Privacy risk from iPhones or other camera phones being fingerprinted by EXIF data?

Question

Asked from the Privacy sub-reddit (https://www.reddit.com/r/privacy/comments/6jllmv/privacy_risk_from_iphones_or_other_camera_phones/):

"Hi, I learned about EXIF data recently and decided to take a random picture on my iPhone 6 (iOS 10.3.2) and upload it to an EXIF data viewer website. I was surprised at how much information was present; the only info not present in the EXIF file was location data, because I have location services turned off for the camera on my iPhone.

So I wondered, because of the wealth of data on an EXIF file, would not a particular combination of data points on an EXIF file be unique to a device, meaning that that device can be fingerprinted using the EXIF data? Is this possible?

Let me provide a hypothetical scenario where this might pose a grave risk to privacy:

Person A is a relatively well-know journalist, married father of three.

Person A frequents a popular porn website where people upload intimate pictures of themselves, and A decides to upload pictures of his genitals taken on his iPhone. Only his groin area is shown, location services is off so A is content that the EXIF data has no location information, and so he happily uploads it.

Then, a while later, A goes on a trip with his family, takes a selfie, and uploads it to his Twitter account which uses his real name. Again, location services off, but obviously his public Twitter does not contain embarrassing information, so A happily uploads the photo showing his face and those of his family to his Twitter feed.

A few weeks later, a bunch of anti-Semitic trolls target A because he is Jewish. They download photos from Twitter, or from his Facebook profile where he also has some public photos, then analyse the EXIF data to come up with a unique fingerprint (wait, after finishing the rest of this post, I remembered that apparently Twitter removes EXIF data? Ok, well, just assume they don't for the sake of this story. In reality, I am sure there are other places hackers can go looking for pictures with EXIF data on them.). They search for photos with this unique fingerprint on the top 200 most popular sites, which includes the earlier mentioned porn site, and they discover his online sexual indiscretions, after a few weeks of running the automated script which searches for EXIF fingerprints.

They then use this information to blackmail him and extort money, following which they expose him anyway and email evidence of his private activities to his family, friends and the rest of the Internet.

Is that possible?

EDIT: PS-I'll admit Black Mirror's "Shut Up and Dance" episode inspired that hypothetical scenario :) "

Answer 1

I answered on that Reddit page:

The answer to your question is a resounding yes.

Also, you don't even need EXIF data; even if you strip the EXIF data, some one can still link together images that have been taken by the same device using camera fingerprinting:

https://www.privateinternetaccess.com/blog/2016/11/smartphones-camera-fingerprint-allows-anyone-track-videos-pictures-back/

Also see some of the comments on this Reddit post:

https://www.reddit.com/r/Android/comments/2hol0n/remove_exif_data_before_sharing_photos_to_protect/

Especially this quote:

"EXIF data can also hold a serial number for the camera. Meaning that if you take two photos, they can be later associated as from the same shooter (e.g. one posted on an anonymous site and another posted on a non-anonymous site, someone could link the two accounts). ".

Also this quote: "Basically, every camera has some random manufacturing imperfections that result in imperceptible noise patterns in the pictures, which can be used as a fingerprint to forensically associate a picture with a camera. To get that fingerprint, you need a set of pictures taken with the same camera, which you then compare with each others to find a common noise patter, which you can then look for in other pictures when you want to know which camera has taken them.

I'm pretty sure the NSA and other SIGINT agencies already scour pictures posted to social networks for camera fingerprints and already have a database full of them.".

If you yourself have shared some very private, sensitive photos on porn sites or whatever, but also post other photos publicly with your name alongside them, you might want to consider the above points. Perhaps try to get those private, sensitive photos taken down. I know, people should have the right to feel anonymous and private online so they can take part in communities freely which they otherwise would be too embarrassed to take in real life, but right now the Internet is not designed properly for that. So, it's your choice. It's very unlikely anyone would target an ordinary guy, so I wouldn't personally worry, but it depends on your risk tolerance and threat model and who you are worried about.