Information Leakage through Mobile Motion Sensors: User Awareness and Concerns

Smart phones and wearable devices have replaced personal computers and desktops as the primary platform for accessing online applications and services. However, these mobile devices bring forth new and additional forms of security and privacy risks, which were non-existent in traditional personal computers. For instance, several recent research efforts have shown that motion sensors such as accelerometer and gyroscope on-board these mobile and wearable devices can be maliciously used to infer private information from users’ keystrokes (e.g., PINs and passwords). The problem is that, unlike traditional security and privacy risks that are typically associated with personal computers, most users may not be aware of these novel risks associated with mobile devices. An adversary may use this lack of user-awareness to target specific user-demographics for successfully carrying out such attacks. There has been some progress in the direction of protection mechanisms against such attacks, however, without user-awareness these protection mechanisms are unlikely to be used effectively (if at all). In order to further understand these issues, we conduct a structured and comprehensive user-study involving users from diverse demographic backgrounds to investigate userawareness and perceptions related to mobile motion sensor based privacy risks, and how these vary across different demographics. By means of our study, we also gain insight on users’ expectations from defense mechanisms that can protect against such attacks. Results of our study can be used to increase awareness (about such risks) among the less-aware user demographies, and in designing effective and usable protection mechanisms as per user-expectations.