Location-based social networks (LBSNs) feature friend discovery by location proximity that has attracted hundreds of millions of users world-wide. While leading LBSN providers claim the wellprotection of their users' location privacy, for the first time we show through real world attacks that these claims do not hold. In our identified attacks, a malicious individual with the capability of no more than a regular LBSN user can easily break most LBSNs by manipulating location information fed to LBSN client apps and running them as location oracles. We further develop an automated user location tracking system and test it on leading LBSNs including Wechat, Skout, and Momo. We demonstrate its effectiveness and efficiency via a 3 week realworld experiment on 30 volunteers and show that we could geolocate any target with high accuracy and readily recover his/her top 5 locations. Finally, we also develop a framework that explores a grid reference system and location classifications to mitigate the attacks. Our result serves as a critical security reminder of the current LBSNs pertaining to a vast number of users.
Li et al. REF found the privacy-leakage problem of users' geographical location in three popular location-based social networks (LBSNs) including Wechat, Skout, and Momo, and proposed the localization methods.
All your location are belong to us: breaking mobile social networks for automated user location tracking
MobiHoc '14
Computer Science