  The extensive use of smartphones and wearable devices has facilitated many
useful applications. For example, with Global Positioning System (GPS)-equipped
smart and wearable devices, many applications can gather, process, and share
rich metadata, such as geolocation, trajectories, elevation, and time. For
example, fitness applications, such as Runkeeper and Strava, utilize the
information for activity tracking and have recently witnessed a boom in
popularity. Those fitness tracker applications have their own web platforms and
allow users to share activities on such platforms or even with other social
network platforms. To preserve the privacy of users while allowing sharing,
several of those platforms may allow users to disclose partial information,
such as the elevation profile for an activity, which supposedly would not leak
the location of the users. In this work, and as a cautionary tale, we create a
proof of concept where we examine the extent to which elevation profiles can be
used to predict the location of users. To tackle this problem, we devise three
plausible threat settings under which the city or borough of the targets can be
predicted. Those threat settings define the amount of information available to
the adversary to launch the prediction attacks. Establishing that simple
features of elevation profiles, e.g., spectral features, are insufficient, we
devise both natural language processing (NLP)-inspired text-like representation
and computer vision-inspired image-like representation of elevation profiles,
and we convert the problem at hand into text and image classification problem.
We use both traditional machine learning- and deep learning-based techniques
and achieve a prediction success rate ranging from 59.59\% to 99.80\%. The
findings are alarming, highlighting that sharing elevation information may have
significant location privacy risks.
