DRAWNAPART: A Device Identification and Spoofing Detection Technique Based on Remote GPU Fingerprinting | Oren Lab - Implementation Security and Side-Channel Attacks

DRAWNAPART: A Device Identification and Spoofing Detection Technique Based on Remote GPU Fingerprinting

Authors:

Tomer Laor

Naif Mehanna

Vitaly Dyadyuk

Antonin Durey

Pierre Laperdrix

Clémentine Maurice

Yossi Oren

Romain Rouvoy

Walter Rudametkin

Yuval Yarom

Appeared in: ACM Transactions on Privacy and Security, 2026 (to appear)

Abstract

Browser fingerprinting aims to identify users or their devices, through scripts that execute in the users’ browser and collect information on software or hardware characteristics. It is used to track users or as an additional means of identification to improve security. Fingerprinting techniques have one significant limitation: they are unable to track individual users for an extended duration. This happens because browser fingerprints evolve over time, and these evolutions ultimately cause a fingerprint to be confused with those from other devices sharing similar hardware and software.

Our technique, DrawnApart, advances the field of browser fingerprinting in three significant ways. First, it is the pioneering work that investigates and exploits manufacturing variances in identical GPUs in the context of privacy protection. Second, it provides a robust method for differentiating between devices with identical hardware and software configurations, achieving practical accuracy improvements in real-world scenarios. In a setting with diverse hardware and software configurations, DrawnApart is most effective when combined with traditional fingerprinting techniques such as FP-Stalker. Third, DrawnApart introduces a capability to verify the GPU renderer string, enabling the detection of spoofing attempts aimed at bypassing two-factor authentication by mimicking the victim’s device attributes.

This is an extended journal version of work originally published in NDSS 2022.

Download links

Draft version

Official version

Artifact Repository