All your location are belong to us: breaking mobile social networks for automated user location tracking
All your location are belong to us: breaking mobile social networks for automated user location tracking
复制标题
DOI：
10.1145/2632951.2632953
复制
发表时间：
2013-10
期刊：
影响因子：
--
通讯作者：
M. Li;Haojin Zhu;Zhaoyu Gao;Si Chen;Le Yu;Shangqian Hu;K. Ren
中科院分区：
文献类型：
--
作者：
M. Li;Haojin Zhu;Zhaoyu Gao;Si Chen;Le Yu;Shangqian Hu;K. Ren
基于位置的社交网络（LBSNs）的特点是通过位置接近度来发现朋友，这已经吸引了全球数亿用户。虽然领先的LBSN提供商声称他们的用户的位置隐私得到了很好的保护，但我们第一次通过真实的世界攻击表明，这些说法并不成立。在我们确定的攻击中，一个能力不超过普通LBSN用户的恶意个人可以通过操纵提供给LBSN客户端应用程序的位置信息并将其作为位置预言机运行来轻松破坏大多数LBSN。我们进一步开发了一个自动化的用户位置跟踪系统，并在包括微信，Skout和莫莫在内的领先LBS上进行了测试。我们通过对30名志愿者进行为期3周的真实世界实验来证明其有效性和效率，并表明我们可以高精度地地理定位任何目标，并很容易恢复他/她的前5个位置。最后，我们还开发了一个框架，探讨了网格参考系统和位置分类，以减轻攻击。我们的结果是对当前大量用户使用的LBSN的重要安全提醒。
Location-based social networks (LBSNs) feature friend discovery by location proximity that has attracted hundreds of millions of users world-wide. While leading LBSN providers claim the well-protection of their users' location privacy, for the first time we show through real world attacks that these claims do not hold. In our identified attacks, a malicious individual with the capability of no more than a regular LBSN user can easily break most LBSNs by manipulating location information fed to LBSN client apps and running them as location oracles. We further develop an automated user location tracking system and test it on leading LBSNs including Wechat, Skout, and Momo. We demonstrate its effectiveness and efficiency via a 3 week real-world experiment on 30 volunteers and show that we could geo-locate any target with high accuracy and readily recover his/her top 5 locations. Finally, we also develop a framework that explores a grid reference system and location classifications to mitigate the attacks. Our result serves as a critical security reminder of the current LBSNs pertaining to a vast number of users.