Device Tracking via Linux's New TCP Source Port Selection Algorithm (Extended Version)
Moshe Kol, Amit Klein, Yossi Gilad

TL;DR
This paper presents a novel device tracking method exploiting a Linux TCP port selection algorithm, demonstrating its effectiveness across various networks and proposing security improvements after discovering vulnerabilities.
Contribution
We introduce a new tracking technique based on detecting hash collisions in Linux's TCP port selection algorithm, revealing a security flaw and suggesting mitigations.
Findings
Effective device tracking across networks and privacy modes
High success rate and long dwell time in real-world tests
Security patch introduced to mitigate the vulnerability
Abstract
We describe a tracking technique for Linux devices, exploiting a new TCP source port generation mechanism recently introduced to the Linux kernel. This mechanism is based on an algorithm, standardized in RFC 6056, for boosting security by better randomizing port selection. Our technique detects collisions in a hash function used in the said algorithm, based on sampling TCP source ports generated in an attacker-prescribed manner. These hash collisions depend solely on a per-device key, and thus the set of collisions forms a device ID that allows tracking devices across browsers, browser privacy modes, containers, and IPv4/IPv6 networks (including some VPNs). It can distinguish among devices with identical hardware and software, and lasts until the device restarts. We implemented this technique and then tested it using tracking servers in two different locations and with Linux devices…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsInternet Traffic Analysis and Secure E-voting · Network Security and Intrusion Detection · Advanced Malware Detection Techniques
