Online Images Can Carry Location Data, Leave Users Vulnerable to "Cybercasing"

^{August 30, 2010}
Photos and videos posted on Web sites such as Craigslist and Twitter can carry detailed information about where the images were taken, according to researchers at the International Computer Science Institute (ICSI). This may leave them vulnerable to "cybercasing," the use of geo-tagged information available online to mount attacks in the real world.

In an ICSI technical report published May 2, Gerald Friedland and Robin Sommer reported that they were able to identify where images posted online were captured. This information is automatically embedded by higher-end digital cameras and smart phones, such as the iPhone. People who post these images are often unaware that they are also posting data about their location.

Friedland and Sommer cross-referenced the latitude and longitude embedded in images with publicly available information, such as Google Maps Street View, to quickly find where photos were taken. The researchers, for example, identified the home addresses of people who put photos on Craigslist, even when those posting the photos had opted to hide their real names and email addresses.

In one search of YouTube videos, the researchers were able to find users with homes near downtown Berkeley by searching the embedded geo-location data. They included the search term "kids" since many home videos are of users' children. They then searched for videos posted by the same users that had been filmed over 1000 miles away. Within fifteen minutes, the researchers were able to find a resident of Albany, California who was vacationing in the Caribbean, along with a dozen other users who might be vulnerable to burglary given the subject matter of the videos they had posted.

The results will be presented at the USENIX Workshop on Hot Topics in Security in August. The research has been featured on the ABC News Web site and in New Scientist magazine.

Citation:

"Cybercasing the Joint: On the Privacy Implications of Geo-Tagging." G. Friedland and R. Sommer. Proceedings of the Fifth USENIX Workshop on Hot Topics in Security (HotSec 10), Washington, D.C., August 2010.