Digital Fingerprinting

Introduction

Problem Statement:

While engaged in a fintech project, we encountered a challenge involving an influx of fraudulent transactions from clients utilizing the same order ID or reference. Delving into the logs, we scrutinized the vulnerability’s root causes. We identified several issues and promptly addressed them. Additionally, we devised a solution: implementing a system to flag devices exhibiting suspicious behavior, thereby mitigating the risk associated with transactions originating from such devices. Below, we explore the concept of digital fingerprinting in greater detail.

Section 1: Introduction:

First of all let’s understand what digital fingerprinting is, it’s a technique used to uniquely identify & track an individual’s online device. It involves gathering various information about a user’s device, such as browser type, operating system, and plugins, to create a unique identifier hash identity. This identifier, or digital fingerprint, can then be used to track users across different websites and detect suspicious or fraudulent activities. Digital fingerprinting plays a crucial role in online security and privacy protection. 

Section 2: Why it’s required

Digital fingerprinting is used for enhancing online security, preventing fraud, and tracking user behavior across different platforms. It allows websites and online services to uniquely identify and authenticate users based on their device characteristics. Additionally, digital fingerprinting helps detect suspicious activities, protect against identity theft, and personalize user experiences. It’s an important tool in ensuring online safety and privacy.

Section 3: Here is some benefits & functionalities provides by digital fingerprinting:

• Enhanced security:
  • Digital fingerprinting helps in identifying and authenticating users, reducing the risk of unauthorized access and identity theft.
• Fraud prevention:
  • By tracking and analyzing user behavior, digital fingerprinting can detect and prevent fraudulent activities such as account takeovers and fake registrations.
• Personalization:
  • Digital fingerprints allow for personalized user experiences by identifying returning users and tailoring content and recommendations based on their preferences.
• Behavioral tracking:
  • Digital fingerprinting enables the tracking of user behavior across different platforms and websites, providing valuable insights for marketing and analytics purposes.
• Device recognition:
  • It helps in identifying and distinguishing between different devices used by a user, allowing for cross-device tracking and consistent user experiences.
• Anti-bot measures:
  • Digital fingerprinting can be used to detect and block automated bots and malicious activities, safeguarding online platforms and services.

Section 4: FingerprintJS a popular JavaScript for browser fingerprinting

Fingerprint.js collects various information about a user’s browser and device, such as user agent, screen resolution, installed plugins, type of browser client using, checks if active tab is incognito and many more, to create a unique identifier or fingerprint. This fingerprint can be used for tracking and identifying users across different websites and sessions. Fingerprint.js provides an easy-to-use API for collecting and generating fingerprints in JavaScript. It’s commonly used for security, analytics, and personalization purposes.

Conclusion:

So conclusion is like, initially we marks some points as per the researched thats needs to address first like:

1. Client Side Encryption (CSE) of sensitive data, it’s quite required. As we identified, the approach is used by intruders. (regardless of channel security with TLS 2.0 or PCI DSS enabled etc).
2. Rate-limiting,limit the requests based on IP’s from where malicious request is initiated, set maximum requests per time frame (for example allow 100 request per 5 mins)
3. Take a close look at the header – req.headers[‘x-forwarded-for’]`: Contains the client IP but still it can be spoofed, so there are chances of a spoof but we still we can create summary of IP’s from where requests in being initiated, (for example IP address range, IP pool etc)
4. Digital Fingerprinting: As we identified that ‘FingerprintJS’ is the best option for browser fingerprint but after a range of requests we need to opt for membership to feed a large number of requests, so we made our own browser fingerprinting script.

Here is some closing thoughts:

So for tightly coupled security we need to combine multiple security parameters & need to use Web application Firewall (WAF) It’s like a cherry on a cake, it prevents & provides lots of security parameters.