Every Move You Make: Tracking Smartphone Users through Motion Sensors

Online users are increasingly being subjected to privacy-invasive tracking across the web for advertisement and surveillance purposes, using IP addresses, cookies, and browser fingerprinting. As web browsing activity shifts to mobile platforms such as smartphones, traditional browser fingerprinting techniques become less effective due to ephemeral IP addresses and uniform software-base. However, device fingerprinting using built-in sensors offers a new avenue for attack. In this talk, I will describe how motion sensors such as accelerometer and gyroscope, embedded in smartphones, can be exploited to track users online. Next, I will discuss the practical aspects of this attack and how it can be used to track users across different sessions under natural web browsing settings. Finally, I will talk about usable countermeasures that we have developed to protect users against such fingerprinting techniques.