@anonympins/fingerprint 0.3.5 → 0.3.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +21 -0
- package/README.md +1087 -1080
- package/package.json +1 -1
- package/src/js/fingerprint.js +168 -41
- package/src/php/Tests/RequestUtilsTest.php +65 -0
- package/src/php/Utils/RequestUtils.php +171 -1
- package/src/php/bin/auto-tune.php +118 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,24 @@
|
|
|
1
|
+
## Version 0.3.6
|
|
2
|
+
|
|
3
|
+
### 🛡️ Sybil Protection & Auto-Tuner Hardening (JS/PHP)
|
|
4
|
+
- **Auto-Tuner Freeze Vulnerability Fix (Anti-Flood)**:
|
|
5
|
+
- Resolved a vulnerability allowing an attacker to indefinitely freeze the auto-tuner by flooding it with simple requests (`request_passed`), causing the high-confidence log ratio to plummet below the 5% threshold.
|
|
6
|
+
- Enhanced `sanitizeTrafficData` to balance, shuffle, and cap the proportion of clean logs (`request_passed`) relative to suspicious logs.
|
|
7
|
+
- Added an absolute fallback trigger condition (`MIN_HIGH_CONFIDENCE_COUNT = 10`) in the optimizer to bypass the 5% minimum ratio when a sufficiently strong signal is present.
|
|
8
|
+
- **Defense Against Sybil Attacks (Data Poisoning)**:
|
|
9
|
+
- Limited the contribution of each `deviceId` to a maximum of 2% of the total dataset within the traffic sanitizer, preventing a single attacker from manipulating safety threshold optimization calculations.
|
|
10
|
+
- **Cryptographic Securing of Challenge Context (HMAC)**:
|
|
11
|
+
- Systematic HMAC-SHA256 signing of the challenge payload (`clientSecret`, `cpuTarget`, `fingerprint`, `memDifficulty`, `originalPath`, and client IP) using the global secret.
|
|
12
|
+
- Strict validation of challenge context integrity upon submission to counter injection or storage tampering attacks.
|
|
13
|
+
|
|
14
|
+
### ✨ New Features & Improvements
|
|
15
|
+
- **Sequential Path Enumeration Detection (Scraping)**:
|
|
16
|
+
- Integrated a detection system for requests with identical, incremental structures (e.g., `/product/1`, `/product/2`, `/product/3`).
|
|
17
|
+
- Automatically applies an enumeration penalty score (`enumerationScore`) of 80% of the pattern weight during unique sequential requests on the same URL pattern.
|
|
18
|
+
- **Network Roaming Tolerance & Strict Hardware Identity**:
|
|
19
|
+
- Upgraded `isTicketValid` to tolerate legitimate user IP changes (roaming) within the same network block (IPv4/IPv6 subnet).
|
|
20
|
+
- Automatic fallback to robust hardware identity validation (`deviceId` and `deviceHash` cryptographically verified via HMAC) if the user completely switches networks (e.g., moving from Wi-Fi to 4G).
|
|
21
|
+
|
|
1
22
|
## Version 0.3.5 (Hotfix)
|
|
2
23
|
|
|
3
24
|
### 🛡️ Critical Fixes & Security Hardening:
|