Tracking Mobile Web Users Through Motion Sensors: Attacks and Defenses
Anupam Das, Nikita Borisov, Matthew Caesar · 2016
Modern smartphones contain motion sensors, such as accelerometers and gyroscopes.These sensors have many useful applications; however, they can also be used to uniquely identify a phone by measuring anomalies in the signals, which are a result of manufacturing imperfections.Such measurements can be conducted surreptitiously by web page publishers or advertisers and can thus be used to track users across applications, websites, and visits.We analyze how well sensor fingerprinting works under realworld constraints.We first develop a highly accurate fingerprinting mechanism that combines multiple motion sensors and makes use of inaudible audio stimulation to improve detection.We evaluate this mechanism using measurements from a large collection of smartphones, in both lab and public conditions.We then analyze techniques to mitigate sensor fingerprinting either by calibrating the sensors to eliminate the signal anomalies, or by adding noise that obfuscates the anomalies.We evaluate the impact of calibration and obfuscation techniques on the classifier accuracy; we also look at how such mitigation techniques impact the utility of the motion sensors.Roadmap.The remainder of this paper is organized as follows.We present background information and related work in Section II.In Section III, we briefly discuss why accelerometers and gyroscopes can be used to generate unique fingerprints.In Section IV, we describe the different temporal and spectral features considered in our experiments, along with the classification algorithms and metrics used in our evaluations.We present our fingerprinting results in Section V. Section VI describes our countermeasure techniques to sensor fingerprinting.Section VII discusses some limitations of our approach.Finally, we conclude in Section VIII.