apple-corelocation-experiments

Possibly what we saw in the Russia Ukraine war with AP locations reported by Apple? https://www.cs.umd.edu/~dml/papers/wifi-surveillance-sp24.pd... And implementation https://github.com/acheong08/apple-corelocation-experiments

> you can inspect the code it's running That's only true for microG itself, not the Google blobs it needs to download and execute in order to function. GmsCompat on GrapheneOS is also fully open source.[1] > For example you can replace the location service with a privacy respecting one. GrapheneOS literally does that.[2] It's currently not perfect in regard to privacy because they are using Apple's Wi-Fi positioning service, but proxying it through their own servers, so Apple never gets the user's IP address or any unique identifiers, and link the location information to any other data. One thing Apple currently does better than most network location providers is the fact that they don't just return position data for one BSSID, they actually give you the data for hundreds of nearby BSSIDs as well[3], which is more private, and means that

> Google reportedly used their Android users to sniff APs Pretty sure that's how it works across all phones. I know that's how Apple gets their location services database at least. https://github.com/acheong08/apple-corelocation-experiments

I built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically goes App -> Packet tunnel -> SOCKS -> a child process (I used https://github.com/AdguardTeam/gomitmproxy) to handle the sniffing and reencryption. Did post the source somewhere at some point but my git server got corrupted and I haven't gone and fixed it. https://github.com/acheong08/apple-corelocation-experiments/... I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days. Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone with

https://github.com/acheong08/apple-corelocation-experiments I worked on this a while back in parallel. You can dump Apple's entire database in ~2 weeks. Around 3 billion records including China. You can compress it down to only a few gigs and have everything offline. I also got a ichnaea proxy though not as well tested. Been using it myself and it's alright,

Apple also maintains a similar database (though with only BSSID and not SSID). You can find all the BSSIDs in one area via the tile API or straight up dump the whole thing. https://github.com/acheong08/apple-corelocation-experiments https://codeberg.org/joelkoen/wtfps/ With this you can build your own MLS using stolen data.

Apple probably has one of the largest databases. Their API is unauthenticated and not rate limited either. Can be used for both APs and cell towers: https://github.com/acheong08/apple-corelocation-experiments

I've been working on this over the past week after reading about it in https://news.ycombinator.com/item?id=40492234. I found an interesting API that returns the largest network in a given tile but have failed to find the algorithm used to encode the `X-tilekey` field used for positioning. I got close with morton encoding and linear regression which works for most of the UK but deviates as you go North/South. I'm posting this both to show what I've done and ask for help. If anyone knows how tile keys might work, please let me know (either here or in an issue). A small data sample: https://github.com/acheong08/apple-corelocation-experiments/... Thank you. Edit: I was initially planning on showing this way later but I can’t figure out around this problem. Thought HN would be the best place to ask since I’m probably the dumbest user here

I’ve been experimenting with this over the past few days: https://github.com/acheong08/apple-corelocation-experiments Found some interesting things and still working on recording more MITM from my iPhone to see what else is sent.