# Surveilling the Masses with Wi-Fi-Based Positioning Systems

**Authors:** Erik Rye, Dave Levin  
**arXiv:** [2405.14975](https://arxiv.org/abs/2405.14975)  
**Date:** 2024-05-23  
**Summary page:** https://www.summarizepaper.com/en/paper/2405.14975v1/

## Key points

- Wi-Fi-based Positioning Systems (WPSes) are commonly used by modern mobile devices for location determination using nearby Wi-Fi access points.
- Apple's WPS was found to have a significant privacy threat due to exploitation by unprivileged attackers, leading to global geolocation data compilation.
- Researchers were able to pinpoint over 2 billion BSSIDs globally in a year, enabling longitudinal tracking capabilities.
- Case studies demonstrated how Apple's WPS could facilitate privacy breaches like tracking devices in conflict zones and during natural disasters.
- Recommendations were provided to enhance user privacy protections for WPS operators and Wi-Fi access point manufacturers on a large scale.
- A longitudinal study querying 10 million geolocated BSSIDs daily through Apple's WPS showed that approximately 8% of sampled BSSIDs became unlocatable within a month.
- Common equipment manufacturers identified in the dataset included TP-Link, Huawei, Vantiva, and Sagemcom among others.
- The research highlights the risks associated with Wi-Fi-based positioning systems and emphasizes the need for robust privacy measures to protect user data from exploitation.

## Summary

Wi-Fi-based Positioning Systems (WPSes) are commonly used by modern mobile devices to determine their location using nearby Wi-Fi access points as reference points. However, a study has revealed that Apple's WPS can be exploited to pose a significant privacy threat on a global scale. By conducting an attack, unprivileged attackers were able to compile a comprehensive snapshot of Wi-Fi BSSID geolocations worldwide in just a matter of days. This was achieved by taking advantage of the limited dense regions of allocated MAC address space. Over the course of a year, researchers were able to pinpoint the precise locations of over 2 billion BSSIDs globally. The implications of such vast datasets become more concerning when considering longitudinal tracking capabilities, allowing for the monitoring of device movements over time. While most Wi-Fi access points remain stationary for extended periods, certain devices like compact travel routers are designed for mobility. Several case studies showcased how Apple's WPS could enable privacy breaches, such as tracking devices entering and exiting conflict zones like Ukraine and Gaza, monitoring movements during natural disasters like the fires in Maui, and potentially enabling targeted individual tracking through proxy methods. Recommendations were provided to WPS operators and Wi-Fi access point manufacturers to enhance user privacy protections on a massive scale. To further understand the movement patterns of wireless access points, a month-long longitudinal study was conducted by querying 10 million geolocated BSSIDs daily through Apple's WPS. The study revealed that approximately 8% of sampled BSSIDs became unlocatable within the month, likely due to devices being turned off or moved out of range. Analysis also identified common equipment manufacturers in the dataset, with TP-Link, Huawei, Vantiva, and Sagemcom being among the most prevalent vendors observed. Overall, this research sheds light on the potential risks associated with utilizing Wi-Fi-based positioning systems and underscores the importance of implementing robust privacy measures to safeguard user data from exploitation. Efforts have been made towards responsibly disclosing these vulnerabilities and implementing mitigations by Apple and Wi-Fi access point manufacturers in response to these findings.