Ghost Riders: Sybil Attacks on Crowdsourced Mobile Mapping Services
Ghost Riders: Sybil Attacks on Crowdsourced Mobile Mapping Services
复制标题
DOI：
10.1109/tnet.2018.2818073
复制
发表时间：
2018-06-01
影响因子：
3.7
通讯作者：
Zhao, Ben Y.
中科院分区：
文献类型：
--
作者：
Wang, Gang;Wang, Bolun;Zhao, Ben Y.
实时众包地图，如Waze，提供有关交通、拥堵、事故和兴趣点的及时更新。在本文中，我们演示了如何缺乏强大的位置认证允许创建基于软件的Sybil设备，暴露众包地图系统的各种安全和隐私攻击。我们的实验表明，一个资源有限的Sybil设备可能会对Waze造成严重破坏，报告错误的拥塞和事故，并自动重新路由用户流量。更重要的是，我们描述了大规模生成Sybil设备的技术，创建了能够远程跟踪大量用户群体的精确移动的虚拟车辆军队，同时避免检测。为了防御Sybil设备，我们提出了一种新的方法，基于共址边缘，认证记录，证明了一对设备的一次性物理共址。随着时间的推移，协同定位边缘联合收割机组合形成大的邻近图，证明设备之间的物理交互，允许虚拟车辆的可扩展检测。我们使用大规模模拟演示了这种方法的有效性，以及如何使用它们来显着降低攻击的影响。我们已将研究结果告知Waze/Google团队。目前，我们正在与Waze团队积极合作，以提高其系统的安全性和隐私性。
Real-time crowdsourced maps, such as Waze provide timely updates on traffic, congestion, accidents, and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based Sybil devices that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. To defend against Sybil devices, we propose a new approach based on co-location edges, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, co-location edges combine to form large proximity graphs that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and how they can be used to dramatically reduce the impact of the attacks. We have informed Waze/Google team of our research findings. Currently, we are in active collaboration with Waze team to improve the security and privacy of their system.