Google location tracking can invade privacy, hackers say

Unique IDs + router addresses = potential abuse


If you've got a Wi-Fi network, chances are Google has used its top-selling Android mobile operating system to store your router's precise location and broadcast it for all the world to see.

Google has been compiling the publicly accessible database of router locations in its quest to build a service, a la Skyhook, that pinpoints the exact location of internet users who use its sites. Now, hobbyist hacker Samy Kamkar has developed a site that demonstrates just how comprehensive Google's catalog is.

Plug the MAC address of your router into Kamkar's website, and chances are it will pull up its precise location, courtesy of Google Maps.

In October, Google pledged to stop using its world-roving Street View vehicles to collect Wi-Fi data and said it instead would rely on Android handsets to get the information. When phones running the Google OS detect any wireless network, they beam its MAC address, signal strength and GPS coordinates to Google servers, along with the unique ID of the handset.

Google has long given assurances that it will use the geolocation database only when users give their explicit consent, such as when they want to be spared the hassle of typing in their current address when getting driving directions. But Kamkar has demonstrated at least two hacks that allow operators of unscrupulous websites to pilfer the information from Google's database anyway, allowing them to know the precise whereabouts of vulnerable visitors.

The database had no trouble locating a router in use since only late December in The Register's San Francisco bureau.

Screen capture of Reg router on Google Maps

Location of Reg router, courtesy of Google Maps

Kamkar's website was introduced a day after he made public research that Android handsets collect nearby Wi-Fi access points and their geographic location every few seconds and transmit the information, along with the device's unique identifier, to the company several times per hour.

“Android phones are wardriving,” Kamkar told The Register. “They're sending all your GPS coordinates. They know how fast you're traveling. Theres a unique identifier that's always sent.”

By combining the location and the unique identifier several times a day every single day, Kamkar said, it wouldn't be hard for Google to figure out where you live and work. And since Android phones track the signal strength of each Wi-Fi network they see, there's a good chance Google could also figure out the MAC address of your home and business routers.

“And if your Android phone goes onto that wireless network, now you're sending that data with your IP address, which is the same IP address you're probably using to log on to Gmail, Google or whatever.”

Kamkar's website also came as Swedish computer enthusiast Magnus Erikson disclosed the existence of files on Android handsets that caches the device's location and the time it was there. The files, known as cache.cell and cache.wifi, are similar in principle to a database stored on Apple iPhones and iPads that can store histories of users comings and goings without their knowledge. Law enforcement agencies have already been tapping the file to learn the whereabouts of iPhone users.

But the Android cache appears to contain at least one significant difference: It limits locations derived from cellphone towers to just 50 entries and Wi-Fi data to just 200. There is no evidence that the consolidated.db file stored on iPhones and iPads has any constraints.

A Google spokeswoman issued a statement that read:

All location sharing on Android is opt-in by the user. We provide users with notice and control over the collection, sharing and use of location in order to provide a better mobile experience on Android devices. Any location data that is sent back to Google location servers is anonymized and is not tied or traceable to a specific user.

We're guessing the only way to opt out is to exchange your Android device for a competing handset. We're not sure what to make of the word "anonymized," given the inclusion of a unique ID. We're guessing a determined law enforcement agent might be able to piece together enough of the information Google collects to figure out who you are.

Of course, Google isn't saying anything more publicly about these data collection policies, just as Apple isn't divulging much about the location caching of iPhone and iPad users. It doesn't give you a warm and fuzzy feeling about privacy in the age of mobile devices, does it? ®


Other stories you might like

  • Running Windows 10? Microsoft is preparing to fire up the update engines

    Winter Windows Is Coming

    It's coming. Microsoft is preparing to start shoveling the latest version of Windows 10 down the throats of refuseniks still clinging to older incarnations.

    The Windows Update team gave the heads-up through its Twitter orifice last week. Windows 10 2004 was already on its last gasp, have had support terminated in December. 20H2, on the other hand, should be good to go until May this year.

    Continue reading
  • Throw away your Ethernet cables* because MediaTek says Wi-Fi 7 will replace them

    *Don't do this

    MediaTek claims to have given the world's first live demo of Wi-Fi 7, and said that the upcoming wireless technology will be able to challenge wired Ethernet for high-bandwidth applications, once available.

    The fabless Taiwanese chip firm said it is currently showcasing two Wi-Fi 7 demos to key customers and industry collaborators, in order to demonstrate the technology's super-fast speeds and low latency transmission.

    Based on the IEEE 802.11be standard, the draft version of which was published last year, Wi-Fi 7 is expected to provide speeds several times faster than Wi-Fi 6 kit, offering connections of at least 30Gbps and possibly up to 40Gbps.

    Continue reading
  • Windows box won't boot? SystemRescue 9 may help

    An ISO image you can burn or drop onto a USB key

    The latest version of an old friend of the jobbing support bod has delivered a new kernel to help with fixing Microsoft's finest.

    It used to be called the System Rescue CD, but who uses CDs any more? Enter SystemRescue, an ISO image that you can burn, or just drop onto your Ventoy USB key, and which may help you to fix a borked Windows box. Or a borked Linux box, come to that.

    SystemRescue 9 includes Linux kernel 5.15 and a minimal Xfce 4.16 desktop (which isn't loaded by default). There is a modest selection of GUI tools: Firefox, VNC and RDP clients and servers, and various connectivity tools – SSH, FTP, IRC. There's also some security-related stuff such as Yubikey setup, KeePass, token management, and so on. The main course is a bunch of the usual Linux tools for partitioning, formatting, copying, and imaging disks. You can check SMART status, mount LVM volumes, rsync files, and other handy stuff.

    Continue reading

Biting the hand that feeds IT © 1998–2022