“Hey Players, there is a problem…”: On Attribute Inference Attacks against Videogamers

We focus on a subtle privacy issue that affects (potentially hundreds of) millions of videogamers: attribute inference attacks (AIA). Through AIA, evildoers can infer gamers’ private attributes (e.g., age, gender, occupation) by leveraging ingame statistics that are publicly available. Despite some previous research efforts highlighting the practicality of AIA in DOTA2, the overarching gaming community is not yet aware of this threat. We argue that AIA can only be mitigated through the collaboration of the entire videogaming community, and hence all stakeholders should be cognizant of the potential threat of AIA. In this work, we first assess the risk of AIA in a broad range of online video games through a set of (original) criteria that make a game prone to AIA. We further examine some practical ways in which attackers can collect personal user data in order to subsequently correlate it with their publicly available in-game data. Finally, we confirm in a representative user study (n=460) that the gamers are hardly aware of subtle issues related to AIA. In particular, 24% of our participants revealed that they would publicly share their personal data. Clearly, such data can be leveraged by evildoers to launch AIA against other players.

I. Introduction

Video games represent the world’s leading entertainment industry [1], totaling over 250 billion in 2023 [2]. These numbers are driven by the immense popularity of videogames across all age groups, genders, cultures, and income levels [1]: today, over 40% of the World’s population play videogames [3]. Online multi-player videogames, in particular, are preferred [4] to single-player videogames—predominantly due to their intrinsic trait of enabling social interactivity [5–7].