Source-linked AI summary
Mobile Device Identification via Sensor Fingerprinting
Hristo Bojinov, Yan Michalevsky, Gabi Nakibly, Dan Boneh
TL;DR
The paper addresses the need for robust mobile-device identifiers when software identifiers are unavailable or unreliable. It uses sensor-specific hardware variation to fingerprint phones and finds that fingerprints can identify devices among thousands, including through accelerometer measurements accessible to mobile web code.
Problem
Mobile services need reliable repeat-visitor and phone identifiers, but cookies can be cleared or blocked and mobile browsers may be too similar for browser fingerprinting.
Method
The paper fingerprints smartphones using speaker-microphone frequency responses and device-specific accelerometer calibration variations.
Results
Over 10,000 mobile-device measurements produced robust fingerprints that survive hard resets and contain sufficient entropy to identify devices among thousands.
Takeaways & Limitations
Accelerometer fingerprinting can identify devices without traditional hardware identifiers and can be performed by untrusted JavaScript in a mobile browser.
Takeaways & Limitations
Sensor fingerprinting can be mitigated by manufacturing-time calibration or by adding changing random values to sensor outputs at the operating-system level.
Abstract
from arXiv · showhide
We demonstrate how the multitude of sensors on a smartphone can be used to construct a reliable hardware fingerprint of the phone. Such a fingerprint can be used to de-anonymize mobile devices as they connect to web sites, and as a second factor in identifying legitimate users to a remote server. We present two implementations: one based on analyzing the frequency response of the speakerphone-microphone system, and another based on analyzing device-specific accelerometer calibration errors. Our accelerometer-based fingerprint is especially interesting because the accelerometer is accessible via JavaScript running in a mobile web browser without requesting any permissions or notifying the user. We present the results of the most extensive sensor fingerprinting experiment done to date, which measured sensor properties from over 10,000 mobile devices. We show that the entropy from sensor fingerprinting is sufficient to uniquely identify a device among thousands of devices, with low probability of collision.
1 Introduction
The paper addresses unreliable mobile identifiers by fingerprinting persistent sensor imperfections, avoiding traditional hardware IDs. It presents speakerphone-microphone and accelerometer approaches, with experiments showing robust identification potential.
- Mobile identifiers can fail after cookie deletion, private browsing, factory resets, or software-state changes, motivating stronger device identifiers.Existing hardware identifiers such as IMEI and UDID also face platform restrictions or privacy concerns.
- Sensor fingerprints provide device identification independent of software state and without accessing traditional identifiers such as IMEI or UDID.The authors argue that merely disallowing application access to UDID is therefore ineffective as a privacy policy.
- The paper evaluates two sensor approaches: speakerphone-microphone frequency-response distortions and accelerometer calibration errors.The audio fingerprint uses amplitude and frequency distortions, while the accelerometer fingerprint uses six calibration-error values.
- Over 10,000 mobile devices yielded robust fingerprints that survive a hard reset and contain enough entropy to identify devices among thousands.The reported result emphasizes persistence and low collision potential at large scale.
- The accelerometer method is contrasted with vibration-based fingerprinting because it is unaffected by the phone’s surface and case.The speaker-microphone method combines two components, increasing fingerprint entropy relative to fingerprinting loudspeakers alone.
2 Threat Model
The threat model centers on covert sensor fingerprinting by websites, especially when users do not suspect identification is occurring. The focus is the offensive potential of identifying devices without browser storage or permission warnings.
- The paper explicitly focuses on the offensive potential of sensor fingerprinting, while acknowledging both malicious and benevolent uses.
- A malicious website may fingerprint users without browser storage such as cookies and without triggering permission warnings.The website classifies each device as known or new according to whether its fingerprint differs sufficiently from stored fingerprints.
- The model assumes the user accesses the site long enough for fingerprinting while possibly leaving the device unattended or unused.
3 Background
Before sensor fingerprinting, mobile applications rely on operating-system identifiers with platform, availability, mutability, or reset-related restrictions. Android and iOS expose different identifier mechanisms and limitations.
- Android: Android device identification can use IMEI, MEID, ESN, MAC addresses, serial numbers, or ANDROID ID, but availability and persistence vary.Telephony identifiers do not exist on non-telephony devices, MAC addresses can be changed, serial numbers depend on OS version, and ANDROID ID may change after factory reset.
- Android: The ANDROID ID is randomly generated on first boot and remains constant for the device’s lifetime unless a factory reset changes it.
- iOS: iOS identification includes UDID, identifierForVendor, and advertisingIdentifier, each constrained by deprecation, vendor scope, uninstallation, or device erasure.UDID has been deprecated since iOS 5; vendor identifiers can be regenerated after removing a vendor’s applications, and advertising identifiers reset after erasure.
- iOS: MAC addresses remain unsuitable as stable identifiers because device owners can forge them.
4 Use of Sensors for Identification
The paper frames sensor fingerprinting around persistent manufacturing imperfections that bias measurements. It surveys common sensor types, then identifies audio and accelerometer sensing as successful fingerprinting avenues while noting practical obstacles for others.
- Manufacturing and assembly variations create sensor-specific measurement biases that persist throughout a sensor’s life.Measuring these imperfections can therefore consistently identify devices carrying the sensors.
- Linear sensor bias models measurements as vm = vtS + O, where S and O are device-specific sensitivity and offset parameters.Ideally, sensitivity is S = 1 and offset is O = 0; the approximation applies to sensors including accelerometers, gyroscopes, magnetometers, and camera pixels.
- The survey considers linear bias, tolerance, and timing as possible sensor imperfections for identification.Microphone gain variation illustrates tolerance, while device-specific interrupt timing provides a separate potential signal.
- The authors aim to survey commonly available mobile sensors and design identification techniques where practical.
- In practice, some sensor defects are not exposed under normal conditions or lack a baseline measurement needed to calculate bias.
- Two successful fingerprinting attempts use audio from the microphone-speaker system and accelerometer measurements; other sensors presented identification difficulties.
5 Device Identification via the Microphone
The microphone-based fingerprint measures device-specific speaker–microphone frequency responses, then classifies devices using harmonic feedback patterns and maximum-likelihood estimation. Experiments show that responses are similar within a device across locations but differ between devices, while location-dependent variation motivates probabilistic classification.
- 5.1 Fingerprinting Scheme: A device’s fingerprint is its speaker–microphone frequency response, measured by playing tones and recording the resulting microphone signal.The recorded signal captures amplitude and frequency distortions produced by the audio hardware.
- 5.1 Fingerprinting Scheme: The analysis isolates each played frequency and its harmonics using Fourier coefficients from one-second microphone recordings.Measurements use 8000 samples per frequency at the typically supported sampling frequency.
- 5.1 Fingerprinting Scheme: Seven frequency-response values are collected for each harmonic, with the first two harmonics used for comparisons across devices and locations.Feedback ratios are similar but not identical across locations because acoustic surroundings affect the response.
- 5.2 Experiment: L2-Distance Classification: The 16-device experiment found similar processed data for the same device across locations and differences between different devices.Each Motorola Droid was measured at three fixed physical locations.
- 5.2 Experiment: L2-Distance Classification: Second-harmonic response amplitude performed better than first-harmonic feedback in simple L2 classification, while adding first and second derivatives had a negative overall impact.The initial classification accuracy nevertheless left room for improvement.
- 5.3 Experiment: Maximum-Likelihood Classification: Maximum-likelihood classification models each frequency response as normally distributed, estimating device-specific means and variances before selecting the most likely device.The method addresses frequency- and surface-dependent variation that can penalize Euclidean distance calculations.
6 Device ID Using the Accelerometer
The accelerometer fingerprint estimates device-specific calibration parameters from measurements taken while the phone is stationary, including through a mobile-browser JavaScript implementation. Experiments found persistent, distinctive fingerprints that support device recognition, while showing both privacy relevance and scope limitations.
- Fingerprint construction: Six calibration values—sensitivity and offset for each axis—form the accelerometer fingerprint estimated from repeated measurements.The method uses an optimization problem to estimate device-specific scaling and translation errors.
- Web-based profiling: A browser-based JavaScript implementation collects accelerometer readings without requiring installation or special permissions, instructing users to leave the device facing up and down.The implementation handles window.ondevicemotion events, batches suitable readings, and posts the estimated parameters for analysis.
- Fingerprint construction: Stationary measurements use Earth’s gravity as a known baseline, with opposite Z-axis orientations providing the measurements needed to estimate Z-axis parameters.The method can also estimate all six parameters without restricting device orientation when more data and more sophisticated processing are used.
- Initial evaluation: 100% recognition was observed for scaling factors MSz between about 200 and 1000 when comparing devices using weighted squared Euclidean distance.The distance weights differences in sensitivity because offset and sensitivity occupy different numeric ranges.
- Scope and privacy: The entropy estimate used only the Z axis, so reliably measuring X- and Y-axis parameters could increase the identifiable population to millions of devices.This is an explicit scope boundary of the reported entropy experiment, not a demonstrated result for the full three-axis fingerprint.
- Experimental results: Combining User-Agent and accelerometer data identified 1900 devices, or 53%, increasing to 58.7% after removing 95th-percentile distances.The accelerometer fingerprint distinguished devices that shared identical User-Agent strings.
7 Related Work
Prior work fingerprinted devices through software features, remote hardware signals, cameras, flash storage, accelerometers, and loudspeakers. This paper combines loudspeaker and microphone behavior, using short synthesized sounds and the device microphone to make the attack more practical.
- Camera sensor noise patterns and flash-memory coupling or timing defects have also supported device fingerprinting, though eMMC wear-leveling complicates mobile flash fingerprinting.
- Prior web fingerprinting used system configuration, browser features, and HTTP headers, while supercookies stored identifiers outside standard browser controls.
- Remote hardware fingerprinting has used clock skew and wireless-transmitter characteristics, including radiometric, phase, and timing analyses.
- Prior accelerometer fingerprinting analyzed vibration outputs with machine-learning features such as mean, standard deviation, and skewness, while other work focused on loudspeakers.
- Unlike loudspeaker-only schemes, this method fingerprints the combined loudspeaker-microphone system, uses the phone’s microphone instead of an external one, and relies on short synthesized sounds.
8 Conclusions and future work
The paper concludes that mobile devices can be recognized through sensor calibration variations rather than software identifiers that may disappear after a reset. It highlights browser-accessible accelerometer fingerprinting as a privacy risk and identifies several open hardware-fingerprinting questions.
- Sensor calibration variations in the speaker-microphone system and accelerometer enable device recognition without relying on soft identifiers lost after reset.
- Accelerometer-based identification is noteworthy because untrusted code running in a mobile browser can perform it.
- The paper identifies open questions about other fingerprintable hardware, total extractable entropy, parameter distributions, and hardware-based cryptographic keys.
Notes
The notes record methodological qualifications about training-data locations, excluded devices, geographic symmetry, gravity variation, accelerometer defects, and conservative cookie assumptions.
- Location 1 data served as the training set, and the excluded device was not misclassified in the first experiment.
- Results remain similar and symmetric when another location is omitted from the training data.
- Earth’s gravity varies slightly by location, but those small variations can be predicted.
- Because of accelerometer defects, the measured value will most likely not equal g exactly.
- The analysis ignores browser applications that exit and delete cookies because their presence would strictly degrade the reported results, making the analysis conservative.
A Availability
The paper provides a web demonstration for evaluating accelerometer parameters and an Android application for measuring frequency-response ratios. It also describes accelerometer calibration from resting measurements, noisy optimization, and KNN-based identification.
- Availability: Compatible mobile browsers can evaluate Sz and Oz parameters at sensor-id.com and display the resulting measurements as a chart like Figure 10.
- Availability: The Android frequency-response application requires enabling nonmarket applications and installing the APK through USB or another supported mechanism.
- Estimating All Six Bias Parameters: Six arbitrary resting positions provide an alternative for estimating all three accelerometer bias parameters without assuming measurements on the phone’s narrow sides.
- Estimating All Six Bias Parameters: With measurement noise, the calibration equations become inequalities, and multiple measurements are collected to estimate accelerometer deviation parameters.
- Estimating All Six Bias Parameters: Gradient descent estimates Ox, Oy, Oz, Sx, Sy, and Sz from an initial ideal parameter point under reasonable parameter constraints.
- Estimating All Six Bias Parameters: 81.3% correct classification resulted from cross-validating KNN matching between new unlabeled samples and labeled device clusters.
B.1 Experiment: Lab Droids in 3D
The evaluation tested fingerprinting on 5 and 16 devices using both unsupervised clustering and supervised classification, with perfect identification in the smaller clustering setup and some errors at larger scale.
- K-means perfectly identified samples from the same device in the five-device setup.
- With 16 devices, clustering remained good but produced some errors.
- 81.25% of samples were correctly classified with supervised classification across 16 devices.
C Difficulties in Identification Using Some Sensors
The paper reports that several sensors are difficult to use for practical identification because their measurements require challenging procedures or are unstable, noisy, environment-dependent, or user-dependent.
- Gyroscope calibration requires constant angular-velocity rotation at different speeds, which is difficult even in a laboratory.
- Magnetometer identification is practically difficult because memory effects and changing magnetic fields disrupt sensitivity and offset estimates.
- Light-sensor measurements are erratic and noisy because the sensor may be partially obstructed, complicating estimation of imperfections.
- GPS clock-skew identification is constrained because modern receivers use a fourth satellite measurement to account for clock bias.
- Touch-screen misalignment may identify a device, but it is usually too small to measure reliably and may depend heavily on the user.
- Camera pattern-noise identification was demonstrated on only nine cameras, without assessing how many cameras can be distinguished.