PinMe: Tracking a Smartphone User around the World

Abstract

Abstract-With the pervasive use of smartphones that sense, collect, and process valuable information about the environment, ensuring location privacy has become one of the most important concerns in the modern age.A few recent research studies discuss the feasibility of processing sensory data gathered by a smartphone to locate the phone's owner, even when the user does not intend to share his location information, e.g., when the user has turned off the Global Positioning System (GPS) on the device. Previous research efforts rely on at least one of the two following fundamental requirements, which impose significant limitations on the adversary: (i) the attacker must accurately know either the user's initial location or the set of routes through which the user travels and/or (ii) the attacker must measure a set of features, e.g., device acceleration, for different potential routes in advance and construct a training dataset.In this paper, we demonstrate that neither of the abovementioned requirements is essential for compromising the user's location privacy. We describe PinMe, a novel user-location mechanism that exploits non-sensory/sensory data stored on the smartphone, e.g., the environment's air pressure and device's timezone, along with publicly-available auxiliary information, e.g., elevation maps, to estimate the user's location when all location services, e.g., GPS, are turned off. Unlike previouslyproposed attacks, PinMe neither requires any prior knowledge about the user nor a training dataset on specific routes. We demonstrate that PinMe can accurately estimate the user's location during four activities (walking, traveling on a train, driving, and traveling on a plane). We also suggest several defenses against the proposed attack.

Sensors of Smart Devices in the Internet of Everything (IoE) Era: Big Opportunities and Massive Doubts

“…Another example of side-channel attacks is motion attacks. In [151], the authors proposed PinMe, an algorithm that can track users around the world. Time zone, IP address, and accelerometer, gyroscope, and barometer sensors have been leveraged.…”

Unexpected Inferences from Sensor Data: A Hidden Privacy Threat in the Internet of Things

“…Smartphone owners can also be located while they are walking or travelling on a train or plane by exploiting a combination of easily accessible mobile sensor data and publicly available auxiliary data [43]. For this approach, neither training data nor prior knowledge about the user is required.…”

The Unlikely Siblings in the GDPR Family: A Techno-Legal Analysis of Major Platforms in the Diffusion of Personal Data in Service Ecosystems

“…Therefore, it would be consequential to obligate iOS to fill out this role appropriately, by denying the flow of data to the app for all data that might be used to approximate or determine the location of the user, on a technical level, as far as such a technical limitation of data flow can be achieved by reasonable measures. In addition to the case, other technical possibilities to determine the location of users [46] must also be excluded. On the other hand, such an unmitigated denial of all potentially "damaging" data would certainly not be feasible.…”