“Hey Players, there is a problem…”: On Attribute Inference Attacks against Videogamers

We focus on a subtle privacy issue that affects (potentially hundreds of) millions of videogamers: attribute inference attacks (AIA). Through AIA, evildoers can infer gamers’ private attributes (e.g., age, gender, occupation) by leveraging ingame statistics that are publicly available. Despite some previous research efforts highlighting the practicality of AIA in DOTA2, the overarching gaming community is not yet aware of this threat. We argue that AIA can only be mitigated through the collaboration of the entire videogaming community, and hence all stakeholders should be cognizant of the potential threat of AIA. In this work, we first assess the risk of AIA in a broad range of online video games through a set of (original) criteria that make a game prone to AIA. We further examine some practical ways in which attackers can collect personal user data in order to subsequently correlate it with their publicly available in-game data. Finally, we confirm in a representative user study (n=460) that the gamers are hardly aware of subtle issues related to AIA. In particular, 24% of our participants revealed that they would publicly share their personal data. Clearly, such data can be leveraged by evildoers to launch AIA against other players.