PaperlayerView exact revision on arXiv

Source-linked AI summary

All Your Location are Belong to Us: Breaking Mobile Social Networks for Automated User Location Tracking

Muyuan Li, Haojin Zhu, Zhaoyu Gao, Si Chen, Kui Ren, Le Yu, Shangqian Hu

arXiv:1310.2547v2cs.SIcs.CR

TL;DR

Existing LBSN location-obfuscation practices leave users vulnerable to privacy breaches despite exposing only relative location information. The paper develops automated attacks using publicly available app information and shows high-accuracy tracking across Wechat, Skout, and Momo, while proposing mitigation mechanisms.

  • Problem

    LBSNs’ relative-location protections and limited-distance displays have not been adequately scrutinized, despite risks that exposed location information can enable identification and privacy harms.

  • Method

    The paper builds an automated tracking system that uses only information available to regular LBSN users, including iterative trilateration and space-partition attacks against three popular apps.

  • Results

    The attacks achieve high localization accuracy across Momo, Skout, and Wechat, including average accuracies of 25.8233m, 129.3674m, and 51.0888m, respectively.

  • Takeaways & Limitations

    Current industrial location-privacy practices can expose LBSN users to serious location-privacy threats, motivating grid-reference and location-classification mitigations.

  • Takeaways & Limitations

    Tracking accuracy depends on location providers and server-side cache policies, with shorter Wechat location buffering making tracking more difficult in China.

Abstract

from arXiv · show

Many popular location-based social networks (LBSNs) support built-in location-based social discovery with hundreds of millions of users around the world. While user (near) realtime geographical information is essential to enable location-based social discovery in LBSNs, the importance of user location privacy has also been recognized by leading real-world LBSNs. To protect user's exact geographical location from being exposed, a number of location protection approaches have been adopted by the industry so that only relative location information are publicly disclosed. These techniques are assumed to be secure and are exercised on the daily base. In this paper, we question the safety of these location-obfuscation techniques used by existing LBSNs. We show, for the first time, through real world attacks that they can all be easily destroyed by an attacker with the capability of no more than a regular LBSN user. In particular, by manipulating location information fed to LBSN client app, an ill-intended regular user can easily deduce the exact location information by running LBSN apps as location oracle and performing a series of attacking strategies. We develop an automated user location tracking system and test it on the most popular LBSNs including Wechat, Skout and Momo. We demonstrate its effectiveness and efficiency via a 3 week real-world experiment with 30 volunteers. Our evaluation results show that we could geo-locate a target with high accuracy and can readily recover users' Top 5 locations. We also propose to use grid reference system and location classification to mitigate the attacks. Our work shows that the current industrial best practices on user location privacy protection are completely broken, and it is critical to address this immediate threat.

I. INTRODUCTION

Location-based social discovery exposes users to serious privacy risks, while industry obfuscation practices had not been adequately scrutinized. The paper shows that regular users can exploit public app information to localize and track targets accurately.

  • Location exposure can reveal habits, interests, activities, relationships, and identities, while enabling spam, reputation damage, blackmail, or physical violence.
  • Existing research emphasizes general location-privacy mechanisms, but real-world LBSN industrial practices had not received sufficient scrutiny.
  • The study finds that attackers can perform high-accuracy involuntary localization and establish accurate user location traces using only publicly available app information.The investigation targets Wechat, Momo, and Skout without requiring hacking or prior social association.
  • FreeTrack geo-located users with mean errors of 51m on Wechat, 25m on Momo, and 130m on Skout across 349 tests.The evaluation used 74 Wechat, 119 Momo, and 156 Skout tests in a three-week attack involving 30 volunteers.
  • The attack can readily recover users’ Top 5 locations, and prior work indicates that more than 50% of individuals may be uniquely identified from their top two locations.

II. LBSN: THE STATE-OF-THE-ART

LBSNs support location-based social discovery through several location-sharing models, including exact sharing, user-authorized sharing, and obfuscated relative information. The section characterizes common obfuscation and location-update practices in popular apps.

  • Classification of LBSNs: Category I LBSNs either openly display exact user locations or let users authorize which people may access them.Banjo, SayHi, I-Am, and iAround exemplify open access, while Google Latitude and PCube exemplify user-authorized sharing.
  • Classification of LBSNs: Category II LBSNs hide exact coordinates through relative-distance display, minimum-accuracy limits, or localization-coverage limits.Wechat, Skout, and Momo use these techniques in different combinations.
  • Location Update in LBSNs: The updating strategy determines how app-reported locations translate underlying GPS, WiFi, or Cell ID accuracy into practical precision, balancing waiting time, precision, and energy.
  • Location Update in LBSNs: Momo confirms a 10m localization limit with distances rounded every 5m, while Skout’s minimum coverage is around 800m with half-mile rounding.
  • Location Update in LBSNs: Wechat shows no distance round-offs, with a clear boundary between every 100m and coverage varying by population density.Coverage can reach 10km in sparse areas and is generally 1000m in dense areas.

C. User Location Privacy in LBSNs

The paper argues that trusting location-hiding techniques creates a privacy risk because a weak attacker can use public relative-distance information to infer users’ locations. Its attacker model distinguishes casual localization from determined tracking.

  • User Location Privacy in LBSNs: Location-hiding techniques may increase privacy risk by encouraging users to share protected information that an adversary can later recover into exact locations or traces.
  • Attacker Model: The attacker uses no more access than a normal LBSN user, cannot compromise servers, and relies on publicly displayed relative distances.The attacker need not be an in-app friend in the considered apps.
  • Attacker Model: A Casual Localization Attacker randomly selects nearby profiles, whereas a Determined Tracking Attacker starts from a known user ID or number.

B. Methodology Overview

The attack treats an LBSN app as a distance oracle by feeding it fake anchor locations, then iteratively applies trilateration to move inferred positions toward the target. A global-scale example completes in five rounds.

  • Methodology Overview: Fake anchor locations turn the LBSN client into a distance oracle that returns distances usable for target localization.
  • Methodology Overview: The attack begins with three random anchors, estimates the target by trilateration, and repeatedly inserts each inferred location as a new reference point.Least-squares estimation is used to reduce distance from the target.
  • Methodology Overview: The iterative algorithm sorts reference points by target distance, estimates a location from the first three, inserts that estimate, and stops when the distance threshold is reached.
  • Methodology Overview: A real-world attack launched from China against a user in Buffalo used anchors in Beijing, Shanghai, and Chengdu, with each intermediate estimate moving closer to the target.The attack took five rounds to finish.

D. Breaking Minimum Distance Limit via Space Partition Attack: Skout and Wechat

The space partition attack breaks minimum-distance protections by repeatedly dividing the target’s possible area and querying which subregion contains the user.

  • Repeatedly partitioning the target’s possible area into halves can refine localization beyond Skout’s 800m and Wechat’s 100m minimum-distance limits.The attack checks whether the target lies within one region and repeats until the desired accuracy is reached.
  • Each round tests a region using relative-distance queries, retaining the half that contains the target and discarding the other.The presentation models the protected area as a box with edge length 2R for simplicity.
  • For coverage-limited apps such as Wechat, FreeTrack first scans possible visiting areas until the target appears in the Nearby list, then launches space partitioning.In a dense 28km2 area, querying at d = 1km requires at most 28 scans.
  • The algorithm starts from an estimated point and range, alternates coordinate partitions, and continues while either coordinate interval exceeds the threshold.Its output is a final estimate T′ for the target T.
  • A social popularity index accelerates attacks by prioritizing locations with larger user populations at the relevant time.The method treats likely user locations as non-uniform across space and time.

IV. IMPLEMENTATION OF FREETRACK

FreeTrack uses automated Android virtual machines, location spoofing, and framework modifications to generate arbitrary anchor locations for cross-platform LBSN attacks.

  • FreeTrack combines a Clojure controller with MonkeyRunner, Android X86 images, VirtualBox, and a LocationFaker app to automate location manipulation.The implementation modifies the Android framework to address location-faking and result-reading problems.
  • Android X86 virtual machines provide faster automated anchor-location generation than QEMU-based Android SDK virtual machines.The spoofed Android device can obtain relative distances to users on Android, iOS, and Windows Phone because the LBSN apps span those platforms.
  • LocationFaker supports different spoofing strategies because apps use either Android’s built-in location APIs or third-party SDKs.Wechat and Skout use built-in APIs, whereas Momo uses Baidu Location SDK.
  • The implementation uses mock location providers and framework changes to satisfy apps’ location-accuracy requirements.Some apps reject spoofed locations when the reported accuracy is too low.

2) Location Spoofing with Network Redirection:

For SDK-based apps, FreeTrack redirects location requests to its own server, then automates client interaction and extracts displayed distances from Android logs.

  • Network redirection handles apps such as Momo that obtain locations through third-party SDKs rather than Android’s built-in APIs.The approach begins by analyzing the app’s network traffic and identifying the location request structure.
  • FreeTrack redirects Baidu Location SDK requests with Iptables NAT to an embedded Jetty server operated by LocationFaker.The redirection returns computed coordinates, radius, error code, and timestamp fields to the app.
  • The system simulates touches, scrolling, numeric input, shell commands, and key presses to trigger location updates and read nearby-user entries.MonkeyRunner scripts execute these operations through the Android client.
  • Framework-level TextView logging replaces OCR, allowing FreeTrack to filter Android logcat output and extract app-reported distances.The authors select text dumping because it is more reliable and accurate in virtual machines.
  • The evaluation measures localization accuracy, attack latency, and recovery of users’ top locations using 30 volunteers over three weeks.Accuracy compares real and inferred locations, while efficiency measures attack-launch latency.

1) Localization Accuracy:

FreeTrack localizes users substantially more accurately than the apps’ stated distance limits, and most attacks finish within 1200 seconds; auxiliary information improves performance further.

  • 1) Localization Accuracy:: 25.8233m average accuracy was achieved for 119 Momo tests, while 129.3674m was achieved for 156 Skout tests despite Skout’s 800m limit.Nearly 60% of Momo attacks were below 20m, and over 70% of Skout localizations were below 120m.
  • 1) Localization Accuracy:: 51.0888m average accuracy was achieved for 74 Wechat tests, with half of users localized within 40m despite its 100m limit.Reported errors can arise from location APIs, provider choices, calculation algorithms, and cached locations.
  • 2) Localization Speed:: More than 80% of attacks for all three apps finished within 1200s.Most execution time was spent waiting for app-server responses; per-query waits were 40s for Wechat, 55s for Momo, and 20s of queuing for Skout.
  • 2) Localization Speed:: Adding social popularity information or approximate initialization areas enhanced localization performance by 1.5 times.The enhancement used popularity for Wechat and approximate regions such as Shanghai for Momo or Skout.
  • B. Real-world Tracking: Tracking Accuracy and Top Location Coverage: The real-world study tracked 30 volunteers across China, Japan, and the United States for three weeks and collected 3395 inferred points.The study compared inferred mobility traces against ground-truth traces recorded every half hour.

1) Tracking Accuracy:

FreeTrack achieves high tracking accuracy across Wechat, Momo, and Skout, while also recovering users’ frequently visited locations over time. Accuracy depends on factors including asynchronous updates, location providers, caching, and differences between real mobility and app usage patterns.

  • Tracking Accuracy: More than 80% of Momo results locate victims within 40m, over 90% of Skout results reach 0–20m or 80–100m, and over half of Wechat results achieve under 60m.These results are reported for asynchronous tracking and are shown in Fig. 8.
  • Tracking Accuracy: FreeTrack’s accuracy is affected by location providers and server-side caching, with Wechat tracking easier in the United States than in China.GPS, Wi-Fi, and Cell ID provide different localization accuracies, while larger Chinese user populations shorten Wechat’s location-cache duration.
  • Top N Location Coverage: Top N location coverage measures overlap between the N most visited reported locations and the N most visited inferred locations.The evaluation treats Top N locations as unordered because inferred ranks may differ from ground-truth ranks.
  • Top N Location Coverage: Only 65% of volunteers’ Top 1 inferred locations exactly matched their ground-truth Top 1 locations because users’ real mobility and app usage patterns differ.The paper compares ground-truth entropy H1 with inferred entropy H2 to characterize this usage-pattern effect.
  • Top N Location Coverage: After three weeks, FreeTrack recovered all volunteers’ Top 1 locations on Momo and achieved high Top 5 coverage overall across the three services.Wechat recovered 71.4% of Top 1 locations, while Skout recovered 60.0% of Top 1 locations; coverage increased with more tracking days.

VI. ATTACKS MITIGATION

The paper discusses limiting location-oracle attacks through location proofs and behavioral anomaly detection. Existing proof techniques are constrained by infrastructure requirements or small effective spatial scales.

  • ATTACKS MITIGATION: The mitigation discussion aims to raise LBSN developers’ location-privacy awareness and encourage more advanced protection techniques.This section frames the proposals as suggestions for limiting attackers’ capabilities.
  • A. Prevention of Using LBSN as Location Oracle: Existing location-proof techniques are less practical for this attack scenario because they require trusted infrastructure or work only at small scales below 100m.The proposed examples use cell towers, Wi-Fi access points, or environmental signals as location tags.
  • B. Detection of Abnormal Users: Service providers can flag anomalous users by comparing location changes and behavior patterns, including unusually frequent changes or excessive short-period queries.The paper notes that Wechat limits queries during a given period and can block misbehaving accounts.

B. A User Controllable Privacy Enhancement Framework

The framework uses grid-based distance obfuscation and location classification to let users tune protection according to location sensitivity while managing utility loss.

  • Distance Obfuscation with Grid Reference System: Grid reference distances represent users by cell centers and use minimum paths between cells, preventing same-cell fake anchors from revealing extra target information.The paper notes that this obfuscation reduces utility because relative distance is central to LBSN functionality.
  • Distance Obfuscation with Grid Reference System: Privacy is defined as the grid distance between real and obfuscated locations.The metric uses LocR and LocO for the real and obfuscated locations, respectively.
  • Distance Obfuscation with Grid Reference System: Utility reaches 1 when displayed real and obfuscated distances to an anchor match, and approaches 0 as their gap nears the tolerated maximum.The displayed-distance gap is constrained by Distmax, the maximum distance the user tolerates.
  • Distance Obfuscation with Grid Reference System: Cell-size changes provide different privacy levels and utilities, evaluated on ground-truth and inferred locations from real-world experiments.Figure 12 presents privacy gain and utility under different cell-size settings.
  • Achieving Privacy and Utility Trade-off via Classification of Users’ Locations: Location classification protects sensitive top locations more strongly while allowing weaker obfuscation for public places such as cafes or bars.Users classify locations into categories with different protection requirements and obfuscation parameters, using dynamically updated visit-frequency profiles.
  • Achieving Privacy and Utility Trade-off via Classification of Users’ Locations: The framework allows users to remove locations publicly in Momo and Wechat, but few users choose this option because they lack awareness of the risks.The paper presents this lack of awareness as a motivation for its work.

VII. RELATED WORK

Prior work addresses location privacy through obfuscation, mix zones, and secure discovery, whereas this paper studies involuntary tracking through LBSN design weaknesses.

  • VII. RELATED WORK: Location-privacy research commonly coarsens spatial or temporal granularity through obfuscation, while mix zones hide locations during pseudonym changes.Other approaches include anonymous service use, cloaking, silent periods, and mix zones.
  • VII. RELATED WORK: Trajectory-inference studies seek private-information re-identification, but this work introduces involuntary tracking of a specific target by anyone using public information.The collected tracking traces can also support user re-identification.
  • VII. RELATED WORK: Secure friend-discovery studies test profile-attribute equality or matching thresholds, addressing a different problem from the paper’s location-tracking attack.The distinction is based on their focus on attribute matching rather than location leakage through LBSN behavior.
  • VII. RELATED WORK: Unlike smartphone-malware research, this attack exploits an LBSN system-design drawback; the authors describe it as the first investigation of location leakage from LBSN apps.The paper distinguishes its threat model from malware on iOS, Android, and Symbian.
  • VIII. CONCLUSION: Experiments on Wechat, Momo, and Skout report range-free, accurate, involuntary tracking and recovery of users’ top five locations, motivating revisions to LBSN privacy practices.The conclusion also calls for greater public awareness and presents the mitigation suggestions as guidance for future app revisions.
Loading 1310.2547v2…