Schneier on Security

ShadowHatesYou • November 24, 2010 6:29 PM

There’s another way to do this on any phone: Abuse the use of google’s
services. Pretty much all geolocation on phones is done either via
GPS(which can be disabled in security settings, or in the case of
verizon blackberries is unavailable to non-verizon approved
applications such as Google Maps), or failing that the use of the
google gears geolocation API. The google gears geolocation API uses
the MAC addresses of wifi access points to determine your location,
and pretty much every application I’ve looked at that does geolocation
falls back to this one single API, with documentation available at
http://code.google.com/apis/gears/api_geolocation.html

The following bash script will look up the GPS coordinates for a given
AP, as detected by the google street view car:
http://squatthis.net/papers/whereisap.sh

This API presents 2 painfully obvious problems:

1) Anyone can spoof a MAC address with an access point, so the use of
MACs for geolocation provides an unreliable reference that can be
cheated easily, without purchasing any special equipment what-so-ever.
All you need to lie to a device is a wireless router, or failing that
a wifi card that supports traffic injection. Place your wifi card
right next to the phone and start injecting beacon frames(which can be
generated via packetforge-ng), and all of a sudden your phone thinks
it’s somewhere it’s not. My blackberry exhibits this behavior, and
doesn’t care about the other wifi signals in the area.

2) When a computer system is compromised, or a java applet is allowed
to run(The MAC address can be obtained by doing either an arp -a, or
using the java equivilent to obtain the default gateway’s MAC
address.), a computer can be geolocated to a very specific area,
with the nearest address provided like so:

shadow@tourian:~/www/papers> ./whereisap.sh 00-C0-26-A9-42-F7
{“location”:{“latitude”:36.1741596,”longitude”:-86.7514764,”address”:{“country”:”United
States”,”country_code”:”US”,”region”:”Tennessee”,”county”:”Davidson”,”city”:”Nashville”,”street”:”Fatherland
St”,”street_number”:”1004″,”postal_code”:”37206″},”accuracy”:73.0},”access_token”:”2:j6Ln5E70bAfWUr5w:2rS_7lt-3gWX-xY7″}

How long until we start seeing incredibly geolocation-assited
targetted ads? There’s no throttling applied to these API queries(as
most mobile devices are NATed), so there’s really no stopping
advertisers from embedding applets and sending the MAC back to the
server.