I'm a privacy conscious user and I don't like to be fingerprinted by marketing websites, so I set up my Symantec firewall and closed most of the ports that I don't use. I also disabled ICMP requests.

Now, when I access Facebook, Google or some other websites, I see they do ICMP requests and who knows what else. But there is something that amazes me. They are able to access my Windows kernel files.

I scanned all of my PC files and everything came out clean but in the firewall logs I can see these sites accessing Ntoskrnl.exe. How is that even possible? Is there something residing in my router/modem?

Some of these tracking URLs that can access Ntoskrnl.exe are:

  • aa.online-matrix.net (owned by device fingerprinting company called threatmetrix)

  • loadm.exelator.com

  • loadeu.exelator.com (the last two are both owned by the marketing company www.nielsen.com)

I have also attached an image file. Please check it out and give me your insights

Image of kernel access requests

  • Why don't you just shut down ICMP at the firewall, rather than try fiddle with every possible intrusion point? Unless you know you need it across your border... then you don't. btw, closing ports is a bit... errmmm... not good. Most ports are stealthed by default, so don't show at all. – Tetsujin Aug 3 '18 at 15:48
  • 3
    You're privacy conscious and you have a Facebook account? Just saying... – Tim Aug 3 '18 at 17:05

The firewall logs do not show anything about what files are being accessed. This column tells you which program handles those packets. (For example, if the packet belonged to a HTTP request made by Firefox, the logs would show Firefox.) Since ICMP packets are always processed by the OS kernel, this column naturally will show the path to the kernel.

ICMP packets have different types, which are sent for many different reasons. Some request information, others provide information. Some have potential privacy issues, others don't. Some are optional, others are part of normal TCP/IP operation. Do not blindly assume that all of them are "hacker tools" without any deeper research.

Your screenshot shows two ICMP packets of type 3, which is "Destination unreachable" – a legitimate error message, telling your OS that some packet cannot be delivered. (Since error notifications themselves are responses, they don't cause any further response from your PC and cannot generally be used for fingerprinting.)

Specifically, code/subtype 4 is "Packet too big", which informs the OS that it should retry using smaller fragments for this destination. If you block this particular subtype, the connection will usually appear to hang forever.

  • thanks for your insight. But i still dont understand i have plenty of firewall logs why only these urls show up in the log with icmp request response/somekind of association with ntoskrnl.exe why not others? There must be something going on. – john john Aug 3 '18 at 16:14
  • The other responses in your logs are simply not being handled by the kernel, so it isn't listed in that column. The kernel is the handler here, not a file being accessed. What your seeing isn't something delving into the depths of your OS, it's a low level part of the OS taking care of something that isn't very important to higher level processes. – zeel Aug 3 '18 at 19:37

It sounds overall like you're just wanting to protect against browser fingerprinting by digital marketing agencies - in which case discussions about the vulnerability of the Windows kernel aren't as relevant. grawity's answer is correct when it comes to the traffic log you've posted as an image.

There are tools available to assess your vulnerability to fingerprinting. One such tool is Panopticlick, created by the Electronic Frontier Foundation(EFF). Among other things, this tool allows you to view if you have a unique browser fingerprint or not. If the scan detects a unique browser fingerprint, you can view a breakdown of all the information that work to make your browser uniquely identifiable.

Before you use their scanning tool, you may wish to read more about their methodology here which includes a brief section on defending against browser fingerprinting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.