# Push Attack: Binding Virtual and Real Identities Using Mobile Push Notifications
## 1 Introduction  
Nearly two-thirds of American adults (64%) currently own a smartphone, and more than 91% of smartphone owners aged 18-29 use social networking at least once a week [1]. Facebook has 1.31 billion monthly mobile active users worldwide (44% of them only log in from a mobile device); Twitter has 252 million monthly mobile active users; Instagram 300 million; while the social dating app Tinder has around 50 million active users per month (source: [[http://www.statista.com/](http://www.statista.com/)]([http://www.statista.com/](http://www.statista.com/))). Besides the big players, a myriad of different applications usually reside on people's smartphones, allowing their users to play, interact with other users, watch news, etc. To use services (e.g., online social networking, OSN), users must log in to these applications with their accounts. These form their virtual identities. A virtual identity cannot always be directly traced to the real identity of an OSN user. Pseudonyms represent a simple and easy-to-use way to provide good anonymity. Virtual identities (together with the information associated: political ideas, sexual preferences, etc.) are apparently separated from real identities. In fact, in online social networks, users voluntarily share personal information with the implicit assumption that it is very difficult to link partial information with a person's real identity [2]. This assumption is often false or questionable, as there are many attacks attempting to establish these links: structural re-identification attacks, inference attacks, information aggregation attacks and re-identification attacks [3]. Usually, these techniques use data mining to exploit the correlation among the different information published by one or more people to infer the publisher's real identity. A binding between virtual and real identities can lead to several issues in countries that limit civil rights, where people get persecuted for their online activity, when virtual identities reveal verypersonal or sensitive information or when the real person is a public figure. For this reason, the \"real names\" policy (the policy that obliges users to identify themselves with their real names, banning the use of pseudonyms) adopted by many online platforms over time brought about several complaints from civil liberties groups. Google apologized and reversed its position ([[https://plus.google.com/u/0/+googleplus/posts/V5](https://plus.google.com/u/0/+googleplus/posts/V5) XkYQYYYqy]([https://plus.google.com/u/0/+googleplus/posts/V5](https://plus.google.com/u/0/+googleplus/posts/V5) XkYQYYYqy)) (July 2014), allowing users to pick pseudonyms. Furthermore, Facebook recently promised to pay more heed to real-name complaints (October 2015) ([[https://www.eff.org/deeplinks/2015/11/facebooks-new-name-policy-changes-are-progress-not-perfection](https://www.eff.org/deeplinks/2015/11/facebooks-new-name-policy-changes-are-progress-not-perfection)]([https://www.eff.org/deeplinks/2015/11/facebooks-new-name-policy-changes-are-progress-not-perfection](https://www.eff.org/deeplinks/2015/11/facebooks-new-name-policy-changes-are-progress-not-perfection))). In this work, we present a new attack that expressly targets smartphone users to bind their virtual identities with their real ones. Unlike traditional website/desktop applications, smartphone applications have two unique key features:  
* smartphones follow users everywhere; so the real identity is, in a certain sense, known a priori. * smartphone operating systems implement a push notification service that can be exploited to reveal the virtual identity associated with the device owner as described in this work. These \"push notifications\" can be emitted asynchronously by app servers and reach mobile clients, even if the related application is closed or suspended and if the terminal is on standby. Push notifications typically (but not always) create new messages in the notification bar, to keep the user updated on what has happened since the last time the app was opened.