“Hey Players, there is a problem…”: On Attribute Inference Attacks against Videogamers
Eisele, L., Apruzzese, G., IEEE Conference on Games, 2024 Conference
Oneliner: Apparently, game-related research overlooks the privacy risks of the video-gaming ecosystem.
Abstract. We focus on a subtle privacy issue that affects (potentially hundreds of) millions of videogamers: attribute inference attacks (AIA). Through AIA, evildoers can infer gamers’ private attributes (e.g., age, gender, occupation) by leveraging in-game statistics that are publicly available. Despite some research efforts revealing the practicality of AIA in Dota2, such a threat has been mostly ignored by the overarching gaming community. This is a problem: AIA can only be mitigated through the cooperation of the entire gaming community—and this cooperation can only begin if all stakeholders acknowledge the threat of AIA.
We seek to promote such a positive change by raising the gaming ecosystem’s awareness about AIA. First, we provide evidence that AIA have truly been overlooked in the gaming domain. Then, we scrutinize the gaming landscape, pinpointing (i) the games that are more prone to AIA, and (ii) the respective communities that facilitate the enactment of AIA. Finally, through an (ethical) user survey (n=539) resembling a fundamental data-collection step of AIA, we (iii) proactively assess the threat of AIA and (iv) educate our participants towards AIA. To protect the players’ privacy, we advocate gamers and developers to reflect upon our findings: the subtle threat of AIA cannot be countered solely by researchers.