Your Phone’s Hardware Can Reveal Your Identity Even If Your Data Is Safe

Your personal data isn’t the only thing that can identify you. Now your hardware can, too.

Researchers at Stanford University have figured out how to accurately identify a device, even if apps can’t access its data, by building a profile of its unique hardware quirks. Taken together, a device’s many tiny idiosyncrasies—due to manufacturing errors—make up a so-called “sensor fingerprint.”

In a recent study published to the arXiv preprint server, the Stanford team measured the sensor properties of over ten thousand phones to find out if they could identify an individual device by analyzing its accelerometer calibration errors and the unique frequency response of its speakerphone-microphone feedback. By repeatedly querying a phone’s sensors, the researchers were able to construct a unique profile that could be used to identify them with a high degree of accuracy.

And just like the kind found on your fingertips, your sensor fingerprint is unique enough to identify your device among thousands of others. Merely restricting access to your personal data and clearing your cookies won’t save you, the paper says, because sensor data can still be accessed and used to ID your device.

It’s easy to see how this could be an unsettling new frontier in user identification through less-than-scrupulous means. For example, a malicious app could conceivably gather enough sensor information to identify a user without their knowledge, while they think they’re safe because they clicked “no” when it asked for their GPS location.

According to the study, a phone’s accelerometer and speakerphone-microphone system aren’t the only hardware sensors that can give away its identity, either. Smartphones contain a multitude of sensors that are skewed in unique ways; an inaccurate touch screen, a wonky gyroscope, and a slightly off GPS sensor could all be used to identify a device.

Sensor data often isn’t considered as sensitive as locational data and other kinds of personal information, so it’s essentially open season for data miners. Think about it: When was the last time you had to give an app permission to access your magnetometer data?

Raising awareness of sensor data’s revealing nature, while also giving users more control over who gets to see it, should be the first line of defence in mitigating the threat posed by sensor fingerprint tracking, according to the researchers.

Tracking a phone by looking at its hardware identifiers is generally frowned upon, for obvious reasons. For example, several years ago Apple banned apps that try to access an iOS device’s manufacturer ID—built in so that a device can be identified in the case of a software reset—but, clearly, even restricting access to manufacturer-provided identification numbers is no longer an effective method of ensuring your hardware’s anonymity.

The issue of identifying devices via a sensor fingerprint could also be tackled by calibrating every device as soon as it rolls off the assembly line. After all, this is really a quality control issue. If every phone’s sensors react the same way to stimulus, no individual phone’s sensor fingerprint should set it apart from any other—in theory, at least, as expecting manufacturing tolerances to be perfectly matched is pretty much impossible. Another possible solution, the study says, is to introduce random noise to sensor signals.

For now, it seems like there’s not much the average user can do to protect their sensor data from being tapped by third parties—there’s simply no way to control it on the user end. On the bright side, it’s not yet a common exploit. Hopefully, looking at all the ways that our devices can give us away will give us a head start on keeping our sensor fingerprint away from prying eyes.