Remote physical device fingerprinting

By Tadayoshi Kohno, Andre Broido, K. Claffy. IEEE Symposium on Security and Privacy, 2005

850 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems

View Paper: https://www.semanticscholar.org/paper/82e05185d047091200a71bc6fad275e3d1eb1e98

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

Citations in the corpus

Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware (2008, background): “[21] as a convert channel to reveal a target host’s physical clock skew, which uniquely identifies a physical machine.”
Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic (2017, methodology): “Network traffic metadata has also been used to perform user and device fingerprinting by a variety of techniques, including correlating IP ID header fields [9], clock skews from the TCP timestamp option [24], and hidden Markov models trained on Netflow data [41].”
A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic (2017, background): “Identifying and counting distinct clients behind a NAT is a known problem [2, 6].”
Implications of radio fingerprinting on the security of sensor networks (2007, methodology): “Kohno, Broido and Claffy [26] use a feature of the TCP or ICMP protocol 2 to estimate the clock skew of a particular device and are able to create fingerprints based on that.”
On Fast and Accurate Detection of Unauthorized Wireless Access Points Using Clock Skews (2008, methodology): “This fake AP is used to fool a wireless node in the WLAN into accessing the network through the fake AP instead of the authorized one.”
How Unique Is Your Web Browser? (2010, background): “Cameras [1,2], typewriters [3], and quartz crystal clocks [4,5] are among the devices that can be ? Thanks to my colleagues at EFF for their help with many aspects of this project, especially Seth Schoen, Tim Jones, Hugh D’Andrade, Chris Controllini, Stu Matthews, Rebecca Jeschke and Cindy Cohn; to ”
A Review of Radio Frequency Fingerprinting Techniques (2020, methodology): “The effectiveness of this technique has been shown in [67] for complex networks.”
Using the physical layer for wireless authentication in time-variant channels (2008, background): “For more general networks, the clock skew characteristic of devices has been viewed as a remote fingerprint of devices over the Internet [12].”
Fingerprinting Electronic Control Units for Vehicle Intrusion Detection (2016, methodology): “Our experiments on a CAN bus prototype and on real vehicles have shown CIDS to be able to detect a wide range of in-vehicle network attacks.”
No NAT'd User Left Behind: Fingerprinting Users behind NAT from NetFlow Records Alone (2014, methodology): “Microscopic deviations in hardware components, such as the clock skews, were used in [17] to fingerprint computer devices.”
AccelPrint: Imperfections of Accelerometers Make Smartphones Trackable (2014, background): “Inspired by past work on device fingerprinting [37], [57], [64], where WiFi chipsets were shown to exhibit unique clock skews and frequency offsets, we ask the question: could sensors in today's smartphones also have unique fingerprints?”
IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT (2016, background): “specific characteristics such as clock skew [23] or radiofrequency signature [24] can be used to identify a unique network interface card, mostly for rogue wireless Access Point”
Virtual trip lines for distributed privacy-preserving traffic monitoring (2008, methodology): “They exploit unique parts of the GPS traces, analogues to hardware and software fingerprinting approaches to identify computer systems [43].”
FPDetective: dusting the web for fingerprinters (2013, background): “Predating fingerprinting at the browser-level, researchers had shown that it is possible to not only remotely learn the operating system of a particular host on the Internet [1, 25], but also to fingerprint multiple physical devices hidden behind NATs through their clockskew, by analyzing the TCP ti”
Participatory Sensing (2019, methodology): “To combat emerging techniques for remote device fingerprinting based on measurements of timestamp drift [12] and localization using latency measurements [13], mediating nodes might add random jitter to packets.”
Embedding Covert Channels into TCP/IP (2005, methodology): “This test and the following one can also be used to estimate clock skew between Alice and the warden and hence identify the physical device without the use of TCP timestamps [20].”
Passive Data Link Layer 802.11 Wireless Device Driver Fingerprinting (2006, methodology): “A technique presented in [22] uses slight drifts in a device’s TCP option clock to identify a network device over the Internet via its unique clock skew.”
DÏoT: A Federated Self-learning Anomaly Detection System for IoT (2018, methodology): “MAC address spoofing can be mitigated using additional techniques for fingerprinting hardware interfaces on wireless [14], [17] and on wired connections [36].”