Google location tracking can invade privacy, hackers say
Unique IDs + router addresses = potential abuse
Agentless Backup is Not a Myth
If you've got a Wi-Fi network, chances are Google has used its top-selling Android mobile operating system to store your router's precise location and broadcast it for all the world to see.
Google has been compiling the publicly accessible database of router locations in its quest to build a service, a la Skyhook, that pinpoints the exact location of internet users who use its sites. Now, hobbyist hacker Samy Kamkar has developed a site that demonstrates just how comprehensive Google's catalog is.
Plug the MAC address of your router into Kamkar's website, and chances are it will pull up its precise location, courtesy of Google Maps.
In October, Google pledged to stop using its world-roving Street View vehicles to collect Wi-Fi data and said it instead would rely on Android handsets to get the information. When phones running the Google OS detect any wireless network, they beam its MAC address, signal strength and GPS coordinates to Google servers, along with the unique ID of the handset.
Google has long given assurances that it will use the geolocation database only when users give their explicit consent, such as when they want to be spared the hassle of typing in their current address when getting driving directions. But Kamkar has demonstrated at least two hacks that allow operators of unscrupulous websites to pilfer the information from Google's database anyway, allowing them to know the precise whereabouts of vulnerable visitors.
The database had no trouble locating a router in use since only late December in The Register's San Francisco bureau.
Location of Reg router, courtesy of Google Maps
Kamkar's website was introduced a day after he made public research that Android handsets collect nearby Wi-Fi access points and their geographic location every few seconds and transmit the information, along with the device's unique identifier, to the company several times per hour.
“Android phones are wardriving,” Kamkar told The Register. “They're sending all your GPS coordinates. They know how fast you're traveling. Theres a unique identifier that's always sent.”
By combining the location and the unique identifier several times a day every single day, Kamkar said, it wouldn't be hard for Google to figure out where you live and work. And since Android phones track the signal strength of each Wi-Fi network they see, there's a good chance Google could also figure out the MAC address of your home and business routers.
“And if your Android phone goes onto that wireless network, now you're sending that data with your IP address, which is the same IP address you're probably using to log on to Gmail, Google or whatever.”
Kamkar's website also came as Swedish computer enthusiast Magnus Erikson disclosed the existence of files on Android handsets that caches the device's location and the time it was there. The files, known as cache.cell and cache.wifi, are similar in principle to a database stored on Apple iPhones and iPads that can store histories of users comings and goings without their knowledge. Law enforcement agencies have already been tapping the file to learn the whereabouts of iPhone users.
But the Android cache appears to contain at least one significant difference: It limits locations derived from cellphone towers to just 50 entries and Wi-Fi data to just 200. There is no evidence that the consolidated.db file stored on iPhones and iPads has any constraints.
A Google spokeswoman issued a statement that read:
All location sharing on Android is opt-in by the user. We provide users with notice and control over the collection, sharing and use of location in order to provide a better mobile experience on Android devices. Any location data that is sent back to Google location servers is anonymized and is not tied or traceable to a specific user.
We're guessing the only way to opt out is to exchange your Android device for a competing handset. We're not sure what to make of the word "anonymized," given the inclusion of a unique ID. We're guessing a determined law enforcement agent might be able to piece together enough of the information Google collects to figure out who you are.
Of course, Google isn't saying anything more publicly about these data collection policies, just as Apple isn't divulging much about the location caching of iPhone and iPad users. It doesn't give you a warm and fuzzy feeling about privacy in the age of mobile devices, does it? ®
COMMENTS
muthaf***ers
This is shit. My gf has an android, because I told her that the church of jobs was underspecced and too expensive and I prefer open source based software.
So now Android is barely open source and they are spying on our hardware. What a bunch of wankers.
I hate them all, I just want to go and live in a field somewhere, till the land, make clothes out of sheepskin, expect nothing more than a cup of sugar for my birthday, sing fireside songs and fuck my brains out for entertainment....
No I'm not a luddite, I have a Soft Eng degree, but please stop the world, I want to get off
Come on then...
.. you all tore Apple to shreds about their location services file, now its time to do the same to Google.
Big Brother has arrived.
@Paratrooping Parrot, "Something really needs to be done about this NOW!"
Something needed to be done about privacy laws 5 years ago, which would have meant that by now, we would have had some laws in place that were ready to prevent it ever getting this bad in the first place. But no, 5 years ago there were too many brainwashed sheep online repeating what they had been taught to say such as, "if you've got nothing to hide etc.." and that persisted until people interested in history could show the "nothing to hide" argument is a complete pack of lies and the lies come from the people who want to spy on everyone.
The abuse of our privacy online has become a completely lawless wild west for morally corrupt companies to do whatever they bloody well want and like with our privacy information and we can't stop them and its all done for their gain. Worse still the governments have intentionally done nothing to stop it because they don't really want to stop it. This is shown perfectly by the way Phorm have got away with so much. Its prefect proof of how the government are not interested in protecting our privacy. Thats because the governments know they can also abuse all our privacy information for their gain as well. So as the governments will not stop it, its going to get ever worse.
For example “Google pledged to stop using its world-roving Street View vehicles to collect Wi-Fi data and said it instead would rely on Android handsets to get the information”
Which means we are now at the shocking point where Google are trying to use all Android users literally as their spies! ... All to build up information for Google ... That means every Android user is now a spy for Google! We are all becoming effectively like a modern day electronic version of the Hitler youth reporting back to Google high command! It means any information Google wants, they just have to update their OS and then we all spy for them! Hows that for Orwellian and its happening now! So WTF are we to face in the years to come, now we are already at this shocking point!
Its completely lawless and the governments don't want to stop the companies and it won't stop, it will continue to get ever worse, until finally everyone has had enough of the corruption and exploitation and everyone finally stands together against the governments and says no more. Then and only then will the governments begrudgingly start to slowly, ever so slowly, stop the companies exploitation and it will take years of them delaying at every step, because they don't really want to change and it will get a lot worse in that time.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
