability of selected APIs to contribute to the fingerprint.

Fonts
Several of the published documents / code make reference to fonts supplied as a good indicator of variability. Most use Flash or Java to get a list of the fonts. Interestingly both seem to provide an unsorted list - so the ordering is determined by where they appear on the disk - adding more unique behaviour. Not having a development toolkit for either, meant I had limited scope for testing this myself - but I did come across some code written by Lalit Patel . Lalit renders a fixed string using a degrading font-selector using different degraded fonts - if the size of the rendered string is the same, then the system must have the prefered font available - neato!

Taking this one step further, if I have a list of fonts to check for, then I can build up a list of what's available. Of course if I look for, say, Arial on a MS Windows platform, Helvetica on MacOS or Vera on Linux it's not going to tell me very much - but on www.codestyle.org I found lists showing the less common fonts. While looking for the most common fonts doesn't add a lot of variability, looking for very rare fonts adds code with little yield - so I created a list of the fonts lying in between these extremes for my code.

Plugins
On Firefox and webkit based browsers, navigator.plugins provides names and versions of the browser plugins (Adobe Acrobat, Flash, Java etc). Iterating through this is simple. Although MSIE has a plugins property in navigator it is not populated. In order to get information about a plugin you need to create an instance of it. And there is no standard API in ActiveX objects to get version information.

Eric Gerds has written some code for getting information about common plugins, however he doesn't reveal much about his methods - and trying to reverse engineer the obfuscated javascript is a bit of a task.

On the builtfromsource blog (author does not seem to provide any identity information) there are examples of how to detect/get version information from some of the more common ActiveX plugins.

While the Timezone Offset is available to javascript (e.g. +0100) the actual time zone (e.g. Europe/London) contains a lot more information; but the latter is not available to Javascript. Phil Taylor reports that different Time zones with the same offset can have different dates on which daylight saving time is switched on. However his method does require a lot of computation on the browser - approx 15k date calculations. There is some scope for optimizing this though (e.g. only looking at last weeks of March and October).

Josh Fraser offers a rewritten script for detecting both the timezone offset and whether DST applies for the current TZ .

Does it work?
I've mentioned I did some testing: I wrote a script using feature detection, arguments.callee.toString().length, font detection and plugin detection (i.e. specifically not using the user Agent string) and ran it on some computers at work.

Where I work the computers are all installed from standard builds. So far, I've got 23 fingerprints from 24 (supposedly identical) machines - i.e. I've only got 2 machines returning the same fingerprint.

I was concerned that instantiating the activeX objects would have an impact on performance and/or be otherwise visible to the user. On my test script, creating instances of Acrobat, Flash, Realplayer and MSWindows Media Player took 2-3 seconds - so not terribly intrusive. In one case, the user got a warning message regarding Acrobat (he'd not previously accessed any PDF files since the system had been installed, the other plugins did not produce any visible warnings). The time taken for the remainder of the
javascript to run is negligible.

Where's my code? Sorry, don't want to make it too easy for the bad guys to see what I'm doing. If you follow the links I've provided you'll get the same functionality with just a little cuttig and pasting.

Data quality vendor not interested in data quality?

CIFAS should be all things to all people. They provide a platform for members to share data about fraudulent transactions - and provide ways of protecting individuals against identity theft. All wrapped in a not-for-profit organisation.

But dig below the surface and all is not as it seems.

Part of the facilities they provide is protective registration. This means that either at your request or the request of a CIFAS member, they will place a notice on you credit records saying that when a credit application is made in your name or from your address, then there should be additional checks on the identity of the party applying.

This helps with the big problem of identity fraud; regaining control of an identity and preventing further abuse.

However go and have a Google for them. There seems to be an awful lot of people out there who are not being protected - they are being prevented from obtaining credit due to a CIFAS listing. So at best, CIFAS have failed to communicate what their policy is to their members.

But suppose you find yourself unfairly blacklisted by CIFAS. How do you go about correcting this? Surely CIFAS, who generate income from providing accurate information would not only take an active interest in resolving individual cases, but would also seek to monitor the reputation of their members' recommendations? Indeed according to the Data Protection Registrar, that is what they are obliged to do, regardless of their business model.

However according to the CIFAS website, issues regarding innappropriate/innaccurate registrations must be directed to the member company and ”CIFAS will not become involved in a dispute until the CIFAS Member has issued a Final Response letter.”

UK Government website privacy abuse?

Anyone who knows me will not be surprised to hear that I think measuring user-experience and how users interact with your website is a very good idea. If you're in the business of trying to collect or analyse this information, then this post is addressed to you.

As I've often said, looking at the standard server-side logs can be very informative - but its only half the story. To get a better picture you need to go client-side. And that means Javascript. For many people / organisations, there just isn't the time or money to develop your own solution - and of course there are no end of vendors trying to flog their wares to you.

This post was prompted by a wasted hour investigating unusual patterns in referer stats. Where I work, phishing poses a very serious risk. Despite this, (and a large IT staff, dedicated security team. and an annual turnover well into the billions) there are no SPF records in our published DNS records! The referer stats for out customer facing website shows our logos appearing in lots of web-based email readers (including those from service providers who are known to validate SPF) - implying that it is more than just a risk. The is a shocking and absurd set of circumstances which I am still trying to resolve after 2 years.

However, that's not what this gripe is about.

This week I noticed a few referals from a very long URL starting with xxxxx.stcllctrs.com (where xxxxxx is the name of my employers parent organisation). The URL was not obviously an email reader. Dropping the URL into a browser returned a 200 response with no content. So I had a look at the root URL, http://xxxxx.stcllctrs.com/ Where I found the documentation for 'jsunpack' (http://jsunpack.jeek.org/dec/go) a tool 'designed for security researchers and computer professionals'. This is primarily a javascript code obfuscator. Interestingly, the URL for jsunpack seems to link to a form allowing people to report possible abuses of the tool - which has a record of its use at http://xxxxx.stcllctrs.com/ flagged as suspicious.

I then Googled for xxxxx.stcllctrs.com and found that our parents organisation had several references to this site, loading javascript files and NOSCRIPT content. Looking at the Javascript it was serving up, it was rather difficult to read (since it was obfuscated) but seemed to be doing strange things with cookies. The domain also apepars in several ad blocking lists. Alarm bells started ringing!

Of course my employers make up for the quality of the security policy with the quantity of it - so I couldn't do proper whois lookup - but looking at tools on the web - this turned out to be a 16 bit subnet owned by Savvis.net. The name is registered with viatel.com. So both the netblock and DNS registration are effectively anonymous.

Obfuscated code, unusual URLs, cookie manipulation, anonymous hosting, greyware listings - DING DING DING!!!

Most of the whois services available online are provided by companies trying to sell registration services- the one I used initially did not provide any information about the registrant (and reformatted the content significantly so it looked like viatel was the registrant). But I eventually found another site (in Romania of all places!) which gave the registrant contact - speed-trap.com limited. This proved to be the Rosetta stone to unravelling what was really going on.

Speed-Trap appear to be a legitimate organisation providing web-usage monitoring services to companies. Surprisingly, they have a number of very high profile customers including direct.gov.uk, RBS, Axa and others. Yet they behave online like a script-kiddy - obfuscating their identity as well as code deployed to run in my browser, leaving other peoples hacking code
on their own website.

DirectGov have a link to their privacy policy on each and every page in their site (for the benefit of those from the colonies - DirectGov is the single, open access portal spanning all central government services in the UK). They clearly state they use javascript and cookies to record and analyse your usage of the site. They do not state that this information is processed by a third party. Indeed they go to unusual lengths to suggest that this information would only be shared with other bodies in extreme circumstances. RBS and http://www.axa.co.uk/privacy take a similar tack.

http://www.direct.gov.uk/en/SiteInformation/DG_020456
http://www.rbs.co.uk/global/f/privacy.ashx
http://www.axa.co.uk/privacy

From https://www.dephormation.org.uk/
"Intercepting, monitoring, eavesdropping, tapping communications requires legal authority, or consent from both parties to the communication."

Although there are some differences to BTs Phorm rollout (in that case, it was clear that Phorm were using the information for other purposes than just usage analysis) I find it very worrying that the UK government and several large financial institutions should be misleading their customers (or citizens) like this.

Crappy code

I spend way too much time dealing with other peoples' crappy code. To that end, a very long time ago, I wrote a quick script that would help me navigate around a PHP source file in order to work out what it's supposed to, and what it actually does.

It generates a call graph of the functions and methods in a PHP file, example shown below.



It had been sitting, festering on my HD for a while, and I thought "Hey, maybe someone else might find this helpful" so I uploaded it to phpclasses.org

So blow me, not only do they find it useful - but they want me to support the damn thing too! And then I get nominated for an award! I had a quick look at the source code. OMG - it's a mess!

So a couple of late nights were spent cleaning it up until the API is at least usable.

You can get the (cleaned up, slightly) source code here

Keyboard not detected. Press F1 to continue

I don't moan all the time.

Once in a while someone goes out of their way to be helpful, or technology works the way it should or I find something which is useful / good value.

Today I bought a new keyboard.

Like many computer people I know, I've had the same PC for the last 15 years or so. In that time the motherboard has been replaced a few times, disk drives have come and gone, graphics cards and monitrs have been swapped. But the oldest component was an HP keyboard which has been putting in sterling service for the last 8 years.

So while I was in PCWorld/Curry's today, I picked up a Sandstrøm keyboard for £15. This has the nicest action of any keyborad around this price I'd seen, and has the added bonus that the keys have LED illumination.

The reason I was in Curry's was to pick up a simlarly branded HiFi for my daughter's birthday. Again which I thought good value.

Despite the scandinavian looking name, not surprisingly both are made in China, and although time will tell regarding the quality of the electronices, both seem to be reasonably solid construction.

I suspect that the manufacturer / importer / retailler are currently discounting heavily to establish the brand in the UK.

Getting all the keys to work on my home machine (currently still with Fedora 9 - a Linux distribution) was surprisingly easy (most of the extra weeks worked as soon as it was plugged in anyway).

It does have a somewhat compressed physical layout (the space bar is only 60mm) so I'm still hitting thEWRONG Kets some if the time but I@m sure that will pass/

Where can I get away from them

The internet is great - everyone has access

The internet is terrible - everyone has access

When I first started using online systems (some time before the arrival of the internet - but I'm not saying how long) people I met online always seemed so knowledgeable and helpful. As I progressed through my studies, and the internet became available I was getting at least as much out of newsgroups and mailing lists as I put in. But gradually the balance shifted - increasingly I saw people asking dumber and dumber questions. For a brief period Stack Overflow seemed to be the new hope, before it became as bad as anywhere else (although the rating system bolstering my ego still tends to outweigh my disappointment at the quality of the questions nevermind the "answers".

While I'd like to think I know what I'm talking about in the forums I participate in regularly, I don't think I'm any sort uber-guru (yeuch - what a horrible term) but primarily I go there to learn - and I'm not learning anymore.

Of course the same questions come up again and again:

• How do I make this pattern fit this problem?
• Do my Class Assignment for me
• The people I pay for support won't answer the phone any more so I'm posting my question here
• It's broken, I don't know why, but I expect you to fix it

Am I just getting too cynical in my old age? Maybe I'll take up nuclear physics as a hobby so I can go back to being a newbie and asking stupid questions on the internet myself.

C.

Little furry babies need adopted!

For those of you whom I've not met, my daughter breeds and shows rats. She's done very well winning several best in breed and couple best in show at national level.

The reason I mention this is that we also provide short-term fostering for rescue rats - and we're currently trying to find homes for 13 rescue rats. If you live in the West of Scotland, and are interested, please visit our site at www.ralstonrats.co.uk