Modern antifraud systems use a variety of methods to identify users. One of the key technologies is network fingerprinting, which allows recognizing devices and their characteristics at the network connection level. This approach includes tools such as p0f, JA3, JA4, JARM, and analysis of TLS/SSL connection parameters. #### History of the creation and purpose of network fingerprints ###### p0f The p0f tool was created to passively analyze network traffic and identify operating systems, configurations, and device characteristics without active communication. Its use began in the field of network diagnostics, but later it was applied to anti-fraud systems. ###### JA3 and JA4 These methods emerged with the purpose of analyzing TLS/SSL connections. JA3 generates a hash from the parameters of a client Hello TLS message, while JA4 generates a hash from a server Hello message. This allows unique fingerprints to be created for clients and servers, identifying devices and programs. ###### Network fingerprints as a tool in anti-fraud systems Network fingerprints are used to: - Identifying devices through analysis of their network behavior. - Identifying suspicious or unusual network traffic. - Recognizing bots and anti-detect browsers that use cloaking. - Detecting malicious servers through active and passive analysis techniques. ###### Key network connection parameters for fingerprinting **TCP/IP Headers** - Window Size. - Flag Sequence. - TTL (Time to Live). **TLS/SSL parameters** - Supported Cipher Suites. - Extensions and their order. - Protocol Version. ###### Network fingerprint parameters **1. Transport Layer Security (TLS) Parameters ** **Versions of TLS:** - Record version: TLS 1.0 (769). - Handshake Version: TLS 1.2 (771). - Harmonized version: TLS 1.3 (772). **Cipher Suites:** The client supports multiple cipher suites including: - TLS_AES_128_GCM_SHA256 (4865). - TLS_AES_256_GCM_SHA384 (4866). - TLS_CHACHA20_POLY1305_SHA256 (4867). - Various ciphers based on ECDHE and RSA. **2. Fingerprinting methods** ** - JA3 fingerprint:** ◦ Hash: dcc69aae7a9e90b98e2f45cefce8d0ab. ◦ Format: TLS version, cipher suites, extensions, elliptic curves, elliptic curve formats. ◦ Used to identify TLS clients based on the characteristics of their welcome message. ** - JA3N fingerprint:** ◦ Hash: dee19b855b658c6aa0f575eda252525e19. ◦ Similar to JA3, but normalized to remove GREASE values. ** - Footprint of JA4:** ◦ Value: t13d1516h2_8daaf6152771_02713d6af862. ◦ Includes the TLS version and other connection parameters. #### Examples of analyzing p0f, JA3, JA4 fingerprints ###### Analyzing p0f An example of using p0f to determine the OS: Consider the p0f fingerprint of a Windows computer connected by wire to a router with internet from an ISP. Let's open the page p0ftest.tanatos.org - mod: “syn” cli: “188.226.xxx.xxx.xxx/26860” srv: “167.172.59.39/443” subj: “cli” os: “Windows NT kernel” dist: “15” params: “generic” raw_sig: “4:113+15:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0” - mod: “mtu” cli: “188.226.xxx.xxx/26860” srv: “167.172.59.39/443” subj: “cli” link: “Ethernet or modem” raw_mtu: “1500” As a result of the test we see the following characteristic for the Windows operating system: TCP options order (mss,nop,ws,nop,nop,sok), multiplier (mss*44,8) and TCP Window Size (113+15), based on this data the site concludes that we are using os: “Windows NT kernel”. Size The values mss 1460 (Maximum TCP data size without headers) and mtu 1500 (Maximum packet size)? are related parameters that define packet sizes on the network and indicate the use of “Ethernet or modem” Let's repeat the test on a mobile device connected via Wi-Fi to the router - mod: “syn” cli: “188.226.xxx.xxx.xxx/60496” srv: “167.172.59.39/443” subj: “cli” os: “Linux 2.2.x-3.x” dist: “15” params: “generic” raw_sig: “4:49+15:0:1460:65535,10:mss,sok,ts,nop,ws:df,id+:0” - mod: “mtu” cli: “188.226.xxx.xxx.xxx/60496” srv: “167.172.59.39/443” subj: “cli” link: “Ethernet or modem” raw_mtu: “1500” - mod: “uptime” cli: “188.226.xxx.xxx.xxx/60496” srv: “167.172.59.39/443” subj: “cli” uptime: “25 days 14 hrs 22 min (modulo 49 days)” raw_freq: “1000.03 Hz”. In this test the device was identified as os: “Linux 2.2.x-3.x” by a number of features: TCP options order (mss,sok,ts,nop,ws), TCP Window Size value (49+15). Also, the fingerprint contains information about the time the device has been in the network uptime: “25 days 14 hrs 22 min (modulo 49 days)” Let's check the P0f fingerprint on android mobile device with 4G - mod: “syn” cli: “176.15.252.192/41378 srv: “167.172.59.39/443” subj: “cli” os: “Linux 2.2.x-3.x” dist: “14” params: “generic” raw_sig: “4:50+14:0:1408:65535,10:mss,sok,ts,nop,ws:df,id+:0” - mod: “mtu” cli: “176.15.252.192/41378” srv: “167.172.59.39/443” subj: “cli” link: “????” raw_mtu: “1448” - mod: “uptime” cli: “176.15.252.192/41378” srv: “167.172.59.39/443” subj: “cli” uptime: “32 days 13 hrs 29 min (modulo 49 days)” raw_freq: “989.80 Hz”. The distinctive feature in this example is the packet sizes mss 1408 and mtu 1448. Let's run the test in an anti-detect browser with a mobile fingerprint using a proxy purchased from one of the services  In this example, we get a p0f fingerprint corresponding to a desktop device, but try to impersonate a mobile device. Such inconsistencies will be treated as suspicious by anti-fraud systems. Also in this example the values of mss 1360 and mtu 1400 correspond to OpenVPN packet sizes and differ from the majority of mobile operators' values. Let's repeat the test in the anti-detect browser with another proxy  The results of the test with the provided proxy are completely consistent with the test results on a real mobile device. ###### UDP (User Datagram Protocol) in anti-fraud systems. UDP (User Datagram Protocol) is a transport protocol working on top of IP (Internet Protocol). It is designed for fast and simplified data transfer without establishing a connection and without guaranteeing delivery. Nowadays antifraud systems often establish connection with the client via UDP, this method helps to determine the real ip-address of the client and detect the use of proxies that either do not process udp-packets and pass them directly to the addressee, revealing the real ip-address, or block udp-packets, which indicates the use of masking the real ip-address. Let's test UDP support by opening the networktest.twilio.com page on the computer.  Let's repeat the test on a 4G mobile device  Both real devices pass the UDP connection tests successfully. Let's run the test in an anti-detect browser using the first proxy  This proxy blocks UDP connections. Let's check our second proxy in an anti-detect browser  This kind of proxy establishes and maintains UDP connections and successfully passes the checks. ###### JA3 fingerprint The JA3 fingerprint is formed from the values: TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurvePointFormats Example: 769,47–53–5–10–49161–49162–49171–49172–50–56–19–4,0–10–11,23–24–25,0 You can read more about how JA3/JA3S fingerprinting is formed and works in this article engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967 Let's see what JA3 fingerprinting looks like using the Chrome and Firefox browsers as examples. Let's open the tls.peet.ws/api/all page on a computer in the Firefox browser  771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0 Refreshing the page, we have the following JA3 footprint  771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-18-13-43-35-11-10-5-0-65281-65037-16-27-51-17513-41,4588-29-23-24,0 Comparing the prints obtained from the same device in the Firefox browser, we see a slight difference in the Extensions values. Let's open the test page in Chrome browser on our computer and get the result of the JA3 fingerprint 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-13-35-0-5-18-65037-16-43-45-10-65281-17513-27-23-41,4588-29-23-24,0 Let's refresh the page in the Chrome browser and look at the JA3 footprint 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-10-27-13-18-65281-65037-45-16-5-23-43-0-11-17513-41,4588-29-23-24,0 We can notice that in order to protect against getting the JA3 fingerprint, the Chrome browser changes the order of the Extensions values. Let's repeat the test on a mobile device in the Firefox browser  JA3: 771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-27-65037,29-23-24-25-256-257,0 Let's refresh the page in the Firefox mobile browser JA3: 771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-27-65037-41,29-23-24-25-256-257,0 In the Firefox mobile browser, as well as on the desktop, the Extensions values changed when the page was refreshed. Let's perform the test in Chrome mobile browser  JA3: 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-13-5-17513-51-27-45-43-11-65037-23-16-35-18-10,4588-29-23-24,0 Let's update the page JA3: 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-43-18-35-0-65281-51-11-45-27-16-5-65037-17513-41,4588-29-23-24,0 The Chrome mobile browser changes the order of Extensions values in the same way as in the desktop version. Let's combine the results into a table and sort the values in order  In the table we can observe the characteristic differences between the values in the Ciphers, Extensions and EllipticCurves sections of the JA3 footprint for different browsers and systems. Based on these values, anti-fraud systems can distinguish between known operating systems and browsers in use. It is important to note that sets of values in different versions of the same browser may differ slightly. Equally important is the JA3S fingerprint, it is formed from the values of Version, Accepted Cipher and List of Extensions of the TLS Server Hello message. Let's take a look at the desktop versions of Firefox and Chrome browsers as examples. Firefox JA3S:  Chrome JA3S:  Based on the test results, we can conclude that the List of Extensions values in the JA3S footprint when the server responds are different for different clients. ###### JA4 footprint JA4 fingerprint is an improved version of JA3 fingerprint, it takes into account more parameters and is more stable. An example of a JA4 print: t13d1517h2_8daaf6152771_b0da82dd1658 Where: **t** 13d1517h2_8daaf6152771_b0da82dd1658 - Protocol (t is TCP, q is QUIQ) t **13** d1517h2_8daaf6152771_b0da82dd1658 - TLS Version (12 - 1.2, 13 - 1.3) t13 **d** 1517h2_8daaf6152771_b0da82dd1658 - Indicates a hop by i - ip address or d - domain t13d **15** 17h2_8daaf6152771_b0da82dd1658 - number of Chipher Suites t13d15 **17** h2_8daaf6152771_b0da82dd1658 - number of Extensions t13d1517 **h2** _8daaf6152771_b0da82dd1658 - h2 - HTTP/2 protocol t13d1517 h2_ **8daaf6152771** _b0da82dd1658 - hash for sorted Chipher Suites t13d1517h2_8daaf6152771_ **b0da82dd1658** - hash from the list of sorted Extensions and algorithms This is how the JA4 fingerprint is represented  JA4: t13d1517h2_8daaf6152771_b0da82dd1658 And its raw version JA4_r: t13d1517h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b, 000d,0012,0017,001b,0023,0029,002b,002d,0033,4469,fe0d,ff01_0403,0804,0401,0503,0805,0501,0806,0601 More information on forming a JA4 fingerprint can be found on this page blog.foxio.io/ja4+-network-fingerprinting #### Network fingerprint spoofing methods Attackers can attempt to hide the real parameters of a network connection through: - Modifying TCP/IP parameters. - Generating fake JA3/JA4 fingerprints. - Using proxy servers or VPNs. Anti-fraud systems respond to such attempts by analyzing anomalies, comparing fingerprints and checking the client's sequence of actions. #### Conclusion Network fingerprints such as p0f, JA3, JA4 have become important tools in the arsenal of anti-fraud systems. They allow not only to identify devices, but also to detect masking attempts. The combination of network and hardware fingerprints, as well as in-depth analysis of HTTP/2 protocols and TCP/IP stack provide more accurate protection against fraud and threats. _Bannykh M.V._
