Real-time crowdsourced maps such as Waze provide timely updates on traffic,congestion, accidents and points of interest. In this paper, we demonstrate howlack of strong location authentication allows creation of software-based {\emSybil devices} that expose crowdsourced map systems to a variety of securityand privacy attacks. Our experiments show that a single Sybil device withlimited resources can cause havoc on Waze, reporting false congestion andaccidents and automatically rerouting user traffic. More importantly, wedescribe techniques to generate Sybil devices at scale, creating armies ofvirtual vehicles capable of remotely tracking precise movements for large userpopulations while avoiding detection. We propose a new approach to defendagainst Sybil devices based on {\em co-location edges}, authenticated recordsthat attest to the one-time physical co-location of a pair of devices. Overtime, co-location edges combine to form large {\em proximity graphs} thatattest to physical interactions between devices, allowing scalable detection ofvirtual vehicles. We demonstrate the efficacy of this approach usinglarge-scale simulations, and discuss how they can be used to dramaticallyreduce the impact of attacks against crowdsourced mapping services.
展开▼
机译：实时众包地图（例如位智）可提供有关交通，拥堵，事故和景点的及时更新。在本文中，我们演示了强位置身份验证的缺失如何允许创建基于软件的{\ emSybil设备}，从而使众包的地图系统暴露于各种安全和隐私攻击中。我们的实验表明，资源有限的单个Sybil设备会造成Waze破坏，报告错误的拥塞和事故，并自动重新路由用户流量。更重要的是，我们描述了可大规模生产Sybil设备的技术，从而创建了能够远程跟踪大型用户的精确运动同时避免检测的虚拟车辆大军。我们提出了一种基于{\ em co-location edge}的新方法来防御Sybil设备，这些记录是经过验证的记录，可证明一对设备的一次性物理co-location。随着时间的流逝，共处一地的边缘组合在一起，形成了大的{\ em接近图}，证明了设备之间的物理相互作用，从而实现了对虚拟车辆的可扩展检测。我们使用大规模仿真演示了这种方法的有效性，并讨论了如何使用它们来大大减少针对众包地图服务的攻击的影响。
展开▼
