Potential mass surveillance and privacy violations in proximity-based social applications

TL;DR

This paper investigates privacy risks in proximity-based social apps, demonstrating how shared location data can be exploited through multilateration and social profiling to identify and track users' movements and identities.

Contribution

It introduces formal multilateration and social attack methods to reveal privacy vulnerabilities in popular proximity-based social applications.

Findings

Multilateration attack can accurately locate users using shared distance data.

Social profiling using Facebook likes can identify users' real identities.

Attacks enable tracking of user movements and habits over time.

Abstract

Proximity-based social applications let users interact with people that are currently close to them, by revealing some information about their preferences and whereabouts. This information is acquired through passive geo-localisation and used to build a sense of serendipitous discovery of people, places and interests. Unfortunately, while this class of applications opens different interactions possibilities for people in urban settings, obtaining access to certain identity information could lead a possible privacy attacker to identify and follow a user in their movements in a specific period of time. The same information shared through the platform could also help an attacker to link the victim's online profiles to physical identities. We analyse a set of popular dating application that shares users relative distances within a certain radius and show how, by using the information shared on these platforms, it is possible to formalise a multilateration attack, able to identify the user actual position. The same attack can also be used to follow a user in all their movements within a certain period of time, therefore identifying their habits and Points of Interest across the city. Furthermore we introduce a social attack which uses common Facebook likes to profile a person and finally identify their real identity.