# Push Attack: Binding Virtual and Real Identities Using Mobile Push Notifications
## 1 Introduction
### Use Cases  
We believe the attack described in this paper can be applied to many scenarios. We propose three reference use cases.  
Marketing Campaigns  
Customer profiling and tracking comprise an important asset for OSNs where business is mainly targeted to selling specific advertisements. Evaluating the conversion rate from the outcome of a social media campaign (involving virtual identities) into the number of real customers (involving real identities) represents a big issue for business intelligence. A technique that fills this gap will certainly be of interest.  
An exemplary use case is determining how many Facebook contacts expressing their will to participate in an event (a concert, show or demonstration) really attend it. Another is identifying the Facebook profile names of the people in a supermarket. This clearly opens several ethical issues. It does though go in the same direction (even if maybe crossing the line) as location analytic services where WiFi-enabled smartphones can be used to indicate customer presence. Indeed, both commercial (e.g., Cisco Meraki CMX [5] or open source (e.g., [6]) software exists that identifies presence, time spent and repeat visits within the range of a WiFi access point by sniffing and analyzing smartphones' 802.11 probe requests.  
Figure 1: Push notifications: default behavior of popular mobile applications. (**a**) Google Play Service screen showing heartbeat and connection status; (**b**) default Facebook notification settings; (**c**) default Twitter notification settings; (**d**) push notification through Chrome mobile web browser.  
Working Place  
Employee productivity is an important driver for a business' continued viability. However, according to a work survey ([[http://www.forbes.com/sites/cherylsnppconner/2013/09/07/who-wastes-the-most-time-at-work/#179c48757b3a](http://www.forbes.com/sites/cherylsnppconner/2013/09/07/who-wastes-the-most-time-at-work/#179c48757b3a)]([http://www.forbes.com/sites/cherylsnppconner/2013/09/07/who-wastes-the-most-time-at-work/#179c48757b3a](http://www.forbes.com/sites/cherylsnppconner/2013/09/07/who-wastes-the-most-time-at-work/#179c48757b3a))), 64% of employees visit non-work related websites daily. More than 61 % of workers spend at least one hour per day on these websites. Tumblr, Facebook and Twitter account for the greater share of this category.  
Conversely, employee privacy is a fundamental right covered by employment laws in many countries all over the world. Employer surveillance versus employee privacy is indeed an open issue [7].  
The privacy attack presented in this paper can reveal the virtual identity of an employee even if they use a pseudonym and a ciphered channel to connect to an OSN. In a workplace, the attack's feasibility increases thanks to the control on the employee's Internet access exercised by the boss, making eavesdropping easy.  
Government Monitoring  
All major OSNs offer tools for law enforcement and publish governments' information requests for transparency (e.g., Twitter Transparency Reports). At the same time, OSNs have been used to organize riots and protests against governments (2011 Arab Spring Riots) and even to recruit terrorists and to organize attacks (2015 terrorist attack in France and Belgium). This motivates the necessity for governments to reveal users' identities and track the real position of OSN users.  
The attack presented in this work can be applied in such scenarios to track the owners of OSN virtual identities. Having control at the ISP level, and without any right to ask for this information from the OSN owner companies, governments can track down dissidents for licit or illicit purposes. The proposed attack can also be used when collaboration with the OSN is not feasible e.g., darknets or where data retention is not available/implemented by the OSN.