Canvasblocker: Fingerprinting by detecting CanvasBlocker

[lawl]

PoC: https://jsfiddle.net/6ke4ycmb/

In case you don't want to click a link and execute my JS here's the code:

var canvas = document.createElement('canvas');
var ctx = canvas.getContext("2d");
var canvasBlocker=false;
try{
    ctx.getImageData(0,0,0,0);
}catch(err){
    try{
        console.log(err.name);
  }catch(err2){
    canvasBlocker=true;
  }
}
if(canvasBlocker){
    alert("Canvas blocker detected.");
}else{
    alert("No canvas blocker detected");
}

This reliably recognized if CanvasBlocker is in use in my tests. Thus providing another bit for fingerprinting :(

Not sure how exactly this can be fixed though, as I'm not familiar with Firefox Extensions.

[lawl]

Another one: https://jsfiddle.net/sy358ukc/

var canvas = document.createElement('canvas');
var ctx = canvas.getContext("2d");
if(ctx.__proto__.getImageData.length==0){
    alert("Canvas blocker detected.");
}else{
    alert("No canvas blocker detected");
}

[kkapsner]

Your first example is not working with the newest version of CanvasBlocker on my side. Which version are you using and what are your settings?

For the second one I created a bug three years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=1081385
Unfortunately I can not resolve this as it's a core bug.

[lawl]

I'm using 0.3.7-Release, which is the AMO version. Settings are default. Block mode is Fake Readout.

What the first thing should do, trip up your code, err is then an exception from your code:

TypeError: window.Array.from is not a function
Stack trace:
getImageData@resource://gre/modules/commonjs/toolkit/loader.js -> resource://canvasblocker-at-kkapsner-dot-de/lib/modifiedAPI.js:215:38
window.onload@https://fiddle.jshell.net/_display/:49:2

This is a problem because it should return the browsers exception. We then try to access err.name, but because it's from a different security context we can't. Thus we know the API has been tampered with.

When doing this in a browser without CanvasBlocker, the exception err is

DOMException [IndexSizeError: "Index or size is negative or greater than the allowed amount"
code: 1
nsresult: 0x80530001
location: https://fiddle.jshell.net/_display/:49]

And we can read err.name and get IndexSizeError, as expected.

In any case it should be made sure that exceptions in your code don't propagate to the website, because that allows detection if one can make your code barf.

[kkapsner]

Which Firefox version are you using?

[lawl]

Ah, its 45.8.0 ESR in a Debian VM I had laying around. I'll try to find something that works in recent firefox versions I guess.

[lawl]

Ok, got it: https://jsfiddle.net/su92se5r/

Same method, different vector.

var canvas = document.createElement('canvas');
var ctx = canvas.getContext("2d");
ctx.canvas.width=null;
var canvasBlocker=false;


try{
    ctx.getImageData(0,0,1,1);
}catch(err){
console.log(err);
    try{
        console.log(err.name);
  }catch(err2){
    canvasBlocker=true;
  }
}
if(canvasBlocker){
    alert("Canvas blocker detected.");
}else{
    alert("No canvas blocker detected");
}

Tested against Firefox 52.0.2 on Windows, fresh install of canvas blocker from AMO, default settings.
This makes your code barf and allows detection in the same way as post 1.

[kkapsner]

Hm... basically 45.7.0 ESR should be supported and it should also know the Array.from function (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/from).

But with 45.7.0 I'm able to reproduce the problem - I should change at AMO that this version is not supported any more. 52.0 ESR is already out so this should be no problem.

The new scenario is indeed a bug I can and will fix.

[lawl]

So sorry, I must be getting really annoying: https://jsfiddle.net/su92se5r/1/

var canvas = document.createElement('canvas');
var ctx = canvas.getContext("2d");
var canvasBlocker=false;

try{
    ctx.__proto__.getImageData.apply(undefined, [0,0,1,1]);
}catch(err){
console.log(err);
    try{
        console.log(err.name);
  }catch(err2){
    canvasBlocker=true;
  }
}
if(canvasBlocker){
    alert("Canvas blocker detected.");
}else{
    alert("No canvas blocker detected");
}

It's the last one for now though, I might poke it again in the future.

[kkapsner]

No reason to apologize.

[spodermenpls]

I created a bug three years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=1081385
Unfortunately I can not resolve this as it's a core bug.

@kkapsner What is taking them so long, didn't one guy say it would be a potential "beginner bug"? I saw you added new information, but it didn't even provoke a reaction. Do you think it would help if this bug got a couple more upvotes, to stir up its visibility a bit?

[kkapsner]

Some upvotes can't hurt. But I think all their ressources are blocked by the move to webExtensions. There are still APIs missing.

[kkapsner]

For completeness here my testing page: http://kkapsner.github.io/CanvasBlocker/test/detectionTest.html
Looks quite OK for me. The "known pixel value test 10" is quite hard to fix (maybe even impossible) due to the nature of faking the canvas content and the first one is the Firefox bug - so I will close this issue. You can reopen it, if you think it should stay open.

[spodermenpls]

@kkapsner CB stays undetected with the "known pixel value test 10" when setting the minimum faking size to at least 100 px.

[kkapsner]

Yes... but than a page could just use a 10px by 11px image. It's the concept behind it.

[spodermenpls]

For the second one I created a bug three years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=1081385
Unfortunately I can not resolve this as it's a core bug.

Good to see that someone put the bug report finally out of its misery.

[spodermenpls]

Looks better than ever with Firefox 59:

[kkapsner]

Finally got rid of the technical problems there. The picture will remain like that in the future.

[ghost]

When is known pixel value test 10: CB detected going to be fixed?
edit Ok, I just read @kkapsner post why he closed this issue.