Every Move You Make: Exploring Practical Issues in Smartphone Motion Sensor Fingerprinting and Countermeasures

Abstract

Abstract:The ability to track users' activities across different websites and visits is a key tool in advertising and surveillance. The HTML5 DeviceMotion interface creates a new opportunity for such tracking via fingerprinting of smartphone motion sensors. We study the feasibility of carrying out such fingerprinting under real-world constraints and on a large scale. In particular, we collect measurements from several hundred users under realistic scenarios and show that the state-of-the-art techniques provide very low accuracy in these settings. We then improve fingerprinting accuracy by changing the classifier as well as incorporating auxiliary information. We also show how to perform fingerprinting in an open-world scenario where one must distinguish between known and previously unseen users. We next consider the problem of developing fingerprinting countermeasures; we evaluate the usability of a previously proposed obfuscation technique and a newly developed quantization technique via a large-scale user study. We find that both techniques are able to drastically reduce fingerprinting accuracy without significantly impacting the utility of the sensors in web applications.

SensorID: Sensor Calibration Fingerprinting for Smartphones

“…Second, they either require the smartphone to be placed in a stationary position (e.g., on a desk) or have a relatively low accuracy when devices are moved. When devices were held in a hand, state-of-the-art work by Das et al achieved an accuracy of around 60% in an open-world setting with the iPhone 6, which is equivalent to 13 bits of entropy ( §VII-D) [4]. In comparison, we achieve 67 bits of entropy for the iPhone 6S.…”

“…We developed both a website 4 and an iOS app to collect sensor data. The iOS app collects raw data from the gyroscope and magnetometer at 200 Hz and does not ask users to put the device in any particular position.…”

“…However, they did not realize that the calibration process could leak information if not properly implemented. More recently, they further improved its accuracy by introducing a voting scheme among different classifiers [4]. Nevertheless, their approach requires a lot of computing resources, which cannot be implemented locally on the device.…”

“…Previous studies applied machine learning techniques directly to sensor data in an attempt to create device fingerprints for smartphones [3], [4]. Unfortunately, this approach has several drawbacks.…”

MSFA: Multiple System Fingerprint Attack Scheme for IoT Anonymous Communication

“…The actual address of the regulator's communication side is identified by analyzing the generated traffic characteristics. Fingerprinting [10] combines a number of input sources. Fingerprint attack technique identifies whether the sender communicates with a particular recipient by collecting the sender or receiving the feature information of both.…”