通过Linux新的TCP源端口选择算法（扩展版）进行设备跟踪
Device Tracking via Linux's New TCP Source Port Selection Algorithm (Extended Version)
摘要：
我们描述了一个跟踪技术的Linux设备，利用一个新的TCP源端口生成机制，最近引入到Linux内核。这种机制基于RFC 6056中标准化的算法，通过更好地随机化端口选择来提高安全性。我们的技术检测在所述算法中使用的哈希函数中的冲突，基于在攻击者规定的方式产生的采样TCP源端口。这些哈希冲突仅取决于每个设备的密钥，因此冲突集形成了一个设备ID，允许跨浏览器、浏览器隐私模式、容器和IPv4/IPv6网络（包括一些VPN）跟踪设备。它可以区分具有相同硬件和软件的设备，并持续到设备重新启动。我们实现了这项技术，然后使用两个不同位置的跟踪服务器和各种网络上的Linux设备对其进行了测试。我们还在一个Android设备上进行了测试，我们打了补丁以引入新的端口选择算法。跟踪技术在现实生活中的条件下工作，我们报告了有关它的详细调查结果，包括它的停留时间，可扩展性和在不同网络类型中的成功率。我们与Linux内核团队合作，以减轻漏洞利用，从而在2022年5月向Linux内核引入了一个安全补丁，我们在论文中提供了更好地保护端口选择算法的建议。
英文摘要：
We describe a tracking technique for Linux devices, exploiting a new TCP source port generation mechanism recently introduced to the Linux kernel. This mechanism is based on an algorithm, standardized in RFC 6056, for boosting security by better randomizing port selection. Our technique detects collisions in a hash function used in the said algorithm, based on sampling TCP source ports generated in an attacker-prescribed manner. These hash collisions depend solely on a per-device key, and thus the set of collisions forms a device ID that allows tracking devices across browsers, browser privacy modes, containers, and IPv4/IPv6 networks (including some VPNs). It can distinguish among devices with identical hardware and software, and lasts until the device restarts. We implemented this technique and then tested it using tracking servers in two different locations and with Linux devices on various networks. We also tested it on an Android device that we patched to introduce the new port selection algorithm. The tracking technique works in real-life conditions, and we report detailed findings about it, including its dwell time, scalability, and success rate in different network types. We worked with the Linux kernel team to mitigate the exploit, resulting in a security patch introduced in May 2022 to the Linux kernel, and we provide recommendations for better securing the port selection algorithm in the paper.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
