Hacker News Reader

Comment by runjake | Hacker News Reader

I didn't know this was news. I and other security researchers & law enforcement have known about it for a while. I assisted in one court case where the data was used as evidence.

I suspect the slick-looking iPhoneTracker app finally made it interesting to the media.

Edit: There was a similar deal on iOS 3 but it seemed more like a bug, not a feature. Data would be purged at some unpredictable interval. I can't recall the file path and don't have an iOS 3 device handy.

View on HN

In deed nothing new. About a year ago a man discovered that his wife's iPhone was sending about 75 Mb of data to Apple via wifi in early morning : https://discussions.apple.com/thread/2450738?threadID=245073... It turned out it was dumps of GPS data and other stuffs.

Apple acknowledged that to the House of Representatives. They're gathering data about their customers, including GPS : [PDF] http://markey.house.gov/docs/applemarkeybarton7-12-10.pdf

II / C / 1 / a. : "Second, to help Apple update and maintain its database with known location information, Apple may also collect and transmit Cell Tower and Wi-Fi Access Point Information automatically. With one exception, Apple automatically collects this information only if the device’s location-based service capabilities are toggled to “On” and the customer uses an application requiring location-based infomiation. If both conditions are met, the device intermittently and anonymously collects Cell Tower and Wi-Fi Access Point Information from the cell towers and Wi-Fi access points that it can “see”, along with the device’s GPS coordinates, if available. This information is batched and then encrypted and transmitted to Apple over a Wi-Fi Internet connection every twelve hours (or later if the device does not have Wi-Fi Intemet access at that time)."

Good info, thanks.

It's important to note that the above use of "anonymous" is laughable in context.

In order for that uploaded data to be useful by Apple, it needs to maintain both the lat/long and wi-fi access point ethernet addresses & signal strengths. This is pretty much a globally-unique identifier.

Identifier of what, though? The two data points you just described identify the wireless network, not the iPhone. In fact, what you just described is precisely the data required for obtaining a device location from the nearby wireless networks, a la Skyhook.

I noticed Google asks to do this in Android, too. They make you explicitly OK it though, at least on my (Verizon Droid) phone.

In location options, if you check certain options it warns you that Google will be logging wifi info and other details even while apps that access this info are not running.

The warning shown when you click "Use wireless networks" in Location settings is

"Location consent Allow Google's location service to collect anonymous location data. Collection will occur even when no applications are running."

My analysis is that this turns the phone into a mobile sensor that performs the same function as one of the Google mobiles driving around with cameras performs relating to wifi and location logging. Google probably collects the GPS coordinates and SSID of every wifi network that comes into range of a phone with this enabled. Given their recent legal troubles relating to wifi discovery, hopefully it doesn't gather more than that.

Yes it does scan surrounding wifi SSID because Google Maps uses Skyhook ( http://www.skyhookwireless.com/ , belongs to Google) to geolocate users faster than just using pure GPS signal. So does Apple which also use Google Maps geolocation services on their iPhones.

My guess is that Apple is gathering all those data in order to build their own Skyhook. It makes sense, specially when you keep in mind that Apple bough the mapping company Poly9.

Google don't use Skyhook. They use their own database.

Skyhook is suing them due to this.

"and the customer uses an application requiring location-based infomiation"

Curious. It certainly seems to be logging way more than just when the location services icon is showing.

What's news to me is that this is persisted forever on the device in an unencrypted format.

Makes me curious about what else "isn't news" that I don't know about this "discovery". That's a lot of awkwardly disclosed (if at all), personal (why do they even care), unencrypted data points (I'd be in trouble for not encrypting) for the one of the world's most valuable companies to persist into eternity. Would it be news if this was MSFT?

Maybe the news just hasn't happened yet?

Side question, could you explain your ethics in helping the cops bust someone by using a tracking device they did not know they were carrying? Personally I find it repugnant and would not participate, the right to privacy is more important than a single crime.

Hopefully I have a better solicitor than the poor chap who had iOS location data submitted into evidence ;)

Given the response on HTCIA, HTCC, and the CCE lists, this was news to many people in the LE community. I think your edit touches on the difference - this is a new source for the information, and it is very easy to collect from the sync host.

Reply on news.ycombinator.com