LuxTrack: activity inference attacks via smartphone ambient light sensors and countermeasures

Official URL: https://dx.doi.org/10.1109/JIOT.2024.3406208

Ambient Light Sensors (ALS) are integrated into mobile devices to enable various functionalities such as automatic adjustment of screen brightness and background color. ALSs can be used to record the light intensity in the surrounding environment without requiring permission from the user; however, this ability raises novel privacy risks. In this paper, we propose LuxTrack, a side-channel privacy attack that uses the ALS of a smartphone to infer the user’s activity on a nearby laptop using the light emitted from the laptop screen. To demonstrate LuxTrack, we developed an Android app that records the light intensity data from the ALS of a mobile device, and used this app to create an ALS light intensity dataset in a controlled environment with real human subjects. From this dataset, LuxTrack extracts a total of 187 features under 6 categories and trains 6 different machine learning models for activity inference. Experiments show that LuxTrack can achieve up to 80% accuracy in inferring the sites/apps the user is viewing on their laptop. We then propose three countermeasures against LuxTrack: binning, smoothing, and noise addition. We demonstrate that while these countermeasures are effective in reducing attack accuracy, they also yield a reduction in the accuracy of legitimate tasks (e.g., adjusting screen background color). By conducting a trade-off analysis between attack accuracy and legitimate task accuracy, we show that the choice of the right countermeasure and parameters can enable the reduction of attack accuracy to below 30% while only incurring 3% loss in legitimate task accuracy.