Advanced Denanonymization through Strava
steveloughran.blogspot.com
Advanced Denanonymization through Strava
1–10 of 77 posts
Re: Advanced Denanonymization through Strava
#2Google and Apple and other map providers scrub some of their data by request of the government. Will the government do something similar here? Kudos to whomever found out that they could identify military stuff through this.
Re: Advanced Denanonymization through Strava
#3This isn't even "deanonymization" in the sense of "performing statistical inference to re-associate different pieces of data." It's "you ask the company to give you personally identifiable data, and it does so."
Re: Advanced Denanonymization through Strava
#4This isn't even "deanonymization" in the sense of "performing statistical inference to re-associate different pieces of data." It's "you ask the company to give you personally identifiable data, and it does so."
Strava is a public-by-default social networking website that happens to focus on athletics. Given that, it's no surprise some users happen to work in the military (they're also on Facebook).
It seems like the various militaries need to do a better job of informing and enforcing social media policy, including auditing websites like Strava. You could also argue that Strava should be private by default, but I don't think you'd have much success persuading them of that.
Re: Advanced Denanonymization through Strava
#5At this point Strava should pull all of its public data. All of these location based services are wide open to attack, correlating across pairs of them, scary.
Re: Advanced Denanonymization through Strava
#6This isn't even "deanonymization" in the sense of "performing statistical inference to re-associate different pieces of data." It's "you ask the company to give you personally identifiable data, and it does so."
Strava is a public-by-default social networking website that happens to focus on athletics. Given that, it's no surprise some users happen to work in the military (they're also on Facebook). It seems like the various militaries need to do a better job of informing and enforcing social media policy, including auditing websites like Strava. You could also argue that Strava should be private by default, but I don't thin…
The US did audits and actually issued 20000 + 2000 Fitbits at minimum in trial programs.
Strava is the least of their problems. Despite all news articles in the last day I didn't come a cross a single previously unknown site mentioned in any of the stories. All those "experts" did, was showing known locations with a novelty overlay.
The heatmap is the graphic and interactive part that makes the story digestable, but there is no actual hard news in there. The story usually then shifts to being able to track users across bases, which is nothing exclusive to strava and mostly speculative when it comes to discovering actually secret deployments.
In the case of HMNB Clyde, that place also exists on instagram, which I find way more discerning, since by default geo-located pictures are even less obvious than a share my GPS-Track of my sports activities as default setting.
https://www.armytimes.com/news/your-army/2015/07/27/20000-so...
Re: Advanced Denanonymization through Strava
#7This is neither advanced nor denanonymization (sic).
They basically pluck an interesting route from the hotmap (as per other people's recent discovery), pretend that they have also run/biked this route and Strava will show them names of others who run/biked the same way. That's clever, but that's not "advanced" by any means.
It's also not a deanonymization as there's really no option in Strava for public _anonymous_ sharing to begin with.
Re: Advanced Denanonymization through Strava
#8Earlier quoted context omitted.
Strava is a public-by-default social networking website that happens to focus on athletics. Given that, it's no surprise some users happen to work in the military (they're also on Facebook). It seems like the various militaries need to do a better job of informing and enforcing social media policy, including auditing websites like Strava. You could also argue that Strava should be private by default, but I don't thin…
The US did audits and actually issued 20000 + 2000 Fitbits at minimum in trial programs. Strava is the least of their problems. Despite all news articles in the last day I didn't come a cross a single previously unknown site mentioned in any of the stories. All those "experts" did, was showing known locations with a novelty overlay. The heatmap is the graphic and interactive part that makes the story digestable, but…
Even the knowledge of exact guard patrol routes and possibly even timings inside a known military base can be extremely helpful information for someone planning an attack. Best part: you don't even have to place a scout in physical proximity as preparation and risk discovery. So this is less than ideal for military organizations.
Re: Advanced Denanonymization through Strava
#9Earlier quoted context omitted.
The US did audits and actually issued 20000 + 2000 Fitbits at minimum in trial programs. Strava is the least of their problems. Despite all news articles in the last day I didn't come a cross a single previously unknown site mentioned in any of the stories. All those "experts" did, was showing known locations with a novelty overlay. The heatmap is the graphic and interactive part that makes the story digestable, but…
Even the knowledge of exact guard patrol routes and possibly even timings inside a known military base can be extremely helpful information for someone planning an attack. Best part: you don't even have to place a scout in physical proximity as preparation and risk discovery. So this is less than ideal for military organizations.
You're totally right of course and I think it's pretty shocking that military personnel aren't aware they are broadcasting their location out to the web. Complete opsec failure.
Re: Advanced Denanonymization through Strava
#10Earlier quoted context omitted.
The US did audits and actually issued 20000 + 2000 Fitbits at minimum in trial programs. Strava is the least of their problems. Despite all news articles in the last day I didn't come a cross a single previously unknown site mentioned in any of the stories. All those "experts" did, was showing known locations with a novelty overlay. The heatmap is the graphic and interactive part that makes the story digestable, but…
Even the knowledge of exact guard patrol routes and possibly even timings inside a known military base can be extremely helpful information for someone planning an attack. Best part: you don't even have to place a scout in physical proximity as preparation and risk discovery. So this is less than ideal for military organizations.
These are most most certainly not patrol routes, but routes taken by people in their off duty time or in mandatory fitness time.