A Run a Day Won't Keep the Hacker Away: Inference Attacks in Fitness Tracking Social Networks
summary
Claim: endpoint privacy zones on major fitness networks are vulnerable to inference attacks that recover homes/workplaces. Method: filter protected endpoints, fit circles with an adapted k-means circle fitting, use accumulated/total distance metadata and a street graph, then least-absolute-deviation regression plus bootstrapping with 1,000 resamples. Result: tested on ~4,000 Strava users with 87% success and ~22 m median error. Built a client-side sanitizer prototype and give fixes: minimize precision, normalize distances, and harden APIs.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:53Overview of Fitness Tracking
- 3:34Inference Attack 1
- 7:52Intuition Behind Attack 2
- 15:53Data minimization
- 19:12Preventing leaks
- 20:24Fixing API leaks
- 22:10Reducing inferences
- 24:11Solutions
- 26:43Nudge Users
- 29:14Proof of Concept
- 32:47Conclusion
- 34:17Questions
related talks
23mAnalysis of Privacy Protections in Fitness Tracking Social Networks -or- You can run, but can you hide?
24mYou Are Who You Know and How You Behave: Attribute Inference Attacks...
51mA Taste Of Privacy Threat Modeling by Kim Wuyts
03mSolitude: A privacy analysis tool
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
54mSecuring Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables
15mA Closer Look: Evaluating Location Privacy Empirically
32mThe Dangerous Data Anonymization - Keynote