5 ms·

A question for the Android experts: is it possible to block or spoof location data, through a custom build? Could I have an Android phone running a program tha

by pravda 6y ago

A question for the Android experts: is it possible to block or spoof location data, through a custom build? Could I have an Android phone running a program that spoofs a long steady drive from Tampa to Butte?

realharo 6y ago
On a custom ROM, sure. That's why games like Pokemon Go blocked them. Using it as a daily driver is not advisable though.
- Firerouge 6y ago
  At worst, having root should be the most that's required, which only on some phones requires a custom rom. Android has built in support for location spoofing with the developer mode option, select mock location app.
  - realharo 6y ago
    Other apps can easily check whether the location comes from a mock source and discard such data. https://developer.android.com/reference/android/location/Location#isFromMockProvider() https://developer.android.com/reference/android/location/Loc...
    - mindslight 6y ago
      These type of security vulnerabilities are due to the core OS/APIs being developed by a surveillance company that isn't concerned with user privacy, and they're countless. There isn't enough will in the Free world to mitigate even the most glaring ones either, such as LineageOS not incorporating the MicroG patches. The end result being more forks, more confusion, and groups of users remaining unprotected. Commoditize your complements, indeed.
seibelj 6y ago
Yes, it’s very possible, I did similar work years ago patching functions on jail broken phones for seamless encryption.
cosmojg 6y ago
I had the option to spoof location data under "Developer options" in Settings with the original OnePlus ROM, but it's even easier to accomplish now that I'm running LineageOS. In short, yes.
rmrfstar 6y ago
Yes, but that does not stop the cell providers from selling your location [1]. You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble [2]. [1] https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hu... [2] https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hack-iphone.html https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hac...
- oarsinsync 6y ago
  > You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble The article also points to WhatsApp as the infection vector. I agree that anything Facebook produces is fair game as far as being sketchy goes, but it’s not the only messaging platform to have been exploited. Do we run all messaging services in independent sandboxes in VMs?
- laegooose 6y ago
  [2] says Bezos' iPhone was hacked via WhatsApp with the NSO Group-developed exploit. It is not possible to run iOS VM in the cloud, and even for Android it does not sound practical at all.
drivebycomment 6y ago
Why bother spoofing when you can simply turn location permission off ?
- panpanna 6y ago
  Spoofing adds noise to the data, making it worth less. If enough people do it in a way that cannot be easily detected, the market for this sort of data will shrink quickly.
  - drivebycomment 6y ago
    I don't see how spoofing is better than blocking. If enough people block it, the market will shrink even faster. It's also much easier for people to block than "spoof". Spoofing seems practically pointless and academic compared to blocking.

by pravda 6y ago

realharo 6y ago

On a custom ROM, sure. That's why games like Pokemon Go blocked them. Using it as a daily driver is not advisable though.

Firerouge 6y ago
At worst, having root should be the most that's required, which only on some phones requires a custom rom. Android has built in support for location spoofing with the developer mode option, select mock location app.
- realharo 6y ago
  Other apps can easily check whether the location comes from a mock source and discard such data. https://developer.android.com/reference/android/location/Location#isFromMockProvider() https://developer.android.com/reference/android/location/Loc...
  - mindslight 6y ago
    These type of security vulnerabilities are due to the core OS/APIs being developed by a surveillance company that isn't concerned with user privacy, and they're countless. There isn't enough will in the Free world to mitigate even the most glaring ones either, such as LineageOS not incorporating the MicroG patches. The end result being more forks, more confusion, and groups of users remaining unprotected. Commoditize your complements, indeed.

seibelj 6y ago

Yes, it’s very possible, I did similar work years ago patching functions on jail broken phones for seamless encryption.

cosmojg 6y ago

I had the option to spoof location data under "Developer options" in Settings with the original OnePlus ROM, but it's even easier to accomplish now that I'm running LineageOS. In short, yes.

rmrfstar 6y ago

Yes, but that does not stop the cell providers from selling your location [1]. You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble [2]. [1] https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hu... [2] https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hack-iphone.html https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hac...

oarsinsync 6y ago
> You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble The article also points to WhatsApp as the infection vector. I agree that anything Facebook produces is fair game as far as being sketchy goes, but it’s not the only messaging platform to have been exploited. Do we run all messaging services in independent sandboxes in VMs?
laegooose 6y ago
[2] says Bezos' iPhone was hacked via WhatsApp with the NSO Group-developed exploit. It is not possible to run iOS VM in the cloud, and even for Android it does not sound practical at all.

drivebycomment 6y ago

Why bother spoofing when you can simply turn location permission off ?

panpanna 6y ago
Spoofing adds noise to the data, making it worth less. If enough people do it in a way that cannot be easily detected, the market for this sort of data will shrink quickly.
- drivebycomment 6y ago
  I don't see how spoofing is better than blocking. If enough people block it, the market will shrink even faster. It's also much easier for people to block than "spoof". Spoofing seems practically pointless and academic compared to blocking.