Devices that tell on you: privacy trends in consumer ubiquitous computing

  • Authors:
  • T. Scott Saponas;Jonathan Lester;Carl Hartung;Sameer Agarwal;Tadayoshi Kohno

  • Affiliations:
  • University of Washington;University of Washington;University of Washington;University of Washington;University of Washington

  • Venue:
  • SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

We analyze three new consumer electronic gadgets in order to gauge the privacy and security trends in mass-market UbiComp devices. Our study of the Slingbox Pro uncovers a new information leakage vector for encrypted streaming multimedia. By exploiting properties of variable bitrate encoding schemes, we show that a passive adversary can determine with high probability the movie that a user is watching via her Slingbox, even when the Slingbox uses encryption. We experimentally evaluated our method against a database of over 100 hours of network traces for 26 distinct movies. Despite an opportunity to provide significantly more location privacy than existing devices, like RFIDs, we find that an attacker can trivially exploit the Nike+iPod Sport Kit's design to track users; we demonstrate this with a GoogleMaps-based distributed surveillance system. We also uncover security issues with the way Microsoft Zunes manage their social relationships. We show how these products' designers could have significantly raised the bar against some of our attacks. We also use some of our attacks to motivate fundamental security and privacy challenges for future UbiComp devices.