Location Cheating: A Security Challenge to Location-based Social Network ServicesWenbo He1, Xue Liu2, Mai Ren1

1University of Nebraska-Lincoln2McGill University

左昌國Seminar @ ADLab, NCU-CSIE

The 31st Int'l Conference on Distributed Computing Systems (ICDCS 2011)

2

Outline• Introduction• Location Cheating Attacks• Evaluation of Location Cheating on foursquare• Possible Solutions against Location Cheating• Conclusions

3

Introduction• Location-based Services(LBS)

• foursquare• Gowalla• GyPSii• Loopt• Brightkite

• foursquare• Launch in March 2009• 1.89 million users (August 2010)• More than 10,000 new members per day• Real world rewards

4

Introduction

5

Introduction

6

Introduction

7

Introduction

8

Introduction

9

Introduction• Business Model of foursquare

• Progressive reward mechanism• Points• Badges• Mayorship

• Real-world rewards• More than 90% of rewards are only for mayors

10

Introduction• Possible Location Cheating Scenarios

• A user may cheat on her location for reasons.• Get rewards• Impress others by claiming a false location• A business owner may use location cheating to check into a competing

business, and leaves bad comments.• The objectives: Automatically and frequently check into many

businesses• Venue profile analysis• Less competitive “Mayor” selection

11

Introduction• Cheater Code

• foursquare adopted Cheater Code to defend against the location cheating attacks. • Verify the location of a device• Cheater Code rules

• Frequent check-ins• Super human speed• Rapid-fire check-ins• Others…

12

Location Cheating Attacks• Location Cheating Against GPS Verification

• foursquare client applications gets the GPS location data from GPS APIs

• There are several ways for an attacker to pass the GPS verification by providing the application with fake GPS coordinates.• Via GPS APIs

• Modify the GPS-related APIs in the OS• Via GPS module

• Hardware• GPS simulator

• Via server provided APIs• Application APIs provided from foursquare

• Via device emulator• Including the simulated GPS module• The experiments of this paper adopt this approach

13

Location Cheating Attacks

14

Location Cheating Attacks• Via device emulator

• Use “Dalvik Debug Monitor Server”(DDMS) to connect to the emulator and to set GPS coordinates

• The cheating process• Hack the emulator• Install and run foursquare application• Find the coordinates of the target venue in Google Earth• Use DDMS to set the coordinates in the emulator• Find the target venue in the list of nearby venues in the foursquare

application• Check into the target venue

• Successfully get the points, badges, and mayorship

15

Location Cheating Attacks• Crawling Data From foursquare Website

• Users’ profiles and venues’ profiles• Crawler

• Multi-thread crawler• Download and process over 7 million webpages• 3 Windows PCs(C2D 2.0GHz, 1GB RAM)• 1 Ubuntu 8.10 server as the database• Crawl 100,000 users per hour (14-16 threads per machine)• Crawl 50,000 venues per hour (5-6 threads per machine)

• In total: 1.89 million users and 5.6 million venuesUpdate all user profiles in less than 2 daysUpdate all venue profiles in about 5 days

16

Location Cheating Attacks

http://foursquare.com/user/123456

17

Location Cheating Attacks• Automated Cheating

• To achieve significant benefits from location cheating, attackers need to control a large number of users and make them check in automatically.• Find location coordinates of venues• Automatically select a list of venues to check into pass the Cheater

Code

18

Location Cheating Attacks

19

Location Cheating Attacks• Semi-automatic location cheating tool

• Choose a starting point• Set the moving direction and distance• The tool will search the nearest location

• Successfully get the points and badges

20

Location Cheating Attacks• Cheating with Venue Profile Analysis

• An attacker may select the victim venues that provide special offers to their mayors and don’t have a mayor yet (or are less competitive for mayorship) as targets.• Around 1000 venues

• The attack can also target other user.• Stop a user from getting any mayorship

• Interesting finding:• A user is the mayor of 865 venues but with total check-ins of 1265.• Most of the 865 venues have no other visitors during the past 60 days.

21

Evaluation of Location Cheating on foursquare

• High Check-in Frequency in Recent Visitor List

100

22

Evaluation of Location Cheating on foursquare

• Low Reward Rate

1000 0.2%

23

Evaluation of Location Cheating on foursquare

• Suspicious Check-in Patterns

24

Possible Solutions against Location Cheating

• Location Verification Techniques• Distance bounding

• Distance bounding protocols• Limitation on transmission range or speed of a communication signal for

location verification• Requires the deployment of verifiers around the venues.

• Address mapping• Address mapping to geolocate IP addresses

• Tracert Map• Google Location Service

• Venue side location verification• Verify on Wi-Fi router in venues.

25

Possible Solutions against Location Cheating

• Mitigating Threat from Location Cheating• Access control for crawling

• Limit crawling data to logged-in users only• Blocking IP address

• Hiding information from profiles

26

Conclusions• This paper introduced a novel cheating attack to location-

based services.• Through real word experiments on foursquare, it shows

that the attacking approach works as expected.• The counter measures against location cheating in current

systems are not perfect.