Analysis of privacy protections in fitness tracking applications

Mobile fitness tracking apps allow users to track their workouts and share them with friends through online social networks. Although the sharing of personal data is an inherent risk in all social networks, the dangers presented by sharing personal workouts comprised of geospatial and health data may prove especially grave. While fitness apps offer a variety of privacy features, at present it is unclear if these countermeasures are sufficient to thwart a determined attacker, nor is it clear how many of their users are at risk. In this work, we perform a systematic analysis of privacy behaviors and threats in fitness tracking social networks. Collecting a month-long snapshot of public posts to the popular Strava fitness tracking service (21 million posts, 3 million users), we observe that 16.5% of users make use of Endpoint Privacy Zones (EPZs), which conceal fitness activity nearby user-designated sensitive locations (e.g., home, office). We go on to develop an attack against EPZs that infers users’ protected locations from the remaining available information in public posts, discovering that 95.1% of moderately active users are at risk of having their protected locations extracted by an attacker. Finally, we consider the efficacy of state-of-the-art privacy mechanisms through adapting geo-indistinguishability techniques as well as developing a novel EPZ fuzzing technique. Strava has been notified of the discovered vulnerabilities and (at time of submission) is preparing to incorporate our countermeasures into their production system.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Computer Science

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2018

Author dc:creator

• Hussain, Muhammad Saad

Contributors dc:contributor

• Bates, Adam

• Location Privacy, Fitness Tracking Applications

Statement dc:rights

• Copyright 2018 Muhammad Hussain

Language dc:language

en

Handle dc:identifier

http://hdl.handle.net/2142/101232

OAI identifier oai:identifier

oai:www.ideals.illinois.edu:2142/101232