Breaking Fraud and Bot Detection Solutions
summary
Vendor JavaScript snippets harvest browser and behavior signals (fonts, canvas, audio, plugins, mouse/keystroke timing) and send a fingerprint to cloud ML; many signals are forgeable or replayable. Demonstrated bypasses include stripping attack (removing injected JS), replay attack (resending a captured fingerprint), headless/browser-modification forging (custom WebKit or $400 anti‑detect tools), and MITM payload edits; empirical notes: 1.5M fingerprint dataset, one‑in‑24 font uniqueness, $800M industry exit.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 1:45Agenda
- 2:50Define the problem
- 8:05Deployment Model
- 11:31Inline Deployment Model
- 13:02Attacker Goal
- 14:08Browser Control
- 14:30Network Control
- 14:49Fundamental Issues
- 15:02Sensor
- 15:21Browser Fingerprint
- 21:01Browser Audio
- 21:59Normal Browser Data
- 23:36Browser Fingerprints
- 25:51Device accelerometer
- 27:06Antitamper
- 28:29payload
- 29:39no guarantees
- 30:06headless browsers
- 31:33stripping attack
- 33:26inline device
- 34:13replay attacks
- 35:05dynamic fingerprint
- 36:23dynamic random token
- 38:05Browser fingerprinting
- 39:05Fake browser fingerprints
- 40:27Canvas fingerprinting
- 41:00Safari source code
- 41:34Anti detect
- 42:25User behavior
- 42:58Authentication flows
- 44:46Finger Print
related talks
35mBreaking fraud & bot detection solutions
37mFraud prevention in the age of online privacy
43mBypassing Malware Detection Mechanisms in Online Banking
40mAn Analysis of the Fingerprinting-Scripts and their Actors on the Internet
40mHostile JavaScript: Attacking and Defending the Browser
14mBrowser Fingerprinting: Stalking With a Personal Touch
42mCracking the Code: Decoding Anti-Bot Systems!
52mFlying Under the Radar - New Security Evasion Techniques