Venue Attacks: The Invisible Threat to Location-Based Social Networks

TL;DR

While most social network security focuses on protecting users, this paper shifts the lens to venues—the digital anchors of physical locations. By exploiting the trust models of platforms like Foursquare and Yelp, attackers can "kidnap" business locations, hijack ownership via weak authentication, and create malicious private venues to embarrass victims. The authors prove that through iterative dishonest check-ins, a physical building can be "moved" miles away in the digital world.

Problem & Motivation: The Mirage of Trusted Maps

We live in an era where we implicitly trust our smartphones. When an LBSN says there is a Starbucks on the corner or that your child has "checked in" at home, we believe it. However, this paper argues that the Venue is a fragile entity.

Current systems prioritize ease-of-use over security. Anyone can create a venue, and "ownership" is often verified by something as simple as a phone call that lacks robust identity verification. This structural gap allows for Venue Attacks, which target the reputation of businesses and the privacy of homeowners.

Methodology: The Anatomy of a Hijack

The authors categorize the threat into three primary vectors:

1. Malicious Venue Creation

Attackers create venues that don't exist or private residential venues without the owner's consent. Imagine an attacker creating a "Home" venue for a victim and checking in there with an offensive username—this results in social embarrassment and potential home-address exposure.

2. Venue Ownership Hijacking

Because LBSNs use automated phone systems to verify owners, an attacker with basic knowledge of a business can claim its digital profile. Once they are the "Owner," they can access private customer statistics (OTId) or post fake coupons (Pr) that cause financial disputes at the actual physical store.

3. Venue Location Hijacking (The "Digital Kidnapping")

This is the most technically intriguing attack. LBSNs like Foursquare dynamically update a venue's coordinates based on the "center" of honest check-ins.

• The Strategy: The attacker doesn't try to move the venue 5 miles away instantly (which the system would flag as dishonest).
• The Iteration: They perform check-ins at the edge of the "honest" radius (e.g., 500 feet). The system slowly shifts the venue's center toward the attacker. By repeating this, they can "drift" a venue across a city.

Figure 1: The iterative process of shifting a venue's location via marginal dishonest check-ins.

Experiments: Proof of Concept

The authors successfully "kidnapped" the LERSAIS Lab at the University of Pittsburgh. Over 200 dishonest check-ins were performed over two months, successfully fooling Foursquare's algorithms into accepting the new, false coordinates.

Figure 2: Screen shots showing the successful relocation of the LERSAIS Lab in Foursquare.

In a Combined Attack, the authors moved a school venue 3 miles away and then created a new fake venue at the original location. The result? 18 real users were deceived into checking in at the attacker's fake venue, demonstrating how easily the digital-physical link can be severed.

Critical Analysis & Future Outlook

The paper reveals a staggering statistic: 99.95% of residential venues and 89.76% of business venues in their dataset were unverified. This "vacuum of ownership" is the primary playground for attackers.

Proposed Solutions

• Restricted Policies: Verified identities should be required for creating public/business venues.
• Hardware Validation: Using WiFi signal strength (RSSI) or MAC address verification from local routers to prove a user is physically there, rather than relying on spoofable GPS data.
• Incentivized Verification: Encouraging business owners to "claim" their spots before an attacker does.

Conclusion

As we move toward a world of "Digital Twins" and AR-enhanced cities, the integrity of geographical data is paramount. This paper serves as an early warning: if we can't secure the "where," we can't trust the "what" of our social networks.

Editor's Note: While this research dates back to the SIGSPATIAL '14 era, the principles of coordinate-drifting and social-engineering-based ownership verification remain highly relevant to modern IoT and Metaverse platforms.