Security News > 2024 > May > Privacy Implications of Tracking Wireless Access Points
Abstract: Wi-Fi-based Positioning Systems are used by modern mobile devices to learn their position using nearby Wi-Fi access points as landmarks.
The privacy implications of such massive datasets become more stark when taken longitudinally, allowing the attacker to track devices' movements.
While most Wi-Fi access points do not move for long periods of time, many devices-like compact travel routers-are specifically designed to be mobile.
We present several case studies that demonstrate the types of attacks on privacy that Apple's WPS enables: We track devices moving in and out of war zones, the effects of natural disasters, and the possibility of targeted individual tracking by proxy-all by remotely geolocating wireless access points.
We provide recommendations to WPS operators and Wi-Fi access point manufacturers to enhance the privacy of hundreds of millions of users worldwide.
Finally, we detail our efforts at responsibly disclosing this privacy vulnerability, and outline some mitigations that Apple and Wi-Fi access point manufacturers have implemented both independently and as a result of our work.