The OPSEC Problem With JavaScript: Fingerprinting, Exploits & Browser Security

JavaScript 的 OPSEC 问题：指纹识别、漏洞利用与浏览器安全

When I started reading about Dark-Web OPSEC, one of the things that caught my attention was how seriously experienced users treat JavaScript. I first came across this subject through a well-known Dark-Web wiki covering anonymity and operational security. The idea was simple: when visiting an untrusted website, every additional browser capability increases the amount of software and functionality involved in processing that page. JavaScript sits close to the centre of that problem. A website can send executable code to the browser, and the browser can give that code access to a large collection of APIs. For ordinary web development, this is essential. From a cybersecurity and OPSEC perspective, every exposed capability deserves attention.

当我开始研究暗网（Dark-Web）的 OPSEC（操作安全）时，引起我注意的一点是，经验丰富的用户对 JavaScript 的重视程度。我最初是通过一个涵盖匿名性和操作安全的知名暗网维基了解到这个主题的。其核心理念很简单：在访问不受信任的网站时，浏览器每增加一项功能，处理该页面所涉及的软件和功能量就会增加。JavaScript 正处于这个问题的核心。网站可以向浏览器发送可执行代码，而浏览器则会赋予这些代码访问大量 API 的权限。对于普通的网页开发来说，这是必不可少的；但从网络安全和 OPSEC 的角度来看，每一个暴露的功能都值得警惕。

JavaScript Means Code Execution

JavaScript 意味着代码执行

Opening a website involves much more than downloading HTML. The browser parses the page, loads resources, executes scripts, communicates with servers, processes media, renders graphics, and maintains application state. JavaScript allows a website to actively interact with much of this environment. Depending on the browser and its security restrictions, JavaScript can interact with APIs involving the DOM, storage, networking, graphics, timing, media, browser capabilities, and other functionality. Browser security boundaries prevent ordinary website code from simply reading arbitrary files or executing shell commands. The available environment is still substantial. That creates two important security questions: What information can the website learn about my environment? What parts of the browser are being exercised by code I do not control? Both are relevant to OPSEC.

打开一个网站不仅仅是下载 HTML。浏览器需要解析页面、加载资源、执行脚本、与服务器通信、处理媒体、渲染图形并维护应用程序状态。JavaScript 允许网站主动与这一环境中的大部分内容进行交互。根据浏览器及其安全限制的不同，JavaScript 可以与涉及 DOM、存储、网络、图形、计时、媒体、浏览器功能及其他功能的 API 进行交互。浏览器的安全边界虽然阻止了普通网站代码随意读取任意文件或执行 shell 命令，但其可用的环境依然非常庞大。这引发了两个重要的安全问题：网站能获取关于我环境的哪些信息？我无法控制的代码正在调用浏览器的哪些部分？这两者都与 OPSEC 息息相关。

V8, SpiderMonkey and JavaScriptCore

V8、SpiderMonkey 和 JavaScriptCore

Modern browsers use dedicated JavaScript engines. Chrome and Chromium-based browsers use V8. Firefox uses SpiderMonkey, while Safari uses JavaScriptCore. These are large software projects containing parsers, interpreters, optimisers, JIT compilers, memory-management systems, and many other components. That complexity matters when looking at browser exploitation. A website can supply JavaScript to the engine remotely. The engine has to parse that code, execute it, optimise it, and interact with the rest of the browser. A vulnerability somewhere in this process can become significant when the attacker controls the input.

现代浏览器使用专用的 JavaScript 引擎。Chrome 和基于 Chromium 的浏览器使用 V8；Firefox 使用 SpiderMonkey；而 Safari 使用 JavaScriptCore。这些都是庞大的软件项目，包含解析器、解释器、优化器、JIT 编译器、内存管理系统以及许多其他组件。在研究浏览器漏洞利用时，这种复杂性至关重要。网站可以远程向引擎提供 JavaScript 代码，引擎必须解析、执行、优化该代码，并与浏览器的其余部分进行交互。当攻击者控制了输入时，此过程中的任何漏洞都可能变得非常严重。

JIT and Browser Exploitation

JIT 与浏览器漏洞利用

JIT means Just-In-Time compilation. JavaScript engines can identify code that runs frequently and compile it into native machine code. This provides substantial performance improvements for complex web applications. Security researchers pay close attention to JIT compilers because optimisation involves complicated assumptions about program behaviour. Browser vulnerabilities have historically involved areas such as: Type confusion, Use-after-free, Out-of-bounds access, Memory corruption, JIT optimisation errors, Incorrect type assumptions, Integer-related bugs. A suitable vulnerability can turn malicious web content into the first stage of an exploit. A browser exploit may then involve additional vulnerabilities to move from limited code execution towards more useful access. Sandbox escapes and privilege boundaries become particularly important at this stage. Modern browsers use sandboxing, process isolation, privilege separation, exploit mitigations, and other security mechanisms to make these chains considerably harder. For a cybersecurity student, browser exploitation is interesting because the initial attack surface can be reached simply by loading a webpage.

JIT 指的是“即时编译”（Just-In-Time compilation）。JavaScript 引擎可以识别频繁运行的代码并将其编译为原生机器码，这为复杂的 Web 应用程序提供了显著的性能提升。安全研究人员非常关注 JIT 编译器，因为优化过程涉及对程序行为的复杂假设。浏览器漏洞在历史上常涉及以下领域：类型混淆、释放后使用（Use-after-free）、越界访问、内存损坏、JIT 优化错误、错误的类型假设以及整数相关漏洞。一个合适的漏洞可以将恶意网页内容转化为漏洞利用的第一阶段。浏览器漏洞利用随后可能涉及额外的漏洞，以从有限的代码执行转向更有用的访问权限。在此阶段，沙箱逃逸和权限边界变得尤为重要。现代浏览器使用沙箱、进程隔离、权限分离、漏洞利用缓解措施和其他安全机制，使得这些攻击链变得极其困难。对于网络安全学生来说，浏览器漏洞利用之所以有趣，是因为只需加载一个网页就能触及初始攻击面。

The Browser Is a Large Attack Surface

浏览器是一个巨大的攻击面

The JavaScript engine is only one component of a browser. A modern browser contains code for: HTML parsing, CSS processing, JavaScript execution, Image decoding, Audio and video, Fonts, Networking, Graphics, WebAssembly, Storage, Inter-process communication, Sandboxing, GPU interaction. A malicious website can cause many of these components to process attacker-controlled data. That makes browsers attractive targets for vulnerability research. JavaScript becomes especially relevant because it gives websites a programmable interface to many browser features.

JavaScript 引擎只是浏览器的一个组件。现代浏览器包含用于以下功能的代码：HTML 解析、CSS 处理、JavaScript 执行、图像解码、音频和视频、字体、网络、图形、WebAssembly、存储、进程间通信、沙箱以及 GPU 交互。恶意网站可以诱导其中许多组件处理攻击者控制的数据，这使得浏览器成为漏洞研究的诱人目标。JavaScript 变得尤为重要，因为它为网站提供了许多浏览器功能的可编程接口。

Fingerprinting

指纹识别

Exploitation is only one side of the OPSEC problem. The other involves information leakage. JavaScript allows websites to inspect a wide range of browser characteristics. Depending on the browser and its privacy protections, these can include: Browser capabilities, Screen dimensions, Device pixel ratio, Language, Timezone, Canvas behaviour, WebGL characteristics, Audio behaviour, Hardware-related signals, Performance characteristics, Supported APIs. One individual value rarely identifies someone. The interesting part is the combination. A browser exposing a particular collection of characteristics may become sufficiently distinctive for a website to recognise it when similar characteristics appear again. That is the basic idea behind browser fingerprinting.

漏洞利用只是 OPSEC 问题的一方面，另一方面涉及信息泄露。JavaScript 允许网站检查广泛的浏览器特征。根据浏览器及其隐私保护措施的不同，这些特征可能包括：浏览器功能、屏幕尺寸、设备像素比、语言、时区、Canvas 行为、WebGL 特性、音频行为、硬件相关信号、性能特征以及支持的 API。单一数值很少能识别出某人，有趣的是它们的组合。一个暴露了特定特征集合的浏览器，可能会变得足够独特，以至于当类似的特征再次出现时，网站能够识别出它。这就是浏览器指纹识别背后的基本理念。

Why Fingerprinting Matters

为什么指纹识别很重要

Suppose someone successfully hides their network address. The website can still observe the browser. If that browser has a sufficiently distinctive fingerprint, the website may be able to recognise returning sessions even when the network-level address changes. This creates a correlation problem. OPSEC failures often come from connecting several individually weak signals. A browser fingerprint can become one more signal connecting separate activities.

假设某人成功隐藏了自己的网络地址，网站仍然可以观察到其浏览器。如果该浏览器具有足够独特的指纹，即使网络层地址发生变化，网站也可能识别出返回的会话。这产生了一个关联性问题。OPSEC 的失败往往源于将几个单独来看很弱的信号连接起来。浏览器指纹可以成为连接不同活动的又一个信号。

Canvas Fingerprinting

Canvas 指纹识别

Canvas fingerprinting is a well-known example. A website can ask the browser to render specific graphics using the Canvas API. Differences in rendering behaviour can arise from the browser, operating system, graphics stack, fonts, hardware, and other parts of the environment. The resulting characteristics can contribute to a fingerprint. Canvas alone does not provide a permanent identity. Its usefulness comes from combining it with other signals. This distinction matters when evaluating browser fingerprinting claims. A fingerprint is better understood as a correlation signal than as a guaranteed identity.

Canvas 指纹识别是一个众所周知的例子。网站可以要求浏览器使用 Canvas API 渲染特定的图形。渲染行为的差异可能源于浏览器、操作系统、图形堆栈、字体、硬件以及环境的其他部分。由此产生的特征可以构成指纹的一部分。Canvas 本身并不能提供永久的身份标识，它的效用来自于与其他信号的结合。在评估浏览器指纹识别的说法时，这种区别很重要。指纹被理解为一种关联信号，而不是一种确定的身份标识。