Tracking Mobile Web Users Through Motion Sensors: Attacks and Defenses

Abstract

Abstract-Modern smartphones contain motion sensors, such as accelerometers and gyroscopes. These sensors have many useful applications; however, they can also be used to uniquely identify a phone by measuring anomalies in the signals, which are a result of manufacturing imperfections. Such measurements can be conducted surreptitiously by web page publishers or advertisers and can thus be used to track users across applications, websites, and visits.We analyze how well sensor fingerprinting works under realworld constraints. We first develop a highly accurate fingerprinting mechanism that combines multiple motion sensors and makes use of inaudible audio stimulation to improve detection. We evaluate this mechanism using measurements from a large collection of smartphones, in both lab and public conditions. We then analyze techniques to mitigate sensor fingerprinting either by calibrating the sensors to eliminate the signal anomalies, or by adding noise that obfuscates the anomalies. We evaluate the impact of calibration and obfuscation techniques on the classifier accuracy; we also look at how such mitigation techniques impact the utility of the motion sensors.

Every Move You Make: Exploring Practical Issues in Smartphone Motion Sensor Fingerprinting and Countermeasures

“…( §5.1) -We carry out the first large-scale user study to evaluate the trade-off between privacy and utility of fingerprinting countermeasures. We evalute both our proposed countermeasure as well as the obfuscation technique proposed by Das et al [16] and find that users experience no significant ill effects from the countermeasures. ( §5.3)…”

“…In turn, advertisers have started using browser fingerprinting [9,19,29] to track users across the web without the use of cookies. As the battleground shifts to mobile platforms, which are quickly becoming the dominant mode for web browsing [1,5,6,8], existing fingerprinting techniques become less effective [22,36]; at the same time, new threats emerge: mobile browsers give web pages access to internal motion sensors (accelerometers and gyroscopes) and researchers have showed that imperfections in these sensors can be used to fingerprint smartphones [16,18,22], boosting the accuracy of a weakened browser fingerprint.…”

“…The evaluation of the state-of-the-art fingerprinting techniques [16] studied phones placed on a desk. This usage scenario is almost certainly less common than inhand phone usage.…”

“…We then carry out a large-scale user study to investigate the impact of privacy protections on the game difficulty. We evaluate an obfuscation method proposed by Das et al [16] and develop a new quantization-based protection method. Encouragingly, we find that neither method creates a statistically significant impact on motion sensor utility, as measured by both subjective and objective measures.…”

“…In summary, we make the following contributions: -We evaluate the state-of-the-art fingerprinting techniques [16] on a larger data set and in more realistic settings, and find that their accuracy degrades significantly. ( §4.1) -We improve the classification performance by introducing new data streams, incorporating a voting scheme among multiple classifiers, and incorporating external information.…”