- Teen hits Apple with $1 billion lawsuit over alleged face recognition arrest 4 Years Ago
- John Cornyn tried to attack Patton Oswalt for his old tweets and failed miserably 4 Years Ago
- Logan Paul is selling a pillow of his dead dog—for a good cause 4 Years Ago
- Study: Too much Netflix, not enough ‘chill’ Today 3:36 PM
- Pete Buttigieg under fire for saying incarcerated Americans shouldn’t be allowed to vote Today 2:54 PM
- Vine’s co-founder is beta testing a new app called Byte Today 2:51 PM
- Report: Joe Biden’s first 2020 fundraiser will be with a Comcast executive Today 2:49 PM
- Netflix’s ‘Sabrina’ appears to have an art-copying problem Today 2:47 PM
- People are crying over these cats’ window-sill romance Today 2:27 PM
- The ‘I’m baby’ meme is all about being comforted Today 2:24 PM
- Parody video totally nails what men are like on Tinder Today 1:57 PM
- Twitch star AriLove latest woman to be arbitrarily banned for ‘sexually suggestive’ attire Today 1:47 PM
- The 18 best Korean beauty sheet masks Today 1:25 PM
- Report: 5,000 Twitter bots pushed ‘Russiagate hoax’ after Mueller report Today 11:15 AM
- Google Trends show how differently Notre Dame and Sri Lanka are being mourned Today 10:50 AM
New research suggests that hackers can track subway riders through their phones
There are a few ways to protect yourself.
Underground subways offer no place to hide from hackers.
Determined hackers can track the movements of millions of subway riders around the world even as they go underground by breaking into smartphone motion detectors, new research from Chinese academics reveals. The attack can track subway riders with up to 92 percent accuracy.
The ability to track subway riders represents a significant cybersecurity threat to the tens of millions of people who use public transportation every day. There are more than 5.5 million daily New York City subway passengers, and over half of those people are carrying smartphones, thus exposing themselves to tracking.
“If an attacker can trace a smartphone user for a few days, he may be able to infer the user’s daily schedule and living/working areas and thus seriously threaten her physical safety,” wrote Jingyu Hua, Zhenyu Shen, and Sheng Zhong of Nanjing University, one of China’s oldest universities. “Another interesting example is that if the attacker finds Alice and Bob often visit the same stations at similar non-working times, he may infer that Bob is dating Alice.”
Smartphones have long been considered God’s gift to spies. They offer myriad tracking tools, from the browser to the GPS sensor, and they stay with their owners almost all day, every day.
The new research, which has not yet been peer reviewed, shows hackers can track people without either cell service or GPS, both of which are heavily protected from attackers and often don’t work underground anyway. By contrast, motion sensors, like the accelerometer that enables screen rotation, are much more vulnerable and can give everything away.
Every subway in the world has a unique fingerprint, the researchers said, and every time a train runs between two stations, that fingerprint can be read in the accelerometer, potentially giving attackers access to crucial information.
“The cause is that metro trains run on tracks, making their motion patterns distinguishable from cars or buses running on ordinary roads,” the researchers wrote. “Moreover, due to the fact that there are no two pairs of neighboring stations whose connecting tracks are exactly the same in the real world, the motion patterns of the train within different intervals are distinguishable as well.”
To make this attack a reality, the researchers propose a new attack that learns each subway’s fingerprint and then installs malware on a target’s phone that steals accelerometer readings.
The trio of researchers performed experiments in China by tracking volunteers carrying smartphones through subways in Nanjing. Tracking accuracy reached 70 to 92 percent.
The attack is “more effective and powerful than using GPS or cellular network to trace metro passengers,” the researchers assert. Accelerometers simply aren’t protected the way GPS and cell networks are. An accelerometer can be accessed, run, and read without the user knowing, whereas smartphones display indicators when either GPS or cell service is being used.
There are several defenses against this hack, the most interesting one being power-consumption scrutiny. To track someone using this method, a hacker would have to continuously access the phone’s accelerometer, draining significant power no matter how well the malware was concealed. If you monitor your phone’s power consumption, you should notice when an app is using too much of the battery—possibly for nefarious reasons.
The Chinese research paper can be read below.
Photo via Doc Searls/Flickr (CC BY 2.0)
Patrick Howell O'Neill is a notable cybersecurity reporter whose work has focused on the dark net, national security, and law enforcement. A former senior writer at the Daily Dot, O'Neill joined CyberScoop in October 2016. I am a cybersecurity journalist at CyberScoop. I cover the security industry, national security and law enforcement.