Security News > 2020 > April > Researchers Uncover Novel Way to De-anonymize Device IDs to Users' Biometrics

Researchers have uncovered a potential means to profile and track online users using a novel approach that combines device identifiers with their biometric information.

The details come from a newly published research titled "Nowhere to Hide: Cross-modal Identity Leakage between Biometrics and Devices" by a group of academics from the University of Liverpool, New York University, The Chinese University of Hong Kong, and University at Buffalo SUNY. "Prior studies on identity theft only consider the attack goal for a single type of identity, either for device IDs or biometrics," Chris Xiaoxuan Lu, Assistant Professor at the University of Liverpool, told The Hacker News in an email interview.

To mount the attack, the researchers assembled an eavesdropping prototype built on a Raspberry Pi that consisted of an audio recorder, an 8MP camera, and a Wi-Fi sniffer that can capture the device identifiers.

The data collected in this manner not only ascertained that there exists a session attendance similarity between one's physical biometrics and his/her personal device, but they are also unique enough to isolate a specific individual among several people located in the same space.

Possible Mitigation Techniques But with billions of IoT devices connected to the internet, the researchers say the compound effect of such a data leakage is a real threat, with the adversary capable of deanonymizing over 70% of the device identifiers.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/Qs7wa1w0WkE/deanonymize-device-biometrics.html