Attacks & Countermeasures of Ultrasonic Cross-Device Tracking

Talking Behind Your Back
Attacks & Countermeasures of
Ultrasonic Cross-Device Tracking
Vasilios Mavroudis
Doctoral Researcher UCL

Contents
•
•
•
•
•
•

Who we are

The Story of a Product
•
•
•

The Story of a Product
•
•
•
•

The Story of a Product
•
•
•
•
•

FTC Cross-Device Tracking Workshop, Nov 16, 2015 (Washington, DC)

The Story of a Product
•
•
•
•
•
•

Unhappy
Proactive
Unconcerned

The Story of a Product
•
•
•
•
•
•
•

The Story of a Product
•
•
•
•
•
•
•
•

The Tip of the Iceberg
•
•
•
•
•

The Ultrasound Tracking Ecosystem
•
•
•
•
•

uBeacons
•
•
•
•
•

uBeacons: Technical Details
•
•
•
•
•
•
•

uBeacons: Practical Details
•
•
•
•

Cross-Device Tracking: Overview

Cross-Device Tracking: Details
•
•
•
•
•
•

Ultrasound Cross-Device Tracking
•
•
•
•
•
•
•
•

Ultrasound Cross-Device Tracking

Ultrasound Cross-Device Tracking

Ultrasound Cross-Device Tracking
•
•

Proximity Marketing
•
•
•
•
•
•

Other Use Cases
•
•
•
•
•
•

Exploitation!
•
•

The Attacker’s Toolchest
•
•
•
•

The Attacker’s Toolchest
•
•

The Tor de-anonymization Attack

The Tor de-anonymization Attack

The Demo Explained
•
•

The Demo Explained
•
•
•
•
•

More Attacks
•
•
•
•

Security Evaluation
•
•
•
•

Security Evaluation
•
•
•
•
•

Security Evaluation
•
•
•
•
•

Security Evaluation
•
•
•
•
•

Security Evaluation
•
•
•
•

May 10, 2016

Aug 31, 2016

July 19, 2016

Oct 17, 2016

Market Penetration
•
•
•
•
•
•
•
•

Countermeasures

Browser Extension
•
•
•
•
•
•

Android Permission
•
•
•
•
•

Tor Bug Tracker

Securing the Ecosystem
•
•
•
•
•

Securing the Ecosystem
•
•
•
•
•

Conclusions: What we did
•
•
•
•
•
•

Conclusions: What’s left to do!
•

Conclusions: What’s left to do!
•
•

Q & A