Effective Mobile Web User Fingerprinting via Motion Sensors

Motion sensors are often equipped on smartphones to enable rich app functionality and interactivity. However, they can also be exploited by attackers as powerful side-channels to compromise users' security and privacy due to the unrestricted sensor data access on modern smartphone platforms. In this paper, we investigate motion sensor based user fingerprinting attacks that can be pervasively performed to severely compromise the privacy of mobile web users. We formulate our user fingerprinting attacks as a typical multi-class classification problem, and design a framework with unified classifiers for effectively performing the attacks. We implement our attacking framework and evaluate it using the motion sensor data collected from 20 volunteers. The evaluation results demonstrate that our attacks are indeed very effective. For example, the user fingerprinting accuracy is higher than 85% by using a classifier unified from seven randomly selected individual classifiers each trained with the motion sensor data of only 10 letter keystrokes.