Full Report
Glassbox dev admits he had some help from Claude to build locally running tool
Analysis Summary
# Tool/Technique: Glassbox
## Overview
Glassbox is an open-source browser fingerprinting and reconnaissance tool designed to demonstrate how websites and trackers identify unique users. Unlike traditional fingerprinting services that store data on central servers, Glassbox runs entirely locally within the user's browser (with the exception of a single public geolocation API ping). It incorporates advanced techniques, including those observed in "in-the-wild" anti-fraud scripts used by major e-commerce platforms like Alibaba.
## Technical Details
- **Type:** Reconnaissance Tool / Browser Fingerprinting Framework
- **Platform:** Web Browsers (Chrome, Firefox, Safari, Edge, Tor)
- **Capabilities:** Passive and active browser environment discovery, entropy estimation, and identification of tracking vectors.
- **First Seen:** August 2026 (Public release/reporting date)
## MITRE ATT&CK Mapping
- **[TA0043 - Reconnaissance]**
- **[T1592 - Gather Victim Host Information]**
- **[T1592.004 - Client Configurations]:** Collecting browser settings, plugins, and OS details.
- **[T1589 - Gather Victim Identity Information]**
- **[T1589.001 - Credentials]:** Checking cross-site login states.
- **[TA0007 - Discovery]**
- **[T1082 - System Information Discovery]:** Identifying hardware via WebGL and Canvas.
- **[T1016 - System Network Configuration Discovery]:** Identifying IP addresses (IPv4/IPv6) and WebRTC leaks.
## Functionality
### Core Capabilities
- **Browser Environment Probing:** Collects raw data from over 30 different signals to build a device profile.
- **Identifiability Modeling:** Calculates a mathematical "entropy" score to estimate the probability of a user being unique among the global population (up to 1 in 7.6 billion).
- **IP & Geolocation:** Detects public IP addresses and determines if the user is exposed via IPv6 or WebRTC leaks.
- **Hardware Abstraction:** Identifies the underlying hardware through Canvas and WebGL rendering artifacts.
### Advanced Features
- **Silent Sawtooth Wave Analysis:** Implements audio-based fingerprinting techniques (inspired by Alibaba's anti-fraud scripts) that use subtle audio frequency variations to distinguish hardware.
- **Cross-Site State Detection:** Probes for login states across various platforms to link browser sessions.
- **Privacy Mask Detection:** Evaluates the effectiveness of browser "masks" or hardening techniques and discounts them from the total entropy score.
- **WASM & API Matrix:** Maps available WebAssembly features and JavaScript API availability to create a unique "signature" of the browser engine.
## Indicators of Compromise
*Note: As Glassbox is a privacy-focused tool rather than malicious software, these indicators are for identifying the tool's presence.*
- **File Names:** `glassbox.codecanary.org` (Domain)
- **Network Indicators:**
- `glassbox[.]codecanary[.]org`
- Connections to public IP/Geolocation APIs (e.g., `ipapi[.]co` or similar services used for IP discovery).
- **Behavioral Indicators:**
- Rapid execution of multiple JavaScript API calls (Canvas, AudioContext, WebGL).
- WebRTC "Internal Address" requests to bypass VPNs.
## Associated Threat Actors
- **Developer:** David Dale (Security Engineer).
- **Usage:** Primarily used by privacy researchers and security-conscious individuals. However, the *techniques* implemented (such as the sawtooth audio waves) are associated with commercial trackers and anti-fraud entities like **Alibaba**.
## Detection Methods
- **Behavioral detection:** Monitoring for frequent calls to `HTMLCanvasElement.toDataURL()`, `AudioContext` creation, and enumeration of `navigator.plugins`.
- **Browser-level protection:** Modern privacy browsers (Tor, Firefox) detect and spoof the return values of these APIs to provide a "generic" fingerprint.
## Mitigation Strategies
- **Browser Standardization:** Use browsers that implement "Fingerprinting Protection" (e.g., Tor Browser or Firefox with `privacy.resistFingerprinting` enabled).
- **WebRTC Protection:** Disable WebRTC or use browser extensions to prevent local IP leaks through VPNs.
- **Standardization over Hardening:** Avoid highly unique browser configurations (excessive extensions or rare fonts), as these increase individual entropy.
- **VPN/Tor Usage:** Masking the network layer to prevent IP-based tracking.
## Related Tools/Techniques
- **EFF Cover Your Tracks:** A similar tool for testing browser uniqueness.
- **AmIUnique:** An open-source fingerprinting research project.
- **Claude Code:** The AI tool utilized by the developer to assist in the creation and polishing of the Glassbox codebase.