If malware has landed on drive, would browser fingerprinting help then?
You need to understand that malware is usually executed by the user, but in the very early stages (which may last only a few milliseconds), it carries out what I described earlier.
If the OS profiling and fingerprinting are correct for that malware—and by “correct” I mean that it has a high probability of success—the infection will continue.
At this stage, the malware has already bypassed the browser, almost certainly using social engineering techniques as well.
We must prevent this.
So after we’ve built a multi-layered defense for the OS, we must do the same for the browser.
If the malware remains confined to the browser, prevention is achieved.
This is the key concept.
If your browser has a stronger sandbox environment than that of default browsers—partitioned cookies, sandboxed iframes...
So, in practice, if your browser opens a compromised website—perhaps due to a malicious third-party script—after an initial phase that, in this case too, lasts only a moment, it may check a series of factors—such as user agent, language, and WebRTC status—to “better understand” whether you are a real user.
This is the fingerprinting/privacy violation phase.
If, on the other hand, you were a BOT, the website would almost certainly interrupt the next phase, which could be a redirect... or something else.
If dynamic filtering or your browser’s/ad blocker’s filter lists have neutralized the script from the start... the compromised website appears to your browser as a harmless website in every respect.
Obviously, I prefer dynamic filtering because it has a higher probability of blocking, but filter lists also play their part in prevention.
Do you see how important the browser is?
