Technology

59322 readers

4980 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

170

Apple's Wifi router database: Surveilling the Masses with Wi-Fi-Based Positioning Systems (www.cs.umd.edu)

submitted 5 months ago by [email protected] to c/[email protected]

8 comments fedilink hide all child comments

Apple's huge database, which usually records the locations of Wi-Fi base stations to the nearest metre, has apparently been exploited without hindrance: With little effort, attackers are able to create a ‘global snapshot’ of all the location data of the WLANs recorded there. This allows them - over a longer period of time - to track changes in the location of the routers usually belonging to a household or sometimes even of individuals, as two researchers from the University of Maryland have now demonstrated.

The researchers consider it particularly problematic that Apple's Wi-Fi database can be read out practically unhindered and immediately provides the location data for ‘several hundred’ additional BSSIDs (the physical MAC addresses of the routers) to the requesting client without being asked via an apparently unlimited API. In this respect, Apple's Wi-Fi database also differs fundamentally from other Wi-Fi databases, such as the one operated by Google.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 5 points 5 months ago (1 children)

So it's possible to run this type of service with this type of database, without sharing BSSID locations with anyone else who asks.

Seems like apple was hoping to keep their API hits down at the expense of everyone’s privacy including their own customers. Very uncool.

[–] [email protected] 4 points 5 months ago (1 children)

It seems that Apple may be interested in at least requiring authentication that the query comes from an Apple device (or even an Apple-approved API key), which would go a long way in alleviating the security flaw.

I can see some value in the server returning BSSID location data directly (especially with risk of intermittent or slow data connections), but the combination of all the factors seems sloppy.

[–] [email protected] 1 points 5 months ago

…the combination of factors seems sloppy. Well put.

It could even be privacy preserving with the right implementation. With a bunch of device locations nearby you’re not hitting the server constantly and leaving a trail… but I think Apple just had limiting API hits and maybe computing.