Location spoofing possible with WiFi devices

In January, Skyhook Wireless Inc. announced that Apple would use Skyhook’s WiFi Positioning System (WPS) for its popular Map applications. The WPS database contains information on access points throughout the world. Skyhook itself provides most of the data in the database, with users contributing via direct entries to the database, and requests for localization. ETH Zurich Professor Srdjan Capkun of the Department of Computer Science and his team of researchers analysed the security of Skyhook’s positioning system. The team’s results demonstrate the vulnerability of Skyhook’s and similar public WLAN positioning systems to location spoofing attacks.

Impersonation and elimination

When an Apple iPod or iPhone wants to find its position, it detects its neighbouring access points, and sends this information to Skyhook servers. The servers then return the access point locations to the device. Based on this data, the device computes its location. To attack this localization process, Professor Capkun’s team decided to use a dual approach. First, access points from a known remote location were impersonated. Second, signals sent by access points in the vicinity were eliminated by jamming. These actions created the illusion in localized devices that their locations were different from their actual physical locations.

Simple falsification

Skyhook’s WPS works by requiring a device to report the Media Access Control (MAC) addresses that it detects. However, since MAC addresses can be forged by rogue access points, they can be easily impersonated. Furthermore, access point signals can be jammed and signals from access points in the vicinity of the device can thus be eliminated. These two actions make location spoofing attacks possible.

Compromised usage

Professor Capkun explained that by demonstrating these attacks, the team hoped to point out the limitations, despite guarantees, of public WLAN-based localization services as well as of applications for such services. He said «Given the relative simplicity of the performed attacks, it is clear that the use of WLAN-based public localization systems, such as Skyhook’s WPS, should be restricted in security and safety-critical applications.»

Media Contact

Srdjan Capkun EurekAlert!

Alle Nachrichten aus der Kategorie: Information Technology

Here you can find a summary of innovations in the fields of information and data processing and up-to-date developments on IT equipment and hardware.

This area covers topics such as IT services, IT architectures, IT management and telecommunications.

Zurück zur Startseite

Kommentare (0)

Schreib Kommentar

Neueste Beiträge

Who stole the light?

Self-induced ultrafast demagnetization limits the amount of light diffracted from magnetic samples at soft x-ray energies. Free electron X-ray lasers deliver intense ultrashort pulses of x-rays, which can be used…

Could breadfruit be the next superfood?

UBC researchers say yes Breadfruit is sustainable, environmentally friendly and a high-production crop. A fruit used for centuries in countries around the world is getting the nutritional thumbs-up from a…

New calculation refines comparison of matter with antimatter

Theorists publish improved prediction for the tiny difference in kaon decays observed by experiments. -An international collaboration of theoretical physicists–including scientists from the U.S. Department of Energy’s (DOE) Brookhaven National…

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close