April 28, 2020 – In Breaking News – The Hacker News
Researchers have uncovered a potential means to profile and track online users using a novel approach that combines device identifiers with their biometric information.
The details come from a newly published research titled “Nowhere to Hide: Cross-modal Identity Leakage between Biometrics and Devices” by a group of academics from the University of Liverpool, New York University, The Chinese University of Hong Kong, and University at Buffalo SUNY.
“Prior studies on identity theft only consider the attack goal for a single type of identity, either for device IDs or biometrics,” Chris Xiaoxuan Lu, Assistant Professor at the University of Liverpool, told The Hacker News in an email interview.
“The missing part, however, is to explore the feasibility of compromising the two types of identities simultaneously and deeply understand their correlation in multi-modal IoT environments.”
The researchers presented the findings at the Web Conference 2020 held in Taipei last week.
The prototype and the associated code can be accessed here.
A Compound Data Leakage Attack
The identity leakage mechanism builds on the idea of surreptitious eavesdropping of individuals in cyber-physical spaces over extended periods of time.
In a nutshell, the idea is that a bad actor can exploit the uniqueness of individuals’ biometric information (faces, voices, etc.) and Wi-Fi MAC addresses of smartphones and IoT devices to automatically identify people by drawing a spatial-temporal correlation between the two sets of observations.
modules that operate in a pipelined manner: (1) Multi-modal eavesdropping (2) Device filtering and (3) Cross-modal ID association. “Nowhere to Hide:
Cross-modal Identity Leakage between Biometrics and Devices” Courtesy of Chris Xiaoxuan Lu, Yang Li, Yuanbo Xiangli, and Zhengxiong Li
“The attacker can be either insiders like co-workers who share the same office with victims or outsiders who use their laptops to eavesdrop random victims in a coffee shop,” Xiaoxuan Lu said.
“So launching such an attack is not difficult, considering multi-modal IoT devices are very small and can be disguised well, like a spy camera with Wi-Fi sniffing function.”
“All in all, there is little setup effort on the side of the attacker.”
To mount the attack, the researchers assembled an eavesdropping prototype built on a Raspberry Pi that consisted of an audio recorder, an 8MP camera, and a Wi-Fi sniffer that can capture the device identifiers.
The data collected in this manner not only ascertained that there exists a session attendance similarity between one’s physical biometrics and his/her personal device, but they are also unique enough to isolate a specific individual among several people located in the same space.
Continue reading… Researchers Uncover Novel Way to De-anonymize Device IDs to Users’ Biometrics
AST strives to meet a 3 STAR trustworthiness rating, based on the following criteria:
- Provides named sources
- Reported by more than one notable outlet
- Includes supporting video, direct statements, or photos
