Location Cheating: A Security Challenge to Location-based Social Network Services

I. INTRODUCTION

• Real-world rewards for checking in at distant venues give users an incentive to falsify their location.The report cites a free cup of coffee as an example reward.Source: §I · p. 1
• The study uses foursquare to investigate service vulnerabilities and seeks to raise awareness while suggesting solutions for the business model’s participants.The stated stakeholders are service providers, registered venues, and users.Source: §I · p. 1
• The report introduces an attack that can pass foursquare’s cheater code and uses crawled profiles to find suspicious users.It also reports that the attack can be more severe when combined with venue or location profile analysis.Source: §I · p. 1
• Falsified GPS data can exploit inadequate location verification, and loosely regulated anticheating rules leave room for cheaters despite defenses such as cheater code.The authors identify insufficient location verification as the vulnerability’s root cause.Source: §I · p. 1
• The report recommends improving location verification and limiting profile crawling and analysis to mitigate location-cheating threats.It presents these as possible measures for service providers.Source: §I · p. 1

II. BACKGROUND

• Users check in to report their location, and services may share that information with friends or the public.Check-ins are made by hand, allowing users to choose when to report their location.Source: A. Business Model · p. 2

A. Business Model

• Foursquare awards points, badges, mayorships, and real-world rewards, with mayorship determined by the number of days checked in during the past 60 days.Only one user can be mayor at a venue, so a persistent attacker can prevent others from gaining the title.Source: A. Business Model · p. 2
• Businesses provide real-world rewards, and more than 90% of the crawled rewards were for mayors, making the competitive reward model a target for location cheating.The authors say discounts and mayorship competition may bring customers to partner businesses.Source: A. Business Model · p. 2

B. Possible Location Cheating Scenarios

• Users may cheat for venue rewards or status, while business owners may falsely check in at competitors to post bad comments.Automated attackers can target venues with desirable discounts or less-competitive mayorships, or use the fewest check-ins needed to retain a mayorship.Source: B. Possible Location Cheating Scenarios · p. 2
• Foursquare initially accepted any venue selected in its client, but later required location information; users can still modify that information and submit a false location.Software such as Autosquare could automate check-ins under the earlier self-regulation approach.Source: B. Possible Location Cheating Scenarios · p. 2

C. Cheater Code

• The cheater code checks device GPS and applies concealed server-side rules, several of which the authors identified experimentally.A check-in far from the phone’s reported GPS location is invalid and earns no rewards.Source: C. Cheater Code · p. 2
• Rules limit repeat check-ins to once per venue per hour, flag distant travel as super-human speed, and warn on a fourth rapid check-in within a 180-by-180-meter area in one minute.Together, these rules constrain daily check-in volume, while identifying them helps attackers work around them.Source: C. Cheater Code · p. 3

III. LOCATION CHEATING ATTACK

• The attack plan combines GPS cheating, automated check-ins, and venue-profile analysis, with the latter targeting high-value venues such as reward providers.The authors crawl foursquare data and evade its cheater code to automate the process.Source: §III · p. 3

A. Location Cheating Against GPS Verification

• Because GPS readings reach the LBS through the client, an attacker can block the phone’s true location and feed fake coordinates that the server accepts.The authors report confirming that foursquare’s application obtains GPS data from the phone’s GPS-related APIs.Source: A. Location Cheating Against GPS… · p. 3, Figure 1 · p. 3

1) Via GPS APIs:

• Modifying smartphone GPS APIs can supply fake coordinates from a server or local file; although limited to open-source operating systems, this method applies across LBS platforms.The paper uses an Android hack as representative of cross-platform LBSs and introduces it as one of several ways to pass GPS verification.Source: 1) Via GPS APIs · p. 3, A. Location Cheating Against GPS… · p. 3

2) Via GPS module:

• GPS cheating can use modified hardware or simulated GPS devices that return fake coordinates to a phone.The paper names commercial GPS simulation tools originally developed for debugging GPS-related software or gadgets.Source: 2) Via GPS module · p. 3

3) Via server provided APIs:

• Foursquare’s public application APIs can be used to check into venues, making large-scale cheating more convenient.The paper notes that not all location-based service providers offer public server APIs.Source: 3) Via server provided APIs · p. 4

4) Via device emulator:

• A configurable emulator can feed a chosen GPS location to an application, and the authors used this method for experiments.They set coordinates with Dalvik Debug Monitor, then selected the target venue in the foursquare application and checked in.Source: 4) Via device emulator · p. 4
• Distant emulator check-ins were accepted and earned points, badges, and a mayorship.The test user became mayor of San Francisco’s Fisherman’s Wharf Sign after nine days of daily check-ins.Source: 4) Via device emulator · p. 4

• A multi-threaded crawler was built to download and process more than seven million webpages.The crawler ran on three PCs, with a fourth machine serving as the database server.Source: B. Crawling Data From Foursquare Website · p. 4
• More than 1.89 million users and 5.6 million venues were crawled, enabling user-profile updates in under two days and venue updates in about five.Repeated daily venue crawls could reveal check-in frequency and support identifying suspicious user behavior.Source: B. Crawling Data From Foursquare Website · p. 4
• Numbered profile IDs let the crawler access nearly all user and venue profiles by changing IDs in their URLs.Only 26.1% of users had username-based URLs, so the crawler used ID-based URLs.Source: B. Crawling Data From Foursquare Website · p. 5
• The crawler fetched public webpages, extracted profile information, and stored users, venues, and recent visitor relations in a database.Recent visitor records and venue mayor IDs were used to calculate users’ recent check-ins and total mayorships.Source: B. Crawling Data From Foursquare Website · pp. 4–5

• Crawled venue coordinates can be queried from the database to identify locations for automated check-ins.The authors illustrate the coordinate data with a map of Starbucks branches across the United States.Source: C. Automated Cheating · p. 5, Figure 3 · p. 5
• The schedule follows a virtual path, with five-minute intervals for venues under one mile apart and five minutes per mile for longer distances.The authors report that check-ins less than one mile apart at five-minute intervals did not trigger detection in their experiments.Source: C. Automated Cheating · pp. 5–6
• A semiautomatic tool selected nearby venues along a chosen direction and distance, then set emulator coordinates or generated an automated check-in list.The tool also limited the process to avoid triggering the cheater code’s rules.Source: C. Automated Cheating · p. 6
• Twenty-five check-ins along a virtual tour earned reward points without triggering the cheater code.The authors used five-minute intervals for steps under one mile.Source: C. Automated Cheating · p. 6
• In dense cities, selected venues may lie close to the desired location, while larger step distances help the virtual route cover greater distances.The authors note that increasing each step’s moving distance reduces the chance of drifting from the desired direction.Source: C. Automated Cheating · p. 6

D. Cheating with Venue Profile Analysis

• Attackers may target venues with special offers for mayors and little competition for mayorship.The authors reported around 1,000 venues in this category at the time of the report.Source: D. Cheating with Venue Profile Analysis · p. 6
• Profile analysis found one user with 865 mayorships and 1,265 total check-ins.Most of the 865 venues had no other visitors during the prior 60 days, so a single check-in could be enough for mayorship.Source: D. Cheating with Venue Profile Analysis · p. 6
• Venue-profile analysis can identify places where a target user has checked in or is mayor, enabling attacks on that user’s mayorships.Source: D. Cheating with Venue Profile Analysis · p. 6

IV. EVALUATION OF LOCATION CHEATING ON FOURSQUARE

• The evaluation identifies above-normal activity, below-normal rewards, and suspicious check-in patterns as signs related to location cheating.Source: §IV · p. 6

A. High Check-in Frequency in Recent Visitor List

• The analysis used 20 million crawled check-ins, but the actual totals were higher because the website showed only recent check-ins.The crawled records averaged at least ten venues per user and four visitors per venue.Source: A. High Check-in Frequency in Recent… · p. 6

B. Low Reward Rate

• For users with more than 1,000 check-ins, badge counts oscillated sharply, and many had fewer than 10 badges; users above 9,000 check-ins generally had low rewards.The authors suggest these patterns may indicate detected cheaters whose check-ins still counted toward totals but yielded no rewards.Source: Figure 5 · p. 7, B. Low Reward Rate · p. 7

A. High Check-in Frequency in Recent Visitor List

• Users with more than 500 total check-ins averaged around 100 recent check-ins; among users with 500–2,000 total check-ins, 25,074 users could potentially be located or their likely destinations inferred.The authors treat unusually high recent-check-in ratios as a possible cheating sign, not hard proof; users with 2,000 or fewer check-ins covered 99.98% of users.Source: Figure 6 · p. 7, A. High Check-in Frequency in Recent… · p. 7

B. Low Reward Rate

• Of 11 users with at least 5,000 check-ins, six were mayors of many venues concentrated in one city, while five had no mayorships and received fewer badges.Four of the five users in the second group appeared in a recent visitor list; the authors interpret the group differences as evidence of caught cheaters.Source: B. Low Reward Rate · p. 8

C. Suspicious Check-in Patterns

• The suspected user appeared in recent visitor lists for over 1,000 venues across more than 30 cities in the United States and Europe, despite apparently using foursquare for less than a year.The authors regard this unusually broad pattern as suspicious.Source: C. Suspicious Check-in Patterns · p. 8
• The comparison user’s venues were concentrated in three cities and a few other places, a pattern the authors considered normal after examining highly active users.The users had similar numbers of recent check-in records and similar registration-era IDs.Source: Figure 8 · p. 8, C. Suspicious Check-in Patterns · p. 8
• The analysis is a snapshot of detected behavior: the authors identify undetected cheaters as the focus of future work.At the time of the study, mayors had passed scrutiny by the cheater code; detected cheating check-ins still counted in totals but received no rewards.Source: C. Suspicious Check-in Patterns · p. 8

V. POSSIBLE SOLUTIONS AGAINST LOCATION CHEATING

• The report identifies large-scale automated attacks and inadequate location verification as the threat and its root cause, while proposing reduced access to user and venue profiles.Source: §V · p. 8

A. Location Verification Techniques

• Venue-side verification uses Wi-Fi routers to check whether a device is within range, but does not distinguish nearby venues without tighter router configuration.Routers must also be registered with the LBS server and establish trusted communication.Source: A. Location Verification Techniques · p. 9
• Distance bounding provides the most accurate location data and works anywhere, but is difficult to implement and has the highest cost.It requires verifiers around registered venues, making deployment expensive.Source: A. Location Verification Techniques · pp. 8–9
• Address mapping is the least accurate option, but works anywhere and has the lowest cost and easiest implementation.Mobile phones may use nonlocal IP addresses or dynamically changing addresses.Source: A. Location Verification Techniques · p. 9

B. Mitigating Threat from Location Cheating

• Because profile analysis can help attackers optimize cheating, the report recommends limiting publicly exposed information.Source: B. Mitigating Threat from Location… · p. 9
• Requiring login for profile pages and blocking detected crawler IP addresses can help limit large-scale crawling.The report notes that public proxies and Tor have limited crawling performance.Source: B. Mitigating Threat from Location… · p. 9
• Removing recent check-ins would impair venue-profile usefulness, so the report suggests hashing necessary information such as user IDs instead.Source: B. Mitigating Threat from Location… · p. 9

VI. CONCLUSIONS AND FUTURE WORK

• Real-world foursquare experiments showed the practical attack worked, and current countermeasures are imperfect.Source: §VI · p. 9
• Future work will seek better ways to identify cheaters missed by existing mechanisms and balance usability with security.Source: §VI · p. 9