the high school profiling attack: how privacy laws can increase minors’ risk
DESCRIPTION
The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk. Ratan Dey, Yuan Ding, Keith W. Ross Dept. of Computer Science and Engineering. Third-Party Profiling of Children. Question: - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/1.jpg)
The High School Profiling Attack: How Privacy Laws Can Increase
Minors’ RiskRatan Dey, Yuan Ding, Keith W. Ross
Dept. of Computer Science and Engineering
![Page 2: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/2.jpg)
Third-Party Profiling of ChildrenQuestion:
Is it possible to automatically build detailed profiles of most of the teenagers (ages 12-17) in a target high school?
Profiles might include:
• Full name, gender, birth year, current school name, school year
• Home street address, photo of home• SkypeID, email address• Names and profiles of family members; names and
profiles of school friends• Interests, wall postings, hundreds of photos
![Page 3: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/3.jpg)
The Danger
Data brokers:• sell profiles to advertisers,
spammers, malware distributors, employment agencies, college admission offices.
• teen market surpasses $200B in USPedophiles:• many already luring victims with FacebookSpear-phishing attacks:• Large-scale, automated and highly
personalized
![Page 4: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/4.jpg)
Natural Approach: Begin w/ Facebook
• Find a child on FB, download his information.
• Visit his friends’ pages.• Repeat with friends.
• Then try to enhance profiles with other sources.
![Page 5: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/5.jpg)
What a stranger sees about a minor:
![Page 6: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/6.jpg)
What a stranger sees about an adult
![Page 7: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/7.jpg)
Default and Worst-Case Information Available to
Strangersin Facebook
![Page 8: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/8.jpg)
Challenge
• For a given high school, how do we find the students in Facebook and build profiles???
–Minors are not searchable by school in FB
– Only name, profile photo, cover photo album, and gender available for minor.
![Page 9: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/9.jpg)
Attack Ingredients
• COPPA, a law designed to protect the privacy of children, indirectly facilitates the attack.
• “Reverse Friend Lookup,” an attacker can infer a user’s friends even if the user’s friend list is private.
• High-school students tend to have a relatively large number of friends from the same high school in the same graduating class year.
![Page 10: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/10.jpg)
Children’s
Online
Privacy
Protection
Act
Some children lie about their ages
![Page 11: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/11.jpg)
High-School Profiling Attack
• Pick target HS• Search FB by HS– Mostly get adults (alumni)– But get some lying minors w/ future
grad year: “core users”
• Collect all friends of core users: “candidates”
• Identify candidates with many friends in core set
![Page 12: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/12.jpg)
Identify candidates w/ many core friends
core
use
rs
candid
ate
stud
en
ts
![Page 13: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/13.jpg)
Lying minors in 10th
grade in Springfield HS
Harry likely:• lives in Springfield• goes to Springfield High• 10th grade• 16 years old• friends with Lisa, Etienne
Honest minor:name and pic
Honest minors are vulnerable
![Page 14: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/14.jpg)
Data sets – One private & two public high schools
![Page 15: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/15.jpg)
Estimating the crawling efforts
![Page 16: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/16.jpg)
High-School #1• 362 students; found FB pages for 325• Attack:18 core users; 6,282
candidates
Top 300 has 75% w/ 22%
false negatives
![Page 17: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/17.jpg)
High-School #2,3
![Page 18: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/18.jpg)
Profile for honest minor:• Full name, gender, profile picture
• City, school name, school year, birth year• Friends in same school; their profiles
• Home street address, photo of home• Names of parents
• SkypeID• Facebook pages of parents• ……
![Page 19: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/19.jpg)
What if no COPPA ?
![Page 20: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/20.jpg)
Counter-measure: remove Harry from others’ friend lists
![Page 21: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/21.jpg)
Take away
• Component of COPPA law actually facilitates privacy leakages to third parties.
• OSNs can take additional measures to significantly protect children’s privacy.– Remove minors from public friend lists– Detect lying minors
![Page 22: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/22.jpg)
Some Current/Future Research• Defenses– Government polices, OSN measures– Quantify privacy leakage
• City attack– Attempt to find and profile all middle-school
and high-school children– Active attack: “friend” minors, get more info
• Information from photos– Big data approach
![Page 23: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/23.jpg)
IMDB Database
![Page 24: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/24.jpg)
Poly Students
![Page 25: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/25.jpg)
Component graphs for students
Component # 1 Component # 2
![Page 26: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/26.jpg)
Obtaining relative height estimates
1. Use openCV for face detection2. Use midpoints of boxes to determine
height differences in pixels = pij
3. Determine average box size in pixels = b4. Determine height differences wrt box
height
5. e.g., S = 15 cm
b
pb ijij
ijij bSx .
![Page 27: The High School Profiling Attack: How Privacy Laws Can Increase Minors’ Risk](https://reader035.vdocument.in/reader035/viewer/2022062517/56813b9a550346895da4cdeb/html5/thumbnails/27.jpg)
CDF for School Database
0 1 2 3 4 5 6 7 80
0.2
0.4
0.6
0.8
1
1.2
Estimated error for Mean approach
Estimated error for Baseline
Error in cm
C
DF