1. Location Cheating: A Security Challenge to Location- based Social Network Services Wenbo He 1, Xue Liu 2, Mai Ren 1 1 University of Nebraska-Lincoln 2 McGill University 左昌國 Seminar @ ADLab, NCU-CSIE The 31st Int'l Conference on Distributed Computing Systems (ICDCS 2011)

2. Outline Introduction Location Cheating Attacks Evaluation of Location Cheating on foursquare Possible Solutions against Location Cheating Conclusions 2

3. Introduction Location-based Services(LBS) foursquare Gowalla GyPSii Loopt Brightkite foursquare Launch in March 2009 1.89 million users (August 2010) More than 10,000 new members per day Real world rewards 3

4. Introduction 4

5. 5

6. 6

7. 7

8. 8

9. Business Model of foursquare Progressive reward mechanism Points Badges Mayorship Real-world rewards More than 90% of rewards are only for mayors 9

10. Introduction Possible Location Cheating Scenarios A user may cheat on her location for reasons. Get rewards Impress others by claiming a false location A business owner may use location cheating to check into a competing business, and leaves bad comments. The objectives: Automatically and frequently check into many businesses Venue profile analysis Less competitive “Mayor” selection 10

11. Introduction Cheater Code foursquare adopted Cheater Code to defend against the location cheating attacks. Verify the location of a device Cheater Code rules Frequent check-ins Super human speed Rapid-fire check-ins Others… 11

12. Location Cheating Attacks Location Cheating Against GPS Verification foursquare client applications gets the GPS location data from GPS APIs There are several ways for an attacker to pass the GPS verification by providing the application with fake GPS coordinates. Via GPS APIs Modify the GPS-related APIs in the OS Via GPS module Hardware GPS simulator Via server provided APIs Application APIs provided from foursquare Via device emulator Including the simulated GPS module The experiments of this paper adopt this approach 12

13. Location Cheating Attacks 13

14. Location Cheating Attacks Via device emulator Use “Dalvik Debug Monitor Server”(DDMS) to connect to the emulator and to set GPS coordinates The cheating process Hack the emulator Install and run foursquare application Find the coordinates of the target venue in Google Earth Use DDMS to set the coordinates in the emulator Find the target venue in the list of nearby venues in the foursquare application Check into the target venue Successfully get the points, badges, and mayorship 14

15. Location Cheating Attacks Crawling Data From foursquare Website Users’ profiles and venues’ profiles Crawler Multi-thread crawler Download and process over 7 million webpages 3 Windows PCs(C2D 2.0GHz, 1GB RAM) 1 Ubuntu 8.10 server as the database Crawl 100,000 users per hour (14-16 threads per machine) Crawl 50,000 venues per hour (5-6 threads per machine) In total: 1.89 million users and 5.6 million venues  Update all user profiles in less than 2 days  Update all venue profiles in about 5 days 15

16. Location Cheating Attacks 16 http://foursquare.com/user/123456

17. Location Cheating Attacks Automated Cheating To achieve significant benefits from location cheating, attackers need to control a large number of users and make them check in automatically. Find location coordinates of venues Automatically select a list of venues to check into pass the Cheater Code 17

18. Location Cheating Attacks 18

19. Location Cheating Attacks Semi-automatic location cheating tool Choose a starting point Set the moving direction and distance The tool will search the nearest location Successfully get the points and badges 19

20. Location Cheating Attacks Cheating with Venue Profile Analysis An attacker may select the victim venues that provide special offers to their mayors and don’t have a mayor yet (or are less competitive for mayorship) as targets. Around 1000 venues The attack can also target other user. Stop a user from getting any mayorship Interesting finding: A user is the mayor of 865 venues but with total check-ins of 1265. Most of the 865 venues have no other visitors during the past 60 days. 20

21. Evaluation of Location Cheating on foursquare High Check-in Frequency in Recent Visitor List 21 100

22. Evaluation of Location Cheating on foursquare Low Reward Rate 22 10000.2%

23. Evaluation of Location Cheating on foursquare Suspicious Check-in Patterns 23

24. Possible Solutions against Location Cheating Location Verification Techniques Distance bounding Distance bounding protocols Limitation on transmission range or speed of a communication signal for location verification Requires the deployment of verifiers around the venues. Address mapping Address mapping to geolocate IP addresses Tracert Map Google Location Service Venue side location verification Verify on Wi-Fi router in venues. 24

25. Possible Solutions against Location Cheating Mitigating Threat from Location Cheating Access control for crawling Limit crawling data to logged-in users only Blocking IP address Hiding information from profiles 25

26. Conclusions This paper introduced a novel cheating attack to location- based services. Through real word experiments on foursquare, it shows that the attacking approach works as expected. The counter measures against location cheating in current systems are not perfect. 26