Sunday, 27 July 2014
Do
you own an Android device? Is it less than three years old? If so, then
when your phone's screen is off and it's not connected to a Wi-Fi
network, there's a high risk that it is broadcasting your location
history to anyone within Wi-Fi range that wants to listen.
This location history comes in the form of the names of wireless
networks your phone has previously connected to. These frequently
identify places you've been, including homes ("Tom's Wi-Fi"), workplaces
("Company XYZ office net"), churches and political offices ("County
Party HQ"), small businesses ("Toulouse Lautrec's house of ill-repute"),
and travel destinations ("Tehran Airport wifi"). This data is arguably
more dangerous than that leaked in previous location data scandals
because it clearly denotes in human language places that you've spent
enough time to use the Wi-Fi. Normally eavesdroppers would need to spend
some effort extracting this sort of information from the
latititude/longitude history typically discussed in location privacy
analysis. But even when networks seem less identifiable, there are ways
to look them up.
In Android we traced this behavior to a feature introduced in Honeycomb (Android 3.1) called Preferred Network Offload (PNO). PNO is supposed to allow phones and tablets to establish and maintain Wi-Fi connections even when they're in low-power mode (i.e. when the screen is turned off). The goal is to extend battery life and reduce mobile data usage, since Wi-Fi uses less power than cellular data.
Response from Google
When we brought this issue to Google's attention, they responded that:
"We take the security of our users' location data very seriously and we're always happy to be made aware of potential issues ahead of time. Since changes to this behavior would potentially affect user connectivity to hidden access points, we are still investigating what changes are appropriate for a future release."
Additionally, yesterday a Google employee submitted a patch to
wpa_supplicant which fixes this issue. While we are glad this problem is
being addressed so quickly, it will still be some time before that fix
gets integrated into the downstream Android code. And even then, Android
fragmentation and the broken update process for non-Google Android devices could delay or even prevent many users from receiving the fix. (We hope Google can make progress on this problem, too.)
