Messup: Protecting User Identities in Mobile Traffic

This research is supported by the National Science Foundation.

Motivation and Approach

While mobile apps are dominating mobile user activities, their privacy risks are also drawing a lot of attention. We argue that the information pieces that are uniquely associated with end users (i.e., userIDs) will make mobile traffic vulnerable to traffic observers who can access user traffic. With connected userIDs, traffic observers can connect different user attributes and other information to the same user, hence disclose the user's real-world identity and a large proportion of user online activities.

We propose Messup, a client-side privacy-preserving system, to protect privacy of mobile users from traffic observers. Messup first detects userID leakage in HTTP traffic from mobile apps. Our measurement results suggest that 65% of mobile apps are leaking userIDs while tracking "anonymous" users. Taking login accounts into consideration, 71% of tested mobile apps will leak userIDs in their HTTP traffic. Messup further breaks the association between userIDs and other user attributes by generating synthetic HTTP requests. Our measurements show that in absence of Messup, on average 51% of user traffic can be attributed to the same user. With Messup, the fact that 75% of the synthetic requests can get a successful response makes it virtually impossible for traffic observers to conduct successful traffic attribution attacks.

The Messup mobile app is the client-side tool of the Messup system. This Android app will sample HTTP traffic generated by other apps, tokenize the HTTP headers, report suspicious userID fields and generate synthetic traffic to protect user identities.

People

Download Messup

The Messup Android app is available here.