Year: 2024
Type: dissertation
Abstract: Location-based services (LBSs) have transformed social interactions and personal experiences in the digital landscape. The widespread adoption of smartphones, equipped with GPS sensors, has been instrumental in the rapid integration of LBSs into our daily lives. Notably, LBSs stand as among the most popular applications on major app stores, appreciated by users for their capacity to enhance social connectivity. These services enable users to seamlessly connect with others, share locations, and organize meetups, underscoring their significant role in facilitating and enriching social interactions. In this dissertation, we analyze the inherent privacy and security risks associated with the sharing of personal information and geographical locations in LBSs, with a dedicated emphasis on social privacy. Through meticulous analysis, our study systematically explores the extent of data exposure and leaks present in two popular categories in LBSs: fitness tracking social networks (FTSNs) and location-based dating (LBD) apps. In the first part of the dissertation, we address the privacy challenges associated with FTSNs such as Strava. These social networks allow users to record sports activities and share them publicly. Sharing encourages peer interaction but also constitutes a risk, because an activity's start or finish may inadvertently reveal privacy-sensitive locations such as a home or workplace. To mitigate this risk, networks introduced endpoint privacy zones (EPZs), which hide track portions around protected locations. We show that EPZ implementations of major FTSNs remain vulnerable to inference attacks that significantly reduce the effective anonymity provided by the EPZ, and in most cases even reveal the protected location. Our attack leverages distance information leaked in activity metadata, street grid data, and the locations of the entry points into the EPZ. This yields a constrained search space where we use regression analysis to predict protected locations. Our evaluation on 1.4 million Strava activities shows that our attack discovers the protected location for up to 85% of EPZs. Larger EPZs reduce the performance of our attack, while geographically dispersed activities in sparser street grids yield better performance. We propose six different countermeasures that each strike a trade-off between usability and privacy preservation. We also responsibly disclosed our findings and countermeasures to the major networks. In the second part of this dissertation, our focus shifts to LBD apps. These LBD apps enable users to meet new people nearby and online by browsing profiles, which often contain highly personal and sensitive data. We systematically analyze 15 LBD apps to assess the prevalence of privacy risks that can result in abuse by adversarial users who want to stalk, harass, or harm others. Through a manual analysis of these apps, we assess which personal and sensitive data is shared with other users, both as (intended) data exposure and as inadvertent yet powerful leaks in API traffic that is otherwise hidden from a user, violating their mental model of what they share on LBD apps. We also show that 6 apps allow for pinpointing a victim's exact location, enabling physical threats to users' personal safety. All these data exposures and leaks enable targeted or large-scale, long-term, and stealthy profiling and tracking of LBD app users. While privacy policies acknowledge personal data processing, and a tension exists between app functionality and user privacy, significant data privacy risks remain. We recommend user control, data minimization, and API hardening as countermeasures to protect users' privacy. The dissertation concludes with final thoughts on the systematic vulnerabilities in LBSs that we discovered in our research. Additionally, we propose a valorization plan with practical solutions based on our research findings, translating insights into concrete implementations that enhance the security and privacy of users in real-world applications, while considering usability trade-offs. We also outline future research topics, particularly in the context of safeguarding users' location privacy within LBSs. Addressing these challenges is crucial for enhancing user privacy and security in LBS applications. With this dissertation, we aimed to fortify user privacy in LBSs by disclosing identified vulnerabilities to vendors, while also disseminating our findings to the general public to raise awareness.
Source: Lirias
Author: Dhondt, Karel
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W6998643976