Slashdot Mirror

← Back to Stories (view on slashdot.org)

Android Bug Allows Geolocation Tracking of Users (duo.com)

Posted by msmash on from the privacy-woes dept.

Trailrunner7 writes: Researchers have discovered a weakness in all version of Android except 9, the most recent release, that can allow an attacker to gather sensitive information such as the MAC address and BSSID name and pinpoint the location of an affected device. The vulnerability is a result of the way that Android broadcasts device information to apps installed on a device. The operating system uses a mechanism known as an intent to send out information between processes or applications, and some of the information about the device's WiFi network interface sent via a pair of intents can be used by an attacker to track a device closely.

A malicious app -- or just one that is listening for the right broadcasts from Android -- would be able to identify any individual Android device and geolocate it. An attacker could use this weaknesses to track a given device, presumably without the user's knowledge. Although Android has had MAC address randomization implemented since version 6, released in 2015, Yakov Shafranovich of Nightwatch Cybersecurity said his research showed that an attacker can get around this restriction.

6 of 46 comments (clear)

  1. Wow. That is pathetic by 110010001000 · · Score: 5, Interesting

    That is really pathetic implementation by Google. The idea is that your application should have to register for special permissions to access this information, but apparently the system broadcasts it to all listening applications on the device. The fact that this actually exists makes me wonder about the entire codebase. There should be single point in the code where intents are sent out and matched against access/permissions. It sounds like spaghetti.

    1. Re:Wow. That is pathetic by 110010001000 · · Score: 3, Funny

      Ooops take it back. Doesn't require any permissions at all. I'm back to pathetic again.

    2. Re:Wow. That is pathetic by Xylantiel · · Score: 2

      Yeah, this is sad. I'm not sure what idiot at Google thought it was okay to broadcast wifi state info to apps that don't have permission to access the wifi state. I can see how it might be ambiguous whether the BSSID or the base station MAC are included in "wifi state" information, but obviously if I have denied an app permission to access wifi state I didn't just mean it can't request wifi state information, really I meant that it shouldn't be given it by the OS.

      Another question: What information to these broadcasts contain in LineageOS?

    3. Re:Wow. That is pathetic by Xylantiel · · Score: 2

      Also, the article say that the issue is being "fixed", but it is still unclear if an app with "network state" permission has access to the BSSID or base station mac, which in many cases effectively gives coarse location. I have often wondered whether requesting "network state" permission was a sneaky way to do geolocation, but never looked into it carefully. And, once again, my next question would be whether the information available to apps with network state permission is different for LineageOS.

  2. Why assume it is a bug? by BobK65 · · Score: 2, Interesting

    Maybe it is just an undocumented feature installed for those in the know.

  3. Re:Pls, technical users... by OrangeTide · · Score: 2

    No spyware in AOSP. But when people say Android they are referring to about two dozen forks of it. And it's really tough to generalize about such a diverse set.

    All I know is that Android dev tools are free, and I can post my shitty apps on the Plat Store. Unlike Apple that enforces arbitrary and ever changing standards and keeps taking my stuff down. Maybe if I were a professional company instead of a hobbyist the App store would be more manageable but for hobbyist hackers, Android is the easier platform to target.

    P.S. I don't think you're sorry at all.

    --
    “Common sense is not so common.” — Voltaire