7 ms·

Everyone knows your location, Part 2: try it yourself and share the results

318 points by mtlynch 2y ago

ebfe1 2y ago
Not exactly related but on the topic of finding target's location, A few years ago i used to run a little demo of capturing probe wifi ssid network on prefered network list of nearby devices and used https://wigle.net/ https://wigle.net/ to identify places that people has visited... it was eye opening for some people in the audience for sure.
- az09mugen 2y ago
  Wow, the map gives a good insight of where "technological humans" are concentrated.
  - yapyap 2y ago
    or where people are actually recording wifi networksk, wigle is kept up to date by volunteers
    - xattt 2y ago
      Complete dead zone in my area, even though the wifi SSIDs are saturated.
- thenthenthen 2y ago
  That sounds like a super fun demo to do live! I have seen people om social media post their funny ssids around their house…please do not.
- sweetjuly 2y ago
  Relatedly, one of my favorite recent papers is "Surveilling the Masses with Wi-Fi-Based Positioning System" [1]. In the paper, they (ab)use the fact that smartphones report the location of WiFi access points to public databases in order to track human migration over several large scale events (from natural disasters to the invasion of Ukraine). [1] https://arxiv.org/pdf/2405.14975 https://arxiv.org/pdf/2405.14975
ddxv 2y ago
I have something similar: https://appgoblin.info https://appgoblin.info which let's you see trackers installed on mobile apps and an Android app that lets you see those on your phone. I'm working on automating a flow similar to the OPs but with an emulator so it can run on a server, but it's pretty difficult. If anyone has advice I'd love to hear it. My biggest problem is how finnicky getting the rooted emulator plus apps is. My current flow for mitm and waydroid is here: https://github.com/ddxv/mobile-network-traffic https://github.com/ddxv/mobile-network-traffic Hope anyone has some advice! Edit: just want to mention that the OPs flow is definitely better for capturing real data and endpoints, but I didn't see how I could automate it?
0x008 2y ago
We all kind of know this is true, but it’s always really eyeopening to see to what extent these companies know everything about us. Even worse is, I think, that somehow they are allowed to sell all the data and that you can basically buy data about everybody easily online[1] [1]: https://media.ccc.de/v/38c3-databroker-files-wie-uns-apps-und-datenhndler-der-massenberwachung-ausliefern https://media.ccc.de/v/38c3-databroker-files-wie-uns-apps-un...
- yapyap 2y ago
  > We all kind of know this is true, but it’s always really eyeopening to see to what extent these companies know everything about us. I agree, if you have a Spotify account I implore you ( and anyone reading ) to download their Spotify data [1] and just look through it, it’s really interesting. I hear news about how big companies are collecting all our data and got kinda desensitized to just the news but to see it applied to you and your specific music experience is pretty eye (re-)opening. 1. https://support.spotify.com/us/article/data-rights-and-privacy-settings/ https://support.spotify.com/us/article/data-rights-and-priva...
  - A4ET8a8uTh0_v2 2y ago
    Could you elaborate a little further ( maybe not data itself, but its type and so on )? I don't have Spotify, but I am obviously fairly interested in the subject as a whole ( and that business model spread widely ).
  - morkalork 2y ago
    Thanks! Giving it a try. I've been using Google's take out to download my Fitbit data already because the app is so shit these days. I wonder what else has these data dumps available.
- thenthenthen 2y ago
  Ah there was a great talk at CCC (actually 2) about a guy tracking Germany’s politicians, they deducted crazy relations from publicly available data iirc. I cannot find the talk right now sadly. Was it in German?
3abiton 2y ago
I know this topics comes up ever so often here, but this is really amazing demo. A reminder that on Android you can use tools like XPL-EX (previously XprivacyLua) to heavily block such calls and libraries, or something simpler even like something like [App Manager](https://muntashirakon.github.io/AppManager/ https://muntashirakon.github.io/AppManager/).
- schrectacular 2y ago
  Could you share a bit on how to identify and block offenders with AppManager?
  - 3abiton 2y ago
    The app has many features, one specifically can decompile and dissect other apps methods, and gives you the ability to disable them. It does lead to crashes, that's why XPL-EX is a cleaner option.
- williamscales 2y ago
  You would need to be rooted for that sort of blocking to be an option, right?
  - prettyStandard 2y ago
    I think you can run a DNS server, and configure Android with a custom DNS server. Not sure about this exact case though.
  - 3abiton 2y ago
    Yes, that's a given. I totally disagree with google's philosophy of locking down android features once you root, it's totally unwarranted.
lrvick 2y ago
You actually can opt out of this. Personally I have not had a cell phone subscription in ~5 years and only use cash IRL.
- stavros 2y ago
  You can actually opt out of this. Vote for politicians that want to regulate this into illegality.
  - hulitu 2y ago
    > You can actually opt out of this. Vote for politicians that want to regulate this into illegality. The parliament has more than one politician and the advertising companies pay better. To opt out of it you need to put politicians in jail for conflict of interest and bribes and make campains against big tech (which could lead to your "suicide). Good luck with that.
    - xico 2y ago
      Isn’t it what the EU is doing step by step to protect its citizens? Politicians should be jailed, both on the legislative and executive side, including Presidents, if they ignore the law. France is showing this once again with hopeful Marine Le Pen and former president Sarkozy, together with dozens of their associates.
  - lclc 2y ago
    But then the government couldn't track you anymore with the help of those companies.
  - whobre 2y ago
    There are no such politicians, and even if they were your vote does not matter.
    - stavros 2y ago
      Laughs in GDPR
bix6 2y ago
Most of us need cellphones so are we just out of luck?
- franga2000 2y ago
  You need a cellphone, but you really don't much on it. Browser, email, a chat app or three, banking, navigation, public transport/parking. Most of these have good privacy-minded options or are usually not the biggest offenders. It's games, ecommerce, social media and such that do the most spying, and you can absolutely live without those apps.
  - 2mlWQbCK 2y ago
    Does turning off data (mobile+wifi) when not actually using any app help at all (on Android)? Will apps still be able to phone home in the background? Or will they just fill up a huge cache with data and bulk-transfer it the next time the phone is online? Maybe at least disconnecting from the internet while not using it will make location tracking slightly more difficult?
    - ghaff 2y ago
      Yes? I assume. If I’m international and am not using my US plan they’d better not be using my home plan in background and I’ve never seen any evidence they were.
  - bix6 2y ago
    Is that true though? I know the banks sell my info to third parties. I love games. Is there no way to safely block their network calls?
    - gruez 2y ago
      >I love games. Is there no way to safely block their network calls? Use a VPN?
      - 2y ago
curtisszmania 2y ago
[dead]
tedunangst 2y ago
Has anyone else actually tried it themselves?
timsh 2y ago
author here to answer any questions or discuss an app
- jrmg 2y ago
  On the question of “why do they collect all this data” - brightness, battery life, headphone usage, volume etc: It’s not just because the data is valuable in itself, it’s also to ‘fingerprint’ the device across IPFA boundaries and in the face of things like NAT and VPNs. There are so many disparate data points that are different across different devices that two apps reporting an identical or near-identical set in a short timeframe are likely on the same device.
- Teever 2y ago
  Are you aware of any sousveillance projects with the goal of identifying and monitoring the people responsible for this tracking?
- alphan0n 2y ago
  Good stuff. You might find more interesting data by implementing Frida [0] into your process to snoop on encrypted traffic normally not visible due to pinned certificates. [0] https://frida.re/docs/home/ https://frida.re/docs/home/
  - sunbum 2y ago
    And more specifically just use the maintained scripts from HTTP Toolkit. https://github.com/httptoolkit/frida-interception-and-unpinning https://github.com/httptoolkit/frida-interception-and-unpinn...
    - alphan0n 2y ago
      Excellent, thank you. There’s a lot to Frida. HTTP Toolkit only mentions using jailbroken iOS devices, but you can also use unjailbroken devices running v13+ via injection [0] [0] https://frida.re/docs/ios/ https://frida.re/docs/ios/
- 2y ago

318 points by mtlynch 2y ago

Not exactly related but on the topic of finding target's location, A few years ago i used to run a little demo of capturing probe wifi ssid network on prefered network list of nearby devices and used https://wigle.net/ https://wigle.net/ to identify places that people has visited... it was eye opening for some people in the audience for sure.

az09mugen 2y ago
Wow, the map gives a good insight of where "technological humans" are concentrated.
- yapyap 2y ago
  or where people are actually recording wifi networksk, wigle is kept up to date by volunteers
  - xattt 2y ago
    Complete dead zone in my area, even though the wifi SSIDs are saturated.
thenthenthen 2y ago
That sounds like a super fun demo to do live! I have seen people om social media post their funny ssids around their house…please do not.
sweetjuly 2y ago
Relatedly, one of my favorite recent papers is "Surveilling the Masses with Wi-Fi-Based Positioning System" [1]. In the paper, they (ab)use the fact that smartphones report the location of WiFi access points to public databases in order to track human migration over several large scale events (from natural disasters to the invasion of Ukraine). [1] https://arxiv.org/pdf/2405.14975 https://arxiv.org/pdf/2405.14975

ddxv 2y ago

I have something similar: https://appgoblin.info https://appgoblin.info which let's you see trackers installed on mobile apps and an Android app that lets you see those on your phone. I'm working on automating a flow similar to the OPs but with an emulator so it can run on a server, but it's pretty difficult. If anyone has advice I'd love to hear it. My biggest problem is how finnicky getting the rooted emulator plus apps is. My current flow for mitm and waydroid is here: https://github.com/ddxv/mobile-network-traffic https://github.com/ddxv/mobile-network-traffic Hope anyone has some advice! Edit: just want to mention that the OPs flow is definitely better for capturing real data and endpoints, but I didn't see how I could automate it?

0x008 2y ago

We all kind of know this is true, but it’s always really eyeopening to see to what extent these companies know everything about us. Even worse is, I think, that somehow they are allowed to sell all the data and that you can basically buy data about everybody easily online[1] [1]: https://media.ccc.de/v/38c3-databroker-files-wie-uns-apps-und-datenhndler-der-massenberwachung-ausliefern https://media.ccc.de/v/38c3-databroker-files-wie-uns-apps-un...

yapyap 2y ago
> We all kind of know this is true, but it’s always really eyeopening to see to what extent these companies know everything about us. I agree, if you have a Spotify account I implore you ( and anyone reading ) to download their Spotify data [1] and just look through it, it’s really interesting. I hear news about how big companies are collecting all our data and got kinda desensitized to just the news but to see it applied to you and your specific music experience is pretty eye (re-)opening. 1. https://support.spotify.com/us/article/data-rights-and-privacy-settings/ https://support.spotify.com/us/article/data-rights-and-priva...
- A4ET8a8uTh0_v2 2y ago
  Could you elaborate a little further ( maybe not data itself, but its type and so on )? I don't have Spotify, but I am obviously fairly interested in the subject as a whole ( and that business model spread widely ).
- morkalork 2y ago
  Thanks! Giving it a try. I've been using Google's take out to download my Fitbit data already because the app is so shit these days. I wonder what else has these data dumps available.
thenthenthen 2y ago
Ah there was a great talk at CCC (actually 2) about a guy tracking Germany’s politicians, they deducted crazy relations from publicly available data iirc. I cannot find the talk right now sadly. Was it in German?

3abiton 2y ago

I know this topics comes up ever so often here, but this is really amazing demo. A reminder that on Android you can use tools like XPL-EX (previously XprivacyLua) to heavily block such calls and libraries, or something simpler even like something like [App Manager](https://muntashirakon.github.io/AppManager/ https://muntashirakon.github.io/AppManager/).

schrectacular 2y ago
Could you share a bit on how to identify and block offenders with AppManager?
- 3abiton 2y ago
  The app has many features, one specifically can decompile and dissect other apps methods, and gives you the ability to disable them. It does lead to crashes, that's why XPL-EX is a cleaner option.
williamscales 2y ago
You would need to be rooted for that sort of blocking to be an option, right?
- prettyStandard 2y ago
  I think you can run a DNS server, and configure Android with a custom DNS server. Not sure about this exact case though.
- 3abiton 2y ago
  Yes, that's a given. I totally disagree with google's philosophy of locking down android features once you root, it's totally unwarranted.

lrvick 2y ago

You actually can opt out of this. Personally I have not had a cell phone subscription in ~5 years and only use cash IRL.

stavros 2y ago
You can actually opt out of this. Vote for politicians that want to regulate this into illegality.
- hulitu 2y ago
  > You can actually opt out of this. Vote for politicians that want to regulate this into illegality. The parliament has more than one politician and the advertising companies pay better. To opt out of it you need to put politicians in jail for conflict of interest and bribes and make campains against big tech (which could lead to your "suicide). Good luck with that.
  - xico 2y ago
    Isn’t it what the EU is doing step by step to protect its citizens? Politicians should be jailed, both on the legislative and executive side, including Presidents, if they ignore the law. France is showing this once again with hopeful Marine Le Pen and former president Sarkozy, together with dozens of their associates.
- lclc 2y ago
  But then the government couldn't track you anymore with the help of those companies.
- whobre 2y ago
  There are no such politicians, and even if they were your vote does not matter.
  - stavros 2y ago
    Laughs in GDPR

bix6 2y ago

Most of us need cellphones so are we just out of luck?

franga2000 2y ago
You need a cellphone, but you really don't much on it. Browser, email, a chat app or three, banking, navigation, public transport/parking. Most of these have good privacy-minded options or are usually not the biggest offenders. It's games, ecommerce, social media and such that do the most spying, and you can absolutely live without those apps.
- 2mlWQbCK 2y ago
  Does turning off data (mobile+wifi) when not actually using any app help at all (on Android)? Will apps still be able to phone home in the background? Or will they just fill up a huge cache with data and bulk-transfer it the next time the phone is online? Maybe at least disconnecting from the internet while not using it will make location tracking slightly more difficult?
  - ghaff 2y ago
    Yes? I assume. If I’m international and am not using my US plan they’d better not be using my home plan in background and I’ve never seen any evidence they were.
- bix6 2y ago
  Is that true though? I know the banks sell my info to third parties. I love games. Is there no way to safely block their network calls?
  - gruez 2y ago
    >I love games. Is there no way to safely block their network calls? Use a VPN?
    - 2y ago

curtisszmania 2y ago

[dead]

tedunangst 2y ago

Has anyone else actually tried it themselves?

timsh 2y ago

author here to answer any questions or discuss an app

jrmg 2y ago
On the question of “why do they collect all this data” - brightness, battery life, headphone usage, volume etc: It’s not just because the data is valuable in itself, it’s also to ‘fingerprint’ the device across IPFA boundaries and in the face of things like NAT and VPNs. There are so many disparate data points that are different across different devices that two apps reporting an identical or near-identical set in a short timeframe are likely on the same device.
Teever 2y ago
Are you aware of any sousveillance projects with the goal of identifying and monitoring the people responsible for this tracking?
alphan0n 2y ago
Good stuff. You might find more interesting data by implementing Frida [0] into your process to snoop on encrypted traffic normally not visible due to pinned certificates. [0] https://frida.re/docs/home/ https://frida.re/docs/home/
- sunbum 2y ago
  And more specifically just use the maintained scripts from HTTP Toolkit. https://github.com/httptoolkit/frida-interception-and-unpinning https://github.com/httptoolkit/frida-interception-and-unpinn...
  - alphan0n 2y ago
    Excellent, thank you. There’s a lot to Frida. HTTP Toolkit only mentions using jailbroken iOS devices, but you can also use unjailbroken devices running v13+ via injection [0] [0] https://frida.re/docs/ios/ https://frida.re/docs/ios/
2y ago