MagneticSpy: Exploiting Magnetometer in Mobile Devices for Website and Application Fingerprinting

TL;DR

This paper demonstrates that magnetometer sensors in mobile devices can be exploited as a side-channel to identify applications and web pages with high accuracy, posing privacy risks despite restrictions on access to other data.

Contribution

It introduces a novel side-channel attack using magnetometer data caused by CPU activity, effective across many device models, revealing sensitive user activity without permissions.

Findings

Successful identification of opened applications with up to 90% accuracy

Web page loading can be detected with up to 91% accuracy

The attack works on 56 out of 80 tested device models

Abstract

Recent studies have shown that aggregate CPU usage and power consumption traces on smartphones can leak information about applications running on the system or websites visited. In response, access to such data has been blocked for mobile applications starting from Android 8. In this work, we explore a new source of side-channel leakage for this class of attacks. Our method is based on the fact that electromagnetic activity caused by mobile processors leads to noticeable disturbances in magnetic sensor measurements on mobile devices, with the amplitude being proportional to the CPU workload. Therefore, recorded sensor data can be analyzed to reveal information about ongoing activities. The attack works on a number of devices: we evaluated 80 models of modern smartphones and tablets and observed the reaction of the magnetometer to the CPU activity on 56 of them. On selected devices we were able to successfully identify which application has been opened (with up to 90% accuracy) or which web page has been loaded (up to 91% accuracy). The presented side channel poses a significant risk to end users' privacy, as the sensor data can be recorded from native apps or even from web pages without user permissions. Finally, we discuss possible countermeasures to prevent the presented information leakage.