Ghost Riders: Sybil Attacks on Crowdsourced Mobile Mapping Services

Gang Wang, Bolun Wang, Tianyi Wang, Ana Nika, Haitao Zheng, Ben Y. Zhao

Research output: Contribution to journalArticlepeer-review

Abstract

Real-time crowdsourced maps, such as Waze provide timely updates on traffic, congestion, accidents, and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based Sybil devices that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. To defend against Sybil devices, we propose a new approach based on co-location edges, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, co-location edges combine to form large proximity graphs that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and how they can be used to dramatically reduce the impact of the attacks. We have informed Waze/Google team of our research findings. Currently, we are in active collaboration with Waze team to improve the security and privacy of their system.

Original languageEnglish (US)
Pages (from-to)1123-1136
Number of pages14
JournalIEEE/ACM Transactions on Networking
Volume26
Issue number3
DOIs
StatePublished - Jun 2018
Externally publishedYes

Keywords

  • crowdsourcing
  • location privacy
  • Online social networks
  • Sybil attack

ASJC Scopus subject areas

  • Software
  • Computer Science Applications
  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Ghost Riders: Sybil Attacks on Crowdsourced Mobile Mapping Services'. Together they form a unique fingerprint.

Cite this