A Strava app feature can be used to find users’ addresses

According to BleepingComputer, researchers at North Carolina State University in Raleigh have discovered a privacy risk in Strava’s heatmap feature that could allow users’ addresses to be identified.

Source: press release

Strava, an app that records sports activity, has over 100 million users worldwide, helping users track their heart rate, activity details, GPS location, and more.

In 2018, Strava implemented a feature called heatmap that anonymously aggregates user activity (runners, cyclists, hikers) to help them find trails or places suitable for exercise, meet like-minded people, and complete their sessions in more frequented and safer locations.

However, as researchers found, this feature allows users to be tracked and de-anonymized using publicly accessible heatmap data combined with specific user metadata.

By comparing heatmap endpoints and a user’s personal data from the search function, researchers were able to correlate the feature’s high-activity points with users’ addresses.

Benoit Grunemwald – Cybersecurity Expert at ESET France reacts:

“This is unfortunately not a surprise, as this is not the first time Strava (but also other social networks) has posed a risk to users’ privacy or even physical security. Already in 2018, Strava was misused to track and attack US military bases around the world, because of the “heatmap” feature.

Presented as a feature to share progress and motivation with peers, the feature’s update in 2017 raised eyebrows in the security community. Thanks to the map’s high accuracy, it seemed easy to track individual activities – Strava even boasted about it in its press release.

The best advice for all users is to think twice before enabling this optional feature – especially when you suspect you are being tracked or if you work in a field with higher security requirements.”

=> SEE ALSO: All our News articles