Antidetect FAQ or User-Agent substitution is nothing more than an ordinary fake

Mutt

Professional
Messages
1,057
Reputation
7
Reaction score
596
Points
113
Free Antidetect Vektor T13 based on VirtualBox.

What is the Antidetect project?
The Antidetect project is a hypervisor (virtualization system) that allows you to create virtual computers so that they look like real ones.
Virtual PCs (virtual machines) - have all the features of real hardware - BIOS, EFI, ACPI, hardware and functionality.
The Antidetect project allows you to create hundreds of thousands of virtual computers in one real one.

What is System Antifraud?
Antifraud (English Anti Fraud - literally "Against" "Fraud") - a system producing identification of users, the main purpose of which is to recognize "good" users and distinguish them from "bad" to ensure the security of the web resource. Simply put - Protection Systems.

How does Antidetect project differ from VirtualBox?
The Antidetect project is based on the source code of the VirtualBox OSE 5.2.2 hypervisor, and it uses technologies that protect the virtual machine from being detected as a virtual one, plus added various functions that are necessary to emulate the functionality of a real PC.

Why did you choose VirtualBox over VMware?
VirtualBox is open source (OSE), while VMware is closed source.

How does Antidetect of virtual machines differ from browser antidetect?
Browser antidetect and Antidetect of virtual machines are fundamentally different concepts. At the moment, there are more than 20 browser antidetects and new ones appear every day, and in all browser antidetects the main feature is changing fingerprints by adding "noise" when processing these fingerprints.

In Antidetect virtual machines, the user can use official browsers without modifying them. when creating a new virtual machine, a new computer is created. Plus Antidetect allows you to work with local applications - poker clients, casinos, forex, bank clients, games, trial software, etc. - that in browser antidetects it is impossible in principle. And yes, one more thing, there are more than 20 browser antidetects, and there is only one virtual machine Antidetect.

Do you have a browser-based Antidetect?
Vektor T13 in May 2017 presented the first prototype of a free open source Antidetect browser based on the code base of the Mozilla Firefox v48 browser, the project was named Antidetect browser by Vektor T13.

By the fall of 2017, the substitution of all, at that time, user's browser fingerprints was implemented.
In the fall of 2017, the project was completely closed.
The closure of the ultra promising project was due to the emergence of the "Balaklava Principle"

What is the Balaklava Principle?
“Balaklava Principle” is a concept that characterizes an action, a methodology or a set of measures aimed at achieving Anonymity, in the implementation of which the user achieves Anonymity, but at the same time, uniqueizes himself among the bulk of users.

The Balaclava Principle emerged after a detailed study of the capabilities of Browser Antidetects. The fact is that all currently existing Browser fingerprints are not unique, which in turn means that even if your Canvas fingerprint has 99% uniqueness (source - https://browserleaks.com/canvas) in the context of large services will be will be repeated very often, for example, let's take Amazon and its monthly number of visitors 553 million (source - https://ahrefs.com/blog/most-visited-websites/)

Accordingly, we can assume that if your fingerprint is 99% unique, another 5.5 million users will have the same fingerprint.

And we can give the same statistics for absolutely all existing Browser fingerprints.

The currently existing methods of spoofing Browser fingerprints used in the overwhelming majority of Antidetect browsers use the technology of adding "noise", which leads to a 100% unique Browser fingerprint, and this, in turn, uniqueizes the user among all other visitors of the web resource and from the side of systems protection, additional sanctions can be applied to such a user in the form of restrictions on actions, additional verifications, and others.

The use of Anonymization technologies, leading to the uniqueness of the user, is called the "Balaclava Principle".

What are the requirements for the PC hardware to run Antidetect?
You can calculate the power you need yourself based on what is needed to run one virtual machine.

Required resources for the operation of one virtual machine:
CPU - 1 core (2 threads)
RAM - 4GB
HDD - 30 GB
GPU - no lower than GeForce 770 and MANDATORY DISCRETE!
OS - Windows 10 (Windows 7 not supported)

Can Antidetect be run on VPS / VDS?
Not

Can Antidetect run on Dedicated Server?
You can, but keep in mind that when working with a remote server, we cannot use the RDP protocol, so if you want to work with Antidetect on a remote server, use either a VNC connection or the Radmin utility.
Also note that you will need a server with a discrete graphics card.
Recommended hosting:

Can Antidetect and VirtualBox be used on the same PC?
No, these are related products and they cannot exist on the same PC at the same time.

The installation process requires installing certificates from Vektor T13 - is it dangerous for my PC?
These certificates are needed for the network driver and usb driver to work.
They are no more dangerous than any other driver certificate.

Can putting my PC into test mode harm me?
We enable the test mode to install drivers not signed by Microsoft, the test mode does not carry any functions and does not pose a potential danger.

Where can I download the iso image of the Windows operating system?
You can download it on the official Microsoft website:

Where can I download the iso image of the Android operating system?
You can download the image of the Android mobile operating system from the link:

Where can I download the iso image of the MacOS operating system?
You can download the image of the MacOS operating system from the link:

Can Windows builds be used from torrent trackers?
No, it is not recommended to use modified versions of windows.

Does it make sense to stuff cookies to emulate a real person?

It makes no sense to stuff cookies by randomly visiting various websites for three reasons:
1) On all large resources, cookies have the http-only flag, which means that cookies can only be received in an http request and cannot be received in a javascript request. Accordingly, your cookies cannot be retrieved by other resources.

2) If large services, for example PayPal or Amazon, tried to get your cookies received from other resources, this would be a pure XSS attack, for which services using it would, at best, incur multibillion-dollar fines. Therefore, no one will do this.

3) In order to evaluate what resources the user visited, you do not need to receive his cookies, it is much easier (and most importantly, more legitimate) to get data directly from the history of his browser. This solution is very elegant, fast, and is not classified as an attack - which means it is legitimate.
An example of retrieving the history from the user's browser can be seen at the link:
(move the mouse over the red square and in the lower left corner of the screen you will see the site you were on)

All browser Antidetects can replace User-Agent, I can set any browser and operating system. Does your Antidetect do that?
User-Agent substitution is nothing more than an ordinary fake, with the help of which developers who are not clean on hand deceive their customers. Substitution of the user agent is impossible in principle and there are several reasons for this:

Reason # 1 - Canvas
In the process of processing standard visual elements of web pages, each browser engine processes them differently, which allows web resources to identify the substitution of User-Agent, in the screenshot below you can see the difference in displaying elements in different browsers:
0d6ac72649166beb78d19.png

Standard Canvas Elements Rendering

Due to the difference in the rendering of standard elements of web resources, it is elementary to calculate the substitution of a user agent, and the Anti-Fraud systems will apply appropriate sanctions to you if you say in the User-Agent header that you are using, for example, the Opera browser, and the rendering of standard elements comes from the Mozilla Firefox browser.

Reason # 2 - AudioContext
First, let's use the online AudioContext test:

In the test results, pay attention to two parameters:
95fd2394e8671fd276fe0.png

Browser Engine dependent fingerprint

What many of you take for an Audio fingerprint is actually a browser engine fingerprint or, as shown in the picture above, a Dynamic Compressor fingerprint. This value is not unique and has only one dependency - the Browser Engine dependency.
You can check this fingerprint on your PC and you will see that if the browser engine version matches, the fingerprint will be the same on all devices. Accordingly, when your Browser Antidetect reports that according to the User-Agent it is Firefox and has a fingerprint of the engine from Chrome, it is elementary to calculate the substitution.

Reason # 3 - Statistical Fingerprint
Stack For 95% of all Browser Antidetect users, the main reason for its Browser Antidetect operation is the ability to change their fingerprints and check it using online checkers.
A person does not think about what he is changing, what he is changing, whether it is necessary to change anything at all in his browser prints, he acts very simply - "Changed means everything is OK", but following this principle leads to confusion of prints and such a system looks like conditionally as follows:
9e1535ff70fe1eb8c0506.png

Browser Antidetect vs Real Browser

As we can see, even without the use of any advanced technologies, based on banal statistics of data received from visitors to the web resource, the Antifraud system can distinguish a real browser from a fake one.
A vivid example of this is Google, try registering a Gmail account without SMS from any Antidetect browser and you will see the result of using the Stack of Fingerprints.

Reason # 4 - TLS Fingerprint
The most "unpopular" fingerprint that is used in most google services is the TLS (SSL) fingerprint, which will also report information about your real browser.
Test - https://ja3er.com

And this is far from all the reasons why the real browser of the user is detected, therefore, using the User-Agent substitution will not hide you, but on the contrary - will distinguish you from ordinary users.
A striking example of the "Balaklava Principle".

Can web resources see virtual machine usage?
At the moment, there is not a single Browser fingerprint, the replacement technologies of which would be unknown.

It is for this reason that more and more Off-browser fingerprints appear.

We are already familiar with some of them:
1. MAP (Mouse activity pattern) - a fingerprint of mouse behavior.
2. UKIP (User keyboard input pattern) - keyboard handwriting print.
3. TLS FP - TLS fingerprint when visiting https web resources.
etc.

Now I want to acquaint you with an elementary simple technique for detecting the use of virtual machines, VDS and various kinds of emulators.

The name of this technique is Browser Native Performance Benchmark (BNPB hereinafter) - or in simpler terms - Browser performance test.

The essence of the technique is elementary simple:
1. CPU performance is checked by providing resource-intensive JS to the client.
2. The GPU performance is checked by determining the rendering speed of the Canvas image.

Online Test Example:

That is, the web resource checks the performance of your processor and video card, and then the received data falls under a condition like:
If BNPB is less than 70% of the average (statistics are separate for each browser and version), then enable additional user verification methods.
If the BNPB is 70% or more of the average, continue working.

This technique is especially effective in detecting browsers running on virtual machines.

Example:
Yesterday we worked with a user on Chrome version 78, BNPB user rating was 16.08 with an average of 853.93
Thus, using the BNPB technique, it is possible to identify a potentially dangerous user, even if he ideally changed all his browser fingerprints.

If I need additional functionality - how can I get it?
Some users need unique hardware, or monitor emulation, or, for example, support for certain software or bypassing a specific anti-fraud system - all this can be done individually by agreeing with the support in the telegram bot: @vektort13_support_bot
By your order, a personal assembly of the Antidetect project will be performed according to your needs.

[BList of Antidetects[/B]
https://kameleo.io
https://accovod.com
https://fraudfox.net (there are complaints about non-performance of services)
https://ls.tenebris.cc
 
Top