Feeds

Google location tracking can invade privacy, hackers say

Unique IDs + router addresses = potential abuse

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

If you've got a Wi-Fi network, chances are Google has used its top-selling Android mobile operating system to store your router's precise location and broadcast it for all the world to see.

Google has been compiling the publicly accessible database of router locations in its quest to build a service, a la Skyhook, that pinpoints the exact location of internet users who use its sites. Now, hobbyist hacker Samy Kamkar has developed a site that demonstrates just how comprehensive Google's catalog is.

Plug the MAC address of your router into Kamkar's website, and chances are it will pull up its precise location, courtesy of Google Maps.

In October, Google pledged to stop using its world-roving Street View vehicles to collect Wi-Fi data and said it instead would rely on Android handsets to get the information. When phones running the Google OS detect any wireless network, they beam its MAC address, signal strength and GPS coordinates to Google servers, along with the unique ID of the handset.

Google has long given assurances that it will use the geolocation database only when users give their explicit consent, such as when they want to be spared the hassle of typing in their current address when getting driving directions. But Kamkar has demonstrated at least two hacks that allow operators of unscrupulous websites to pilfer the information from Google's database anyway, allowing them to know the precise whereabouts of vulnerable visitors.

The database had no trouble locating a router in use since only late December in The Register's San Francisco bureau.

Screen capture of Reg router on Google Maps

Location of Reg router, courtesy of Google Maps

Kamkar's website was introduced a day after he made public research that Android handsets collect nearby Wi-Fi access points and their geographic location every few seconds and transmit the information, along with the device's unique identifier, to the company several times per hour.

“Android phones are wardriving,” Kamkar told The Register. “They're sending all your GPS coordinates. They know how fast you're traveling. Theres a unique identifier that's always sent.”

By combining the location and the unique identifier several times a day every single day, Kamkar said, it wouldn't be hard for Google to figure out where you live and work. And since Android phones track the signal strength of each Wi-Fi network they see, there's a good chance Google could also figure out the MAC address of your home and business routers.

“And if your Android phone goes onto that wireless network, now you're sending that data with your IP address, which is the same IP address you're probably using to log on to Gmail, Google or whatever.”

Kamkar's website also came as Swedish computer enthusiast Magnus Erikson disclosed the existence of files on Android handsets that caches the device's location and the time it was there. The files, known as cache.cell and cache.wifi, are similar in principle to a database stored on Apple iPhones and iPads that can store histories of users comings and goings without their knowledge. Law enforcement agencies have already been tapping the file to learn the whereabouts of iPhone users.

But the Android cache appears to contain at least one significant difference: It limits locations derived from cellphone towers to just 50 entries and Wi-Fi data to just 200. There is no evidence that the consolidated.db file stored on iPhones and iPads has any constraints.

A Google spokeswoman issued a statement that read:

All location sharing on Android is opt-in by the user. We provide users with notice and control over the collection, sharing and use of location in order to provide a better mobile experience on Android devices. Any location data that is sent back to Google location servers is anonymized and is not tied or traceable to a specific user.

We're guessing the only way to opt out is to exchange your Android device for a competing handset. We're not sure what to make of the word "anonymized," given the inclusion of a unique ID. We're guessing a determined law enforcement agent might be able to piece together enough of the information Google collects to figure out who you are.

Of course, Google isn't saying anything more publicly about these data collection policies, just as Apple isn't divulging much about the location caching of iPhone and iPad users. It doesn't give you a warm and fuzzy feeling about privacy in the age of mobile devices, does it? ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.