Google location tracking can invade privacy, hackers say

Unique IDs + router addresses = potential abuse

If you've got a Wi-Fi network, chances are Google has used its top-selling Android mobile operating system to store your router's precise location and broadcast it for all the world to see.

Google has been compiling the publicly accessible database of router locations in its quest to build a service, a la Skyhook, that pinpoints the exact location of internet users who use its sites. Now, hobbyist hacker Samy Kamkar has developed a site that demonstrates just how comprehensive Google's catalog is.

Plug the MAC address of your router into Kamkar's website, and chances are it will pull up its precise location, courtesy of Google Maps.

In October, Google pledged to stop using its world-roving Street View vehicles to collect Wi-Fi data and said it instead would rely on Android handsets to get the information. When phones running the Google OS detect any wireless network, they beam its MAC address, signal strength and GPS coordinates to Google servers, along with the unique ID of the handset.

Google has long given assurances that it will use the geolocation database only when users give their explicit consent, such as when they want to be spared the hassle of typing in their current address when getting driving directions. But Kamkar has demonstrated at least two hacks that allow operators of unscrupulous websites to pilfer the information from Google's database anyway, allowing them to know the precise whereabouts of vulnerable visitors.

The database had no trouble locating a router in use since only late December in The Register's San Francisco bureau.

Screen capture of Reg router on Google Maps

Location of Reg router, courtesy of Google Maps

Kamkar's website was introduced a day after he made public research that Android handsets collect nearby Wi-Fi access points and their geographic location every few seconds and transmit the information, along with the device's unique identifier, to the company several times per hour.

“Android phones are wardriving,” Kamkar told The Register. “They're sending all your GPS coordinates. They know how fast you're traveling. Theres a unique identifier that's always sent.”

By combining the location and the unique identifier several times a day every single day, Kamkar said, it wouldn't be hard for Google to figure out where you live and work. And since Android phones track the signal strength of each Wi-Fi network they see, there's a good chance Google could also figure out the MAC address of your home and business routers.

“And if your Android phone goes onto that wireless network, now you're sending that data with your IP address, which is the same IP address you're probably using to log on to Gmail, Google or whatever.”

Kamkar's website also came as Swedish computer enthusiast Magnus Erikson disclosed the existence of files on Android handsets that caches the device's location and the time it was there. The files, known as cache.cell and cache.wifi, are similar in principle to a database stored on Apple iPhones and iPads that can store histories of users comings and goings without their knowledge. Law enforcement agencies have already been tapping the file to learn the whereabouts of iPhone users.

But the Android cache appears to contain at least one significant difference: It limits locations derived from cellphone towers to just 50 entries and Wi-Fi data to just 200. There is no evidence that the consolidated.db file stored on iPhones and iPads has any constraints.

A Google spokeswoman issued a statement that read:

All location sharing on Android is opt-in by the user. We provide users with notice and control over the collection, sharing and use of location in order to provide a better mobile experience on Android devices. Any location data that is sent back to Google location servers is anonymized and is not tied or traceable to a specific user.

We're guessing the only way to opt out is to exchange your Android device for a competing handset. We're not sure what to make of the word "anonymized," given the inclusion of a unique ID. We're guessing a determined law enforcement agent might be able to piece together enough of the information Google collects to figure out who you are.

Of course, Google isn't saying anything more publicly about these data collection policies, just as Apple isn't divulging much about the location caching of iPhone and iPad users. It doesn't give you a warm and fuzzy feeling about privacy in the age of mobile devices, does it? ®

Sponsored: 5 critical considerations for enterprise cloud backup