[论文解读] Zooming Into Video Conferencing Privacy and Security Threats

Dima Kagan, Galit Fuhrmann Alpert+1 more|arXiv (Cornell University)|Jul 2, 2020

Spam and Phishing Detection参考文献 20被引用 16

一句话总结

本研究分析了超过15,700张公开分享的视频会议拼贴图像，通过图像处理与社交网络分析技术，提取出包括姓名、年龄、性别和面部特征在内的私人用户数据。研究结果表明，通过在多个会议间交叉比对这些数据，恶意行为者能够重建用户身份及其社交网络，对参与者（包括儿童和弱势用户）造成重大的现实世界隐私与安全风险。

ABSTRACT

The COVID-19 pandemic outbreak, with its related social distancing and shelter-in-place measures, has dramatically affected ways in which people communicate with each other, forcing people to find new ways to collaborate, study, celebrate special occasions, and meet with family and friends. One of the most popular solutions that have emerged is the use of video conferencing applications to replace face-to-face meetings with virtual meetings. This resulted in unprecedented growth in the number of video conferencing users. In this study, we explored privacy issues that may be at risk by attending virtual meetings. We extracted private information from collage images of meeting participants that are publicly posted on the Web. We used image processing, text recognition tools, as well as social network analysis to explore our web crawling curated dataset of over 15,700 collage images, and over 142,000 face images of meeting participants. We demonstrate that video conference users are facing prevalent security and privacy threats. Our results indicate that it is relatively easy to collect thousands of publicly available images of video conference meetings and extract personal information about the participants, including their face images, age, gender, usernames, and sometimes even full names. This type of extracted data can vastly and easily jeopardize people's security and privacy both in the online and real-world, affecting not only adults but also more vulnerable segments of society, such as young children and older adults. Finally, we show that cross-referencing facial image data with social network data may put participants at additional privacy risks they may not be aware of and that it is possible to identify users that appear in several video conference meetings, thus providing a potential to maliciously aggregate different sources of information about a target individual.

研究动机与目标

• 调查通过公开分享的视频会议拼贴图像暴露私人信息的程度。
• 评估利用面部特征与元数据在多个视频会议中重新识别个体的可行性。
• 评估将视频会议数据与社交网络信息关联以损害用户隐私的风险。
• 识别用户、组织及平台开发者可采取的隐私保护实践措施。
• 突出儿童和老年人在虚拟会议中面临隐私威胁的脆弱性。

提出的方法

• 通过网络爬虫收集并整理15,700张拼贴图像及142,000张人脸图像，数据源为公开发布的视频会议。
• 应用基于深度学习的图像处理与文本识别技术，从图像中提取性别、年龄、用户名及全名。
• 利用社交网络分析识别在多个会议中出现的用户，并推断其社交关系。
• 将人脸图像与外部数据集交叉比对，评估重新识别的可能性。
• 评估虚拟背景、面部遮罩及反面部识别配件等隐私保护技术的有效性。
• 分析用户行为，包括在面部使用表情符号，作为潜在的隐私保护方法。

实验结果

研究问题

• RQ1 在多大程度上可从公开分享的视频会议拼贴图像中提取姓名、年龄和性别等个人信息？
• RQ2 面部识别与元数据关联在多大程度上能有效识别多个视频会议中的同一人？
• RQ3 将视频会议数据与社交网络信息结合，对用户重新识别的风险是什么？
• RQ4 使用真实背景或个人用户名等用户行为如何加剧隐私暴露？
• RQ5 用户与组织可采取哪些切实可行的对策来降低视频会议中的隐私风险？

主要发现

• 共收集15,700张拼贴图像与142,000张人脸图像，揭示了真实姓名、用户名及人口统计属性等个人数据的广泛暴露。
• 本研究证明，可通过面部识别技术在多个会议中重新识别个体，从而构建社交网络图谱。
• 将人脸数据与社交媒体资料交叉比对，显著增加了身份重建与隐私泄露的风险。
• 大量参与者（包括儿童和老年人）被发现使用真实姓名与个人背景，使其面临更高的追踪与骚扰风险。
• 采用通用用户名、虚拟背景或面部遮罩等简单措施，可显著降低自动化识别的风险。
• 在面部使用表情符号被观察为一种实用且低成本的干扰面部识别系统的方法，有助于保护隐私。