I know where you are and what you are sharing: exploiting P2P communications to invade users' privacy
I know where you are and what you are sharing: exploiting P2P communications to invade users' privacy
复制标题
DOI：
10.1145/2068816.2068822
复制
发表时间：
2011-09
期刊：
影响因子：
--
通讯作者：
Stevens Le Blond;Chao Zhang;A. Legout;K. Ross;Walid Dabbous
中科院分区：
文献类型：
--
作者：
Stevens Le Blond;Chao Zhang;A. Legout;K. Ross;Walid Dabbous
在本文中，我们展示了如何利用实时通信应用程序来确定目标用户的IP地址。我们的研究重点是Skype，尽管其他实时通信应用程序可能存在类似的隐私问题。我们首先设计了一个方案，该方案隐蔽地呼叫被识别的目标用户来找到他的IP地址，即使他在NAT之后也可以这样做。通过定期呼叫用户，我们可以观察用户的移动性。我们展示了如何扩展该方案以观察数万用户的移动模式。我们还考虑了链接性威胁，在这种威胁中，被识别的用户被链接到他的互联网使用。我们通过结合Skype和BitTorrent来说明这一威胁，以说明确定已识别用户的文件共享使用情况是可能的。我们设计了一种基于IP数据报的标识字段的方案，以高精度地验证被识别的用户是否参与了特定的Torrent。我们的结论是，任何互联网用户都可以利用Skype，以及潜在的其他实时通信系统，来观察数千万已识别用户的移动性和文件共享使用情况。
In this paper, we show how to exploit real-time communication applications to determine the IP address of a targeted user. We focus our study on Skype, although other real-time communication applications may have similar privacy issues. We first design a scheme that calls an identified-targeted user inconspicuously to find his IP address, which can be done even if he is behind a NAT. By calling the user periodically, we can then observe the mobility of the user. We show how to scale the scheme to observe the mobility patterns of tens of thousands of users. We also consider the linkability threat, in which the identified user is linked to his Internet usage. We illustrate this threat by combining Skype and BitTorrent to show that it is possible to determine the filesharing usage of identified users. We devise a scheme based on the identification field of the IP datagrams to verify with high accuracy whether the identified user is participating in specific torrents. We conclude that any Internet user can leverage Skype, and potentially other real-time communication systems, to observe the mobility and filesharing usage of tens of millions of identified users.