Cybercasing 2.0: You Get What You Pay For

Jaeyoung Choi,Istemi Ekin Akkus,Serge Egelman,Gerald Friedland,Robin Sommer,Michael Carl Tschantz,Nicholas Weaver

DOI: https://doi.org/10.48550/arXiv.1811.06584

2018-11-16

Abstract:Under U.S. law, marketing databases exist under almost no legal restrictions concerning accuracy, access, or confidentiality. We explore the possible (mis)use of these databases in a criminal context by conducting two experiments. First, we show how this data can be used for "cybercasing" by using this data to resolve the physical addresses of individuals who are likely to be on vacation. Second, we evaluate the utility of a "bride to be" mailing list augmented with data obtained by searching both Facebook and a bridal registry aggregator. We conclude that marketing data is not necessarily harmless and can represent a fruitful target for criminal misuse.

Cryptography and Security