Slashdot Mirror
Android Leaks Location Data Via Wi-Fi
Bismillah writes: The Preferred Network Offload feature in Android extends battery life, but it also leaks location data, according to the Electronic Frontier Foundation. What's more, the same flaw is found in Apple OS X and Windows 7. "This location history comes in the form of the names of wireless networks your phone has previously connected to. These frequently identify places you've been, including homes ('Tom’s Wi-Fi'), workplaces ('Company XYZ office net'), churches and political offices ('County Party HQ'), small businesses ('Toulouse Lautrec's house of ill-repute'), and travel destinations ('Tehran Airport wifi'). This data is arguably more dangerous than that leaked in previous location data scandals because it clearly denotes in human language places that you've spent enough time to use the Wi-Fi."
Should be popular SMART PHONES leak WiFi data.
Sensationalist bullshit
The sensational headline fails to mention that most operating systems, including OSX and Windows, are affect. In fact most wifi devices are and we have known about this problem since the early days of wifi.
I wish I had the time to mod the shit down before it hit the front page.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
say thanks. It's 2014 and engineers are still designing protocols like we're all friends who respect each others' privacy.
I've noticed this before but haven't been able to figure out how to delete it. I guess it has to do with the device searching for stored WiFi networks to establish a connection? Still annoying. According to the article, if you connect to hidden networks then you won't be able to get around this, unfortunately that's almost all the networks I connect to. Couldn't it just do a scan of nearby networks and look up the MAC address of the hidden networks, and, on a match, then try to establish a connection?
Twinstiq, game news
"[...] because it clearly denotes in human language places that you've spent enough time to use the Wi-Fi."
I though driving by an open hotspot on the highway was enough time to use it. At least they would know on which Highway I drove.
Also according to the article. Somehow iOS manages to have reasonable Wi-fi battery power without using this trick.
How can this sensational headline make into slashdot home page?
No, it doesn't "show you've spent enough time to use the wifi." For fun, grab an Android app called WifiCollector. On a 200-mile drive through three Eastern states a few weeks ago, it sniffed out over a thousand WAPs (most of them not open). Anyone using that to imply I was actually at any of those locations long enough to use the wifi is probably just about smart enough to work in a government intelligence job.
---------------------------------------
Rotate the pod, please, HAL....
This is primarily to be able to access "hidden networks" (hidden SSIDs) - they are called Probe Request packets.
Although it is intended behavior and people who are aware of it can mitigate the problem, it is still very unknown to the general public, and I believe the behavior should be different. Fo sho.
So basically it sounds like anything using the wpa_supplicant code may do this? I can understand why it may be necessary for a hidden network, don't understand why the connecting party would ever transmit anything about past connections for public networks. Isn't SSID included in the beacon every 100ms or so?
The leaking of location data isn't even the whole story.
Vice did a decent documentary on this recently. See: https://www.youtube.com/watch?v=dysnKiXUlRU
Your phone will, by default, try to connect to a Wifi hotspot when it's in range. When it's previously connected to, and remembered an open Wifi network, it creates a security risk. It seems like what they're doing is probing for specific APs, rather than (or as well as) doing a channel scan without specifying the SSID (presumably for reasons of efficiency, thus saving battery life). This allows an in-range malicious user to listen for these probe requests, and then automatically spin up a Wifi hotspot with the same SSID as one of those open networks. Once you're connected, they can intercept any encrypted traffic, and perform MIM attacks. Scary stuff.
ok control, we've discovered that the suspect is called, or knows someone called, 'Tom', and that he once visited a McDonald's... maybe.
There are 2 types of people in this world. Those who understand ternary and those who don't.
"What's more, the same flaw is found in Apple OS X and Windows 7."
Clickbait, maybe?
I think we kind of figured this already.
Just how is my phone "leaking" this information. I you get my phone then you may know where I have been but I am not going to give you my phone if I want to conceal this information.
Wait... am I to determine by this rating that you WERE all surprised by this???!
Here in Thailand / Laos I have recently seen massage parlor signs advertising "Free Wifi". You get in a room with a beautiful lady and she rubs her hands all over your body. Why would you want to check your e-mail? And certainly you would not "Exotic Massage" to show up in your wifi list. But remember that phones are like that. I manually checked my wife's call history to see if she had telephoned my girlfriend.
Except that this protocol was designed long ago.
"I don't know, therefore Aliens" Wafflebox1
If this is for looking up hidden SSIDs, then why not ping looking for know-hidden SSIDs?
"I don't know, therefore Aliens" Wafflebox1
Why do people such as yourself call others "sheep"? Is it because the matrix is true and you are one of the few who took the correct coloured pill?
Does it make you seem superior to others that you are not a "sheep" yet somehow they are?
On rooted Android, one can configure wpa_supplicant to _not_ "scan_ssid" globally but individually, for the hidden APs. Also, one can set the "bssid" of the access points he connects to. There was a need for a better interface a while ago...
That doesn't invalidate the point. Besides, the feature which leaks the information is relatively new, and it leaks more information than necessary, even when following the old protocol (as evidenced by a bugfix which stops Android from broadcasting SSIDs of networks which aren't "hidden".)
For fun, grab an Android app called WifiCollector.
Or MozStumbler, from the makers of Firefox.
But if you're looking for something similar on iOS, you won't find anything on the App Store because there's no public API to log seen SSIDs on iOS. Instead of making a public API, Apple instead just decided to blacklist the entire category of applications in March 2010.
Churches provide free WiFi now? So you have something to do during the sermon?
For the sake of the user's privacy, operating systems need to default to manually sending probe requests. If that isn't convenient enough, and the device has cellular or GPS sensors, then when the user turns on Wi-Fi, the device could briefly turn on cellular and GPS radios and trilaterate nearby towers and satellites in order to determine which SSID's probe request to send.
Have gnu, will travel.
They actually track which stores you visit to monetize ads. If you opt out then a lot of things including Google Now stop working.
http://digiday.com/platforms/g...
They even do the same thing on iOS if you use Gmail, Chrome or Google Now apps.
It is easiest for Google to conduct this passive location tracking on Android users, since Google has embedded location tracking into the software. Once Android users opt in to location services, Google starts collecting their location data as continuously as technologically possible. (Its ability to do so is dependent on cell tower or Wi-Fi signal strength.)
Android is currently the leading mobile OS in the U.S. with a 45.9 percent market share in 2013, according to eMarketer. A little more than a fifth (20.3 percent) of the U.S. population uses Android smartphones.
But Google can also constantly track the location of iPhone users by way of Google apps for iOS, Apple’s mobile operating system. IOS is just behind Android in U.S. market share with 38.3 percent of users, per eMarketer. Nearly 17 percent of the American populace uses an iOS smartphone.
When an iPhone user stops using an app, it continues running “in the background.” The user might not realize it, but the app continues working, much in the same way tabs function on a Web browser.
Google’s namesake iOS app — commonly referred to as Google mobile search — continues collecting a user’s location information when it runs in the background. This information is then used to determine if that user visited a store and whether that store visit can be attributed to a search conducted in the app. Store visits can also be tracked via Google’s other iOS apps that use location services. If iOS users open their Chrome, Gmail or Google Maps app in a store, their location can be deemed a store visit.
And they recently stopped snooping on the free Google Apps and email for Schools and even businesses after doing it for a long time to build ad profiles after they didn't dare telling the same lies in federal court that they were telling to the public about snooping on students to show ads.
http://www.edweek.org/ew/artic...
http://www.edweek.org/ew/artic...
But hey, it's Google so they get a free pass here while if MS did anything even close to that people would be shouting from rooftops.
This space for rent.
This is _really_ old news. I've been to two or three talks about this. How can anyone still be surprised?
Have you heard about SoylentNews?
Got this from a previous discussion on /.
http://forum.xda-developers.co...
Perhaps the true sheep are the ones who go around spouting the sheep meme all the time
Except APL does it too. They just don't advertise it and bury it in the EULA.
Remember, not only are you buying a product, you are also a product when you buy i-things! (haven't you noticed all in-app ads are funneled through just one service?)
I wrote stuff to do this, but to aid in the capture of criminals. This kind of tool is extremely valuable to bounty hunters (professionals and not the assholes kicking down random doors like their cowboys).
Captcha: dictator seems fitting.
What's more, the same flaw is found in Apple OS X and Windows 7.
So why only"Android' in the headline? Why not use "Smartphones"?
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
But hey, it's Google so they get a free pass here while if MS did anything even close to that people would be shouting from rooftops.
That's because MS has been convicted in court of abusing this power. So far, Google appears to have stayed within the law in how it uses this data.
Except that's not true: Google's got into plenty of trouble for grabbing too much data, then not deleting that data when ordered to by the court.
I think you'll find that Google is well on its way to becoming the new MS -- and not just in the market sense. People ARE starting to grumble, and avoid using Google services for some things.
You obviously have evidence for this?
It is possible on an unlocked device to spoof this data by
collecting data from other phones in passing or from a
mesh of friends that pull data from their device and share
it with others.
i.e. should my WiFi device hear such a broadcast.
It could save parts of it, format those and insert the data
randomly into the list of devices my device appears to know about.
After anyone publishes enough to prove the possibility
then the information can no longer be used with impunity against
an individual because data stamps could be changed and
data inserted.... by a third party.
As we know from Snowden papers, TLAs do exploit flaws
and coerce vendors to insert and unlock side doors in devices .
Further all such activity is classified so any jury can
now be presented with reasonable doubt that the evidence
of this type on a phone or laptop has any validity.
Scan recent history for "surveillance equipment is known as a Stingray, an innovative way
for law enforcement to track cellphones used by suspects and gather evidence.
The equipment tricks cellphones into identifying some of their owners’ account information,..."
(theblaze.com)
I am reminded of a plugin to firefox that did much the same thing by randomly
making HTTP connections hither and yon triggered by a chain of "interesting" words.
The intent was to pollute the search history etc.... again to add uncertainty
that the individual was doing anything "of interest" to the prosecution.
On occasion I still fire it up from time to time not because I wish to hide anything I did but because
I wish to protect myself from those that would hide stuff on my system via tricks like
a 1x1 pixel display of a high resolution image download or mouse over abusive
use of JavaScript or modern HTML5 canvases and many many more abusive things.
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
Because it isn't news to you?
Wow, under your dictatorship what enlightenment we'd be able to expect!
The data described as being leaked is not location data. It is the names of SSIDs to which the device has connected before.
Just sayin
"Google is well on its way to becoming the new MS "
Google has already become just like MS and Apple. They all rank at the top of the most successful companies in the world. These companies have been an integral part of the PC and Internet technical revolution. A revolution that has changed the world of communications and commerce. You can question some of their methods but you should try and balance the good and bad when forming your opinions on their "evilness". None of these companies have ever claimed to be philanthropic organizations.
I always thought they carried Bibles...
I believe you are referring to the wi-fi data picked up promiscuously by Google fleet of camera vehicles while taking street view pictures. Their excuses about that were pretty thin as I remember.
I believe you are referring to the wi-fi data picked up promiscuously by Google fleet of camera vehicles while taking street view pictures. Their excuses about that were pretty thin as I remember.
Not as thin as their excuses for not deleting all of it. After saying they had deleted it.
Of course news about a fake are Fake News.
Whether it be location data, or just important information, IONU's app ensures that you no longer have to worry about your data being leaked to anyone but the recipient. IONU's encrypted messaging service provides the privacy and security that is becoming vital in this day and age. Download the app here: https://ionu.com/download