While it's not particularly surprising that the location of a piece of radio hardware that broadcasts a static identifier is trackable, it is pretty interesting how the location awareness and ubiquity of modern smartphones are effectively creating a massive distributed sensing network. The focus on this piece is mostly on how apple (by designing their api in a way that avoids apple computing your exact location on their servers, presumably in an attempt to _preserve_ user privacy) inadvertently gave public access to that sensing network. I'd love to read a piece that also games out what exactly a red team or attacker could do with _privileged_ access. I.e. "if somebody was able to compromise the location services servers, but not iOS, what exactly would they be able to do with that"...
Also surprised how many people don't know that their phones regularly try to connect to all wifi networks saved on the device, and that this unique combination which includes things like "my town mcdonald's" or whatever is enough to uniquely identify someone and usually locate them too.
>as 'accidentally' storing the actual network data from open networks [0]
What's with the scare quotes? It seems entirely plausible to me. eg. their process for capturing beacons were to put a wifi card in monitor mode, capturing any packets they see, and then filtering only for beacons. Somewhere along the way they forgot to add the filter, and as a result they were inadvertently recording all packets. Trying to imply that they were doing something nefarious makes little sense. The cars were constantly moving, so at best you got a few seconds of web browsing data before going out of range. As google should know, the value in data comes from being able to build a complete profile of someone, not knowing what one page someone visited was. Moreover, thanks to third party cookies and their embeds everywhere on the web, they don't need to drive around to capture your web browsing traffic. They can get a continuous feed just by operating their cdn/ad networks.
This had essentially nothing to do with web browsing packets, and everything to do with Google building a map of citizen bSSIDs and MAC addresses without their consent.
Many of the same objections apply. What is google going to do with a point in time snapshot of "bSSIDs and MAC addresses"? The SSIDs don't tell them anything aside from "there's a wifi router at this vague location". MAC addresses are slightly more interesting, but there's nothing you can do with a point in time capture with them. Even if you want to do evil things like stalking people, you'd need to do regular scans, not the once-a-few-years drive-by they do with the streetview cars.
Also to be clear I'm not claiming that it's fine for them to do it, or that they should continue doing it, only that the scare quotes around "accidentally" was unwarranted given the lack of evidence towards malice and lack of motive. To make an analogy, accidentally-exposed-to-the-public breaches happen all the time. You can complain about how there were lack of controls/security, but people don't typically don't use scare quotes to imply the breaches were somehow intentional.
Yeah sure theoretically, but by all accounts they were using off the shelf wifi adapters, not using SDRs to make a quasi synthetic aperture radar to pinpoint the exact location of each transmitter. Moreover even if you had the exact position (eg. <1m) of each transmitter, it's unclear what they'd do with them.
Don't forget in-vehicle Wi-Fi access points, which are active in most modern cars/trucks. Plus you can't "opt out" as these are usually fixed names (you can't append "_nomap")
Since MAC address ranges are allocated to different vendors, Google and Apple could choose to not report the locations of certain vendors’ devices, such as Starlink or known transportation APs.
On a related note: android devices try to continuously connect to all WiFi networks they have been connected to before, no matter if you are „near“ them or not.
Doesn’t even matter if the access point is broadcasting the SSID or not.
Found this out by just having the personal hot spot of an iOS device enabled and then turning on a android tablet. iOS doesn’t broadcast the SSID unless you have the settings screen of the personal hotspot open.
Scary.
>Doesn’t even matter if the access point is broadcasting the SSID or not.
Source? AFAIK this behavior only gets engaged if the hotspot has a hidden SSID.
>Found this out by just having the personal hot spot of an iOS device enabled and then turning on a android tablet. iOS doesn’t broadcast the SSID unless you have the settings screen of the personal hotspot open. Scary.
This is opposite to my experience. I specifically have to enable "allow other devices to join" for non-ios devices to be able to join.
When I make a hot spot hidden, devices that previously connected to it can still do so in most implementions I've seen. That's how you work around them not supporting hidden networks.
So I'll call "Source?" on it working like you describe.
That's a misnomer. It doesn't actually make it hidden, only transmit beacons with a blank ssid. That's why even if your network is hidden, it will show a "hidden network" option for you to manually enter the SSID[1]. Moreover, client devices that have hidden networks saved will send out probe packets with network names it has saved[2], so it can determine whether the hidden network is actually around. This is actually worse for privacy, especially if your network name is vaguely unique, because you're broadcasting this high entropy information everywhere you go.
Wait how is this bad? If I have wifi on I'm pretty sure I want to reconnect to saved networks. You want them to only do it when near the network? By tracking the location? Isn't this much much worse for privacy? You can always turn wifi off....
I only want my devices to connect to networks which are actually there. Not try every one they have connected to before no matter if they are existing or not.
This is a data goldmine for data brokers who have most certainly replicated the data set, but without any of the privacy measures that the researchers implemented.
On another note, I had missed that Apple recognizes the '_nomap' suffix and stops indexing/reporting its WiFI AP locations.
Would that data be considered Apple IP even though the AP addresses and locations are somewhat public information (because APs are broadcasting their addresses)?
Apple’s API might return fake “trap addresses” that it could use to trace if their API data shows up in other companies’ location databases. Like the “trap streets” used to catch map plagiarists: https://en.m.wikipedia.org/wiki/Trap_street
Is there a way to prevent this data from being used? Can I somehow not broadcast certain data over wifi or otherwise keep google and apple from using my wifi metadata without my consent?
> But in late March 2024, Apple quietly tweaked its privacy policy, allowing people to opt out of having the location of their wireless access points collected and shared by Apple — by appending “_nomap” to the end of the Wi-Fi access point’s name (SSID).
I find that incredibly irksome. I'm glad they provide an opt-out mechanism, but strongly dislike that it requires me to give my Wi-Fi network an ugly name. And what if 2 vendors have different opt-out strings such that I can't choose to stay out of, say, Apple and Google's DBs at the same time?
I feel you and agree, but there's a good argument to be made that BSSIDs are "public information".
It's a slippery slope to walk trying to regulate that one. One example: "No public citizen, you are not allowed to monitor our frequencies without paying our corporation a subscription fee."
I understand. I have a ham radio license and I can listen in to all sorts of things sent out into the public airwaves. That's what broadcasting is.
At the same time, I write a blog for other humans to read. I'm annoyed that some companies are likely scraping it to train their LLMs. Beyond my annoyance, I don't know how far I'd want to go toward making it possible for humans to consume it but not AIs. The legal cures for that seem like they'd be worse than the disease.
I am thinking of starting a competing product that uses wifi APs for geo location instead of GPS satellites. I want to be a more customer friendly business than google or apple though, it'll only be opt-in. All you have to do to indicate that you have opted-in is to append "_nomap" to your AP name. /s
If I understand correctly, the research was only possible because they were able to leverage the Google and apple APIs against each other. The lesson I get from this is these companies shouldn't behave like they exist in a vacuum and when exposing data or forcing global configuration (like the AP name) they need to be more careful.
But most people don’t intentionally “broadcast their SSID in the open”. They just want to surf wirelessly in their homes with as little hassle as possible.
Until there’s technology that lets you do that easily I think this definitely violates privacy. Especially if unique information like MAC addresses is collect, and not only the Wi-Fi name.
I wonder how MAC addresses are treated under GDPR since e.g. IP addresses are considered personal information.
When a consumer can see their neighbors' networks' SSIDs being broadcast on their own pocket computer, but somehow doesn't think that anyone else can see their own network's SSID, then:
That's magical thinking.
Magical thinking is not a privacy problem. Magical thinking is a cognition problem.
There's a surefire way to prevent this kind of thing forever: Stop broadcasting your data on the air for anyone to hear, and others will stop being able to listen to it.
This is also why I replace all of my APs when I move (new BSSIDs) and don’t put identifying information like phone numbers, names, or domains in SSIDs.
I took the opposite approach: make the SSID equal the street address. If it's going to be mapped anyways, might as well name it with a location-based name.
Disagree: That feels like a failure of defense-in-depth, handing unnecessary bonus information to an attacker while providing no actual convenience to legitimate users who already know their own street address.
For example, suppose a device on your network is compromised: The attacker instantly get a freebie for a mailing-address they could use for identity-theft/impersonation, blackmail/extortion threats, or scams pretending to be an authority figure.
If you also have something like a home security system, they'll immediately know where to go if someone wants to burgle a room full of goodies (possibly visible via camera) as soon as the owner leaves.
The reverse direction is also an issue: Suppose someone already knows your street address, and is trying to figure out which wireless network to target in order to harass/hack/burgle you.
Even if these all seem unlikely, the information leak is all downside, no benefit.
Honestly anything other than the auto-generated SSID is going to add more entropy and make you stick out. Moreover, AFAIK they track the BSSID (ie. MAC address), so unless you also spoof that, changing the network name is not going to matter.
That's actually bad. iOS shows a "privacy warning" if you're connected to a wifi hotspot with a "common name". Presumably that's because if you have something a network with a common name saved (eg. "dlink"), your phone would try to connect to it everywhere you go, exposing your mac address.
> your phone would try to connect to it everywhere you go
Emphasis on "try", provided the original network wasn't some kind of totally unsecured open one. (And nobody would do that nowadays, right?... Right?)
IANANetworkEngineer, but from what I can find about "Evil Twin" WiFi attacks, your device ought to remember and reuse the security info from the legitimate AP. Even if the hacker mimics the SSID and MAC, they probably won't have the other secrets needed to finish tricking your device into finalizing the connection.
> exposing your mac address
This can be avoided if your device is set to randomize its MAC on each connection to an SSID or that one in particular. However there are some networks where that is undesirable, like a home network that does some assigned IPs and port-forwarding across NAT, etc.
>This can be avoided if your device is set to randomize its MAC on each connection to an SSID or that one in particular.
AFAIK only grapheneOS offers per-connection mac randomization. Windows comes close with "change daily". Regular Android has a developer setting that enables it for all networks, which causes issues like you mentioned.
I know regular Android since version 10 has a standard randomization feature, but as you say it's not as strict as per individual connection attempt, just per recognized SSID.
Because I don’t want my residential location moves being tracked, as the person who goes from zip code A to zip code B to zip code C is possibly a unique track.
I don’t use much bluetooth at home. Zigbee is becoming an issue, but I haven’t moved since I’ve set it up.
In the US, I would assume your employer (via payroll or “work number”, or your banks/credit cards/credit reporting agencies, or even retailers like Amazon or Walmart are selling that information.
Or the USPS when you let them know where to forward your mail to after you move:
None of those organizations ever receive my primary residential address, only my tertiary one. Fortunately in the US you are allowed to have more than one home. Absolutely nothing with my name on it goes to where I usually sleep.
To divulge sensitive information like that is actively unsafe for certain types of people, because, as you note, almost every single vendor with whom you do business will blast it out all over the ecosystem until it shows up on SEO spam websites forever.
This isn’t true. Only one residential record of location is. I have three. I sleep at the one on my driver’s license only a few nights per year. Some vanlife types use a post box, which is also legal.
It would be actively dangerous for people like me if we were forced to regularly sleep in a location available to the general public.
Separately (assuming US): would you actually find it surprising there would exist a subset of hackers unimpressed with the R and D parade to the point that they abstain?
I don’t register to vote or receive any mail at my primary residence. My government paperwork all goes to my tertiary residence.
Do you really think someone who is changing their BSSIDs when they move is putting the address at which they regularly sleep unguarded into public records?
It only takes takes one Bluetooth device sitting there and shouting its name to track a move, if that's what a person wants to focus on doing.
Most of the Bluetooth devices that I am able to identify are things like televisions. When a Samsung TV moves, it's pretty likely that the people who own that TV have moved along with it.
hostapd definitely exposes this as it was used extensively to spoof 3DS streetpass relays for a variety fun reasons, back before Nintendo shut down the service in March 2018 :(
You should set it to the most common bssid of your preferred anonymity set. You can look up tables of most common MAC addresses and SSIDs and pick from there.
Still, the distribution of these identifiers will vary by region, manufacturer and other factors. The best way to stay anonymous is to avoid using the wireless spectrum. You’ll never be in full control of your anonymity as long as anyone around you is broadcasting a unique identifier and your device is logging its observations of these identifiers, correlating them with GPS, and sending them to the cloud…
“Google’s WPS computes the user’s location and shares it with the device. Apple’s WPS gives its devices a large enough amount of data about the location of known access points in the area that the devices can do that estimation on their own.”
How is sharing the locations of 400 nearby BSSIDs better?
It's the fact that Apple spews this huge amount of info that allowed this research to happen, after all.
That’s according to two researchers at the University of Maryland, who theorized they could use the verbosity of Apple’s API to map the movement of individual devices into and out of virtually any defined area of the world.
> How is sharing the locations of 400 nearby BSSIDs better?
Apple isn't constantly computing your precise location. It's happening on device.
The fundamental problem is our devices are inadvertently broadcasting their own locations. Not that Apple is providing, in essence, a report on the public radio spectrum. (Do hidden SSIDs broadcast a BSSID?)
> Not that Apple is providing, in essence, a report on the public radio spectrum.
Of the entire world. Provided in a nice enough package that with a little patience researchers could collect the location 480 million devices.
> Do hidden SSIDs broadcast a BSSID?
They do something worse: they force devices that want to connect to them to broadcast the BSSID all the time, which allows passive listeners to track them (e.g.) across a shopping mall.
Except those companies hate standards and will use them exclusively when it commonize their complements. (well.. Even when it does they don't necessarily do.)
I read the article but didn't get how the authors got the data.
I understand that IOS/Android leak nearby Wi-Fi to Apple/Google and that was like that for years. But how I can get access to such bulk data to reproduce the map from the article?
I went on my Mac and used mitmproxy while requesting location. The API is here: https://gs-loc.apple.com/clls/wloc. It uses protobuf and you basically send a list of BSSIDs and it returns a list of BSSIDs with Long/Lat attached.
My question would be: are iPhones reporting locations with nearby access points or does Apple have other means of collecting the AP locations
The authors wrote a client to ask Apple’s WiFi Positioning API for the locations of random AP addresses. Enough of the random addresses were known to Apple’s location database that it returned real location data. Apple’s API also returns the addresses and locations of 400+ other nearby APs. That enables iOS devices to do faster and offline content geolocation in the same region.
> Apple’s API will return the geolocations of up to 400 hundred more BSSIDs that are nearby the one requested. It then uses approximately eight of those BSSIDs to work out the user’s location based on known landmarks.
> In essence, Google’s WPS computes the user’s location and shares it with the device. Apple’s WPS gives its devices a large enough amount of data about the location of known access points in the area that the devices can do that estimation on their own.
This highlights the need for access points that can broadcast a random BSSID periodically similar to how handset hotspots implement. I am looking for a new WIFI 7 access point and would love to find one that does this.
When I visited the 37c3 my iPhone was always showing my location being in Leipzig instead of Hamburg (probably because the SSIDs weren't changed when the APs were moved from Leipzig to Hamburg).
"Apple did not respond to requests for comment. But in late March 2024, Apple quietly tweaked its privacy policy, allowing people to opt out of having the location of their wireless access points collected and shared by Apple - by appending "_nomap" to the end of the Wi-Fi access point's name (SSID)."
Have never seen new computers out of the box that phone home more than Apple computers.
"Privacy is a fundamental human right" - Tim Cook, Apple CEO
"We don't collect a lot of your data and understand every detail about your life. That's just not the business that we are in," says Apple CEO Tim Cook, shown here at the NPR offices in Washington, D.C., on Thursday."
