Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?

Specifically

  • Highlighting new or unusual locations
  • Simultaneous / concurrent usage (a session in the US and also in China may be indicative of an attack)
  • Reduced PW challenges for "known" locations

I'm interested in using Browser Location data, source IP, GPS (on phone devices) or any other metatata that can be used to identify and separate "good "authentication sessions from "bad" sessions.

By the way: Confused deputy attacks are out of scope for this, since that attack will likely have valid location data. I'm mainly focused on validating good sessions, or challenging risky sessions instead of or in combination with a permanent cookie

What I hope to learn is how the implementer has addressed roaming users, VPNs and other data validation techniques. I'd also be interested in seeing the "user story" on what process flow would look like.

share|improve this question
4  
Whilst it doesn't exactly count as GPS, the login system for Google Accounts does flag up connections from ridiculously distant locations in a short period of time, based on IP address geolocation. So, if you read your gmail at 10.30 in the USA, then load up Google Reader in China ten minutes later, it flags it as suspicious and asks for further verification. –  Polynomial Jan 2 '13 at 22:34
    
Rapidshare used the same mechanism as @Polynomial described –  Lucas Kauffman Jan 2 '13 at 22:37
1  
Mobile phone networks also use a "miles an hour" event if calls are made from the same caller account in a short period of time between two locations. If "miles an hour" is above 1500 then a fraud score is incremented. –  Callum Wilson Jan 3 '13 at 12:53
    
This sort of location tracking is used daily when you log into your Google account. As for how to handle it on a mobile device additional information must be also used, to determine the fingerprint of the device, in addition to any information that change as the phone is relocated. A mobile phone's ip address is assigned from a pool of ip addresses, which could be from another state in a single region ( West Coast, East Coast, Ect ), assigned to users as they are made free. –  Ramhound Jan 10 '13 at 13:40
add comment

2 Answers

I attended a workshop for Splunk a few months ago. Splunk, if you are unfamiliar with it, is a type log viewer. You can find more out about them at their website: http://www.splunk.com. Essentially, you dump all of your log data into one place, and then analyze it, correlate, report on it, etc.

One of the use cases for Splunk was to correlate VPN logs with Physical Badge access logs. An alert was drafted so that if a user was signed into the VPN and used their access badge in the building, it would flag it and notify on that event. You could use really any sort of logs, I could see an example case where a user signs in from an IP address in Kansas and had done so for the last 30 days, now all of sudden they sign in from an IP address in Canada. Splunk could detect that and alert on it.

Splunk is free for up to 2 GB of data per day, so if you have the data, you could begin testing something like this. The trick is getting the log data in a location so that you can dig through it.

share|improve this answer
add comment

A similar idea has been proposed in the following research papers:

Here's one version of a proposed scheme:

They propose using location to make unlock PIN codes more convenient for smartphones. In particular, the phone remembers the locations where you've unlocked the phone before. If you've unlocked the phone before at a particular location (or unlocked it several times at that location), the phone infers that it is a safe location, and in the future doesn't require you to unlock your phone when you are in that location.

The idea is that if a thief steals your phone, they are probably going to run off with the phone and then try to use it in some other location -- and that other location won't be one where you've unlocked the phone before, so the thief won't be able to access your phone. However, when you use your phone from (say) your home or your office, the phone will recognize it is in a safe location and automatically unlock, sparing you from having to enter a PIN code. Thus, you get the security benefits of a PIN lock code, with greater convenience.

I don't know of anyone who has implemented this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.