location cheating: a security challenge to location-based social network services
Post on 25-Feb-2016
27 Views
Preview:
DESCRIPTION
TRANSCRIPT
Location Cheating: A Security Challenge to Location-based Social Network ServicesWenbo He1, Xue Liu2, Mai Ren1
1University of Nebraska-Lincoln2McGill University
左昌國Seminar @ ADLab, NCU-CSIE
The 31st Int'l Conference on Distributed Computing Systems (ICDCS 2011)
2
Outline• Introduction• Location Cheating Attacks• Evaluation of Location Cheating on foursquare• Possible Solutions against Location Cheating• Conclusions
3
Introduction• Location-based Services(LBS)
• foursquare• Gowalla• GyPSii• Loopt• Brightkite
• foursquare• Launch in March 2009• 1.89 million users (August 2010)• More than 10,000 new members per day• Real world rewards
4
Introduction
5
Introduction
6
Introduction
7
Introduction
8
Introduction
9
Introduction• Business Model of foursquare
• Progressive reward mechanism• Points• Badges• Mayorship
• Real-world rewards• More than 90% of rewards are only for mayors
10
Introduction• Possible Location Cheating Scenarios
• A user may cheat on her location for reasons.• Get rewards• Impress others by claiming a false location• A business owner may use location cheating to check into a competing
business, and leaves bad comments.• The objectives: Automatically and frequently check into many
businesses• Venue profile analysis• Less competitive “Mayor” selection
11
Introduction• Cheater Code
• foursquare adopted Cheater Code to defend against the location cheating attacks. • Verify the location of a device• Cheater Code rules
• Frequent check-ins• Super human speed• Rapid-fire check-ins• Others…
12
Location Cheating Attacks• Location Cheating Against GPS Verification
• foursquare client applications gets the GPS location data from GPS APIs
• There are several ways for an attacker to pass the GPS verification by providing the application with fake GPS coordinates.• Via GPS APIs
• Modify the GPS-related APIs in the OS• Via GPS module
• Hardware• GPS simulator
• Via server provided APIs• Application APIs provided from foursquare
• Via device emulator• Including the simulated GPS module• The experiments of this paper adopt this approach
13
Location Cheating Attacks
14
Location Cheating Attacks• Via device emulator
• Use “Dalvik Debug Monitor Server”(DDMS) to connect to the emulator and to set GPS coordinates
• The cheating process• Hack the emulator• Install and run foursquare application• Find the coordinates of the target venue in Google Earth• Use DDMS to set the coordinates in the emulator• Find the target venue in the list of nearby venues in the foursquare
application• Check into the target venue
• Successfully get the points, badges, and mayorship
15
Location Cheating Attacks• Crawling Data From foursquare Website
• Users’ profiles and venues’ profiles• Crawler
• Multi-thread crawler• Download and process over 7 million webpages• 3 Windows PCs(C2D 2.0GHz, 1GB RAM)• 1 Ubuntu 8.10 server as the database• Crawl 100,000 users per hour (14-16 threads per machine)• Crawl 50,000 venues per hour (5-6 threads per machine)
• In total: 1.89 million users and 5.6 million venuesUpdate all user profiles in less than 2 daysUpdate all venue profiles in about 5 days
17
Location Cheating Attacks• Automated Cheating
• To achieve significant benefits from location cheating, attackers need to control a large number of users and make them check in automatically.• Find location coordinates of venues• Automatically select a list of venues to check into pass the Cheater
Code
18
Location Cheating Attacks
19
Location Cheating Attacks• Semi-automatic location cheating tool
• Choose a starting point• Set the moving direction and distance• The tool will search the nearest location
• Successfully get the points and badges
20
Location Cheating Attacks• Cheating with Venue Profile Analysis
• An attacker may select the victim venues that provide special offers to their mayors and don’t have a mayor yet (or are less competitive for mayorship) as targets.• Around 1000 venues
• The attack can also target other user.• Stop a user from getting any mayorship
• Interesting finding:• A user is the mayor of 865 venues but with total check-ins of 1265.• Most of the 865 venues have no other visitors during the past 60 days.
21
Evaluation of Location Cheating on foursquare
• High Check-in Frequency in Recent Visitor List
100
22
Evaluation of Location Cheating on foursquare
• Low Reward Rate
1000 0.2%
23
Evaluation of Location Cheating on foursquare
• Suspicious Check-in Patterns
24
Possible Solutions against Location Cheating
• Location Verification Techniques• Distance bounding
• Distance bounding protocols• Limitation on transmission range or speed of a communication signal for
location verification• Requires the deployment of verifiers around the venues.
• Address mapping• Address mapping to geolocate IP addresses
• Tracert Map• Google Location Service
• Venue side location verification• Verify on Wi-Fi router in venues.
25
Possible Solutions against Location Cheating
• Mitigating Threat from Location Cheating• Access control for crawling
• Limit crawling data to logged-in users only• Blocking IP address
• Hiding information from profiles
26
Conclusions• This paper introduced a novel cheating attack to location-
based services.• Through real word experiments on foursquare, it shows
that the attacking approach works as expected.• The counter measures against location cheating in current
systems are not perfect.
top related