Tool Reveals iPad and iPhone User Locations 36
mask.of.sanity writes "A researcher has found that Apple user locations can be potentially determined by tapping into Apple Maps and he has created a Python tool to make the process easier. iSniff GPS accesses Apple's database of wireless access points, which is collected by iPhones and iPads that have GPS and Wi-Fi location services enabled. Apple uses this crowd-sourced data to run its location services; however, the location database is not meant to be public. You can download the tool via Giuthub."
Re:Protect yourself (Score:4, Interesting)
Joining, and discovering are not the same thing. You don't need to join a network for your phone to register it as near your location.
Re:Protect yourself (Score:5, Interesting)
Joining, and discovering are not the same thing. You don't need to join a network for your phone to register it as near your location.
Absolutely true. But your phone won't give away the MAC address of your previous network unless it's trying to join the fake wifi network. Unless I'm greatly misunderstanding what I read.
From GitHub:
To solicit ARPs from iOS devices, set up an access point with DHCP disabled (e.g. using airbase-ng) and configure your sniffing interface to the same channel.
Once associated, iOS devices will send up to three ARPs destined for the MAC address of the DHCP server on previously joined networks. On typical home WiFi routers, the DHCP server MAC address is the same as the WiFi interface MAC address, which can be used for accurate geolocation. On larger corporate WiFi networks, the MAC of the DHCP server may be different and thus cannot be used for geolocation.
I'm pretty sure that for a device to be associated, it has to be attempting to join the network. I could be wrong, I'm not a WiFi engineer. Please correct me if I'm wrong about that.