A Unique 'Fingerprint' For Each Computer
The Internet isn't always anonymous; it's possible to identify a user via the Internet Protocol address unique to each computer accessing the Internet or Media Access Control address of some hardware. However, both of these identifiers can be faked with the right software. Now scientists have found another unique identifier that acts almost like a fingerprint for each individual computer: the graphics card.
Researchers from Technische Universiteit Eindhoven in the Netherlands, Technical University of Darmstadt in Germany, Katholieke Universiteit Leuven in Belgium, and the Dutch security firm, Intrinsic ID, discovered that there are physical differences between graphics cards that can be detected by software.
These differences can't be duplicated because they're a random result of producing millions of processors. The researchers dubbed the differences "physically unclonable functions found in standard PC components," or PUFFIN.
"Such a "fingerprint" for a given piece of hardware would be most helpful to online gaming companies and the players. Heavy gamers tend to have high-end graphics cards and customized machines, so odds are they are accessing an online game, such as World of Warcraft from their own computer. This is a different situation than with a bank, which customers may access from a variety of machines such as their work computer or their personal laptop or even their smartphone.
An online gaming company would install the PUFFIN software on its servers. When a customer logged into the game, the software would scan the gamer's graphics card for its unique "fingerprint," and match it against the known fingerprint on file. If the log in name and password didn't match the fingerprint, the online gaming company could ask for additional authentication and if that didn't match, the company could block the user.
Iran's Military Hacks U.S. Stealth Drone
The PUFFIN system isn't perfect. While it isn't possible to duplicate the hardware, it might be possible to duplicate the small differences in behavior on the part of the card. That's still a subject for further research. It's also worth noting that the identification is of the machine being used; it says nothing about who is using it. So someone might access a person's World of Warcraft account using the account holder's computer, and it would still look legitimate.
The PUFFIN Project will run until 2015.
Via PUFFIN, Threatpost


