Re: Apple changed their documentation at my request but it proves they don't care about privacy

Jon Ribbens wrote:
>> I will not only tell you exactly where that router is located (I even wrote
>> the Python code to give me a dot on an OSM map for your location) but I can
>> trivially easily forever track that router's location forever, without any
>> restrictions on my part (which is the point of the paper, after all).
> 
> Yes, I know that too now, after reading the paper. I downloaded the
> code at https://github.com/darkosancanin/apple_bssid_locator (which
> was originally uploaded in 2015) and ran it locally with my own AP
> MAC address and confirmed it showed my home location very accurately.

Hi Jon Ribbens,

You are intelligent, and I've been a bit brutal to those who have been
idiotically trolling this newsgroup without even reading the subject line,
so I want to first thank you for actually reading the paper & testing it.

 *Surveilling the Masses with Wi-Fi-Based Positioning Systems*
 <https://arxiv.org/abs/2405.14975>

You are at the stage where you ran the apple_bssid_locator.py script
and you found that your own BSSID/GPS pair was clearly in the results.

I had run the same code as you just did, where I was horrified a dozen
of mine were in the results since _all_ of them had _nomap on the SSID!

Luckily, I live near to plenty of Silicon Valley executives, where 
my next-door neighbor happens to an executive in the Apple Maps group.

When I brought the topic up to him, he at first considered it a likely 
bug, and then his engineers tried to snow me by saying the issue 
wasn't reproducible, but I kept hammering him on an honest answer.

In the end, he said I could only talk to the lawyers, who, in the end, 
said they'd "fix" the documentation, which, let's be clear, is the topic.

Apple did fix the documentation.
Apple has no intention of honoring what EVERY other company already honors!

Subsequently, I had discussions with Daniel Veditz and Brian Krebs, and 
they agreed with the tests, so at this point, there isn't much we can do.

At this point, you seem to be the only one who displays any indication 
that they understood the topic of this paper & what it means for privacy
(given you ran the python code and it clearly told you where you lived).

I appreciate that you followed up by running the apple_bssid_locator.py
script, where I went another step further to modify that script so that
it not only reports a single output, but the next nearest 400 BSSIDs.

With the code below and the code I posted in response to Keith Roberts
who claimed, apparently, that you hadn't run the code you did run, 
you can literally track any router BSSID location anywhere in the world.

Forever... 

Here is the improved apple_bssid_locator.py for you to test, where I 
simply ask of you to run it, and for you to explain to the newsgroups
what it does, as people seem to be saying I can't explain things well.

Maybe you can do better than I at explaining what this code does?

  #!/usr/bin/env -S uv run --script
  # -*- coding: utf-8 -*-
  
  # C:\app\os\python\apple_bssid_locator\apple_bssid_locator.py
  # Queries Apple WPS database for GPS:BSSID location pairs
  # Implementation based on https://github.com/hubert3/iSniff-GPS 
  #
  # Usage: apple_bssid_locator.py 11:22:33:AA:BB:CC 
  # Usage: apple_bssid_locator.py 11:22:33:AA:BB:CC --all
  # Usage: apple_bssid_locator.py 11:22:33:AA:BB:CC --map
  #
  # Changelog:
  # v1p0 20251205 - Initial version from apple_bssid_locator.py
  # v1p1 20251214 - Added logging to results.txt
  # v1p2 20251215 - Timestamped results.txt to avoid overwrites
  # v1p3 20251219 - Limited output to 6 decimal places
  # v1p4 20251219 - Added raw integer output alongside converted decimals
  # v1p5 20251222 - Fixed raw to decimal conversion (divide by 100 Million)
  
  import argparse
  import requests
  import webbrowser
  import AppleWLoc_pb2
  
  def parse_arguments():
      parser = argparse.ArgumentParser()
      parser.add_argument("bssid", type=str, help="display the location of the bssid")
      parser.add_argument("-m", "--map", help="shows the location on google maps", action='store_true')
      parser.add_argument("-a", "--all", help="shows all results returned, not just the requested one", action='store_true')
      args = parser.parse_args()
      return args
  
  def format_bssid(bssid):
      return ':'.join(e.rjust(2, '0') for e in bssid.split(':'))
  
  def query_bssid(bssid, output_file="results.txt"):
      apple_wloc = AppleWLoc_pb2.AppleWLoc()
      wifi_device = apple_wloc.wifi_devices.add()
      wifi_device.bssid = bssid
      apple_wloc.unknown_value1 = 0
      apple_wloc.return_single_result = 0   # request ALL results
      serialized_apple_wloc = apple_wloc.SerializeToString()
      length_serialized_apple_wloc = len(serialized_apple_wloc)
  
      headers = {'User-Agent':'locationd/1753.17 CFNetwork/889.9 Darwin/17.2.0'}
      data = b"\x00\x01\x00\x05"+b"en_US"+b"\x00\x13"+b"com.apple.locationd"+b"\x00\x0a"+b"8.1.12B411"+b"\x00\x00\x00\x01\x00\x00\x00" + bytes((length_serialized_apple_wloc,)) + serialized_apple_wloc
      r = requests.post('https://gs-loc.apple.com/clls/wloc', headers=headers, data=data)
  
      apple_wloc = AppleWLoc_pb2.AppleWLoc()
      apple_wloc.ParseFromString(r.content[10:])
  
      # Build dictionary of results
      results = {}
      with open(output_file, "w") as f:
          for wifi_device in apple_wloc.wifi_devices:
              if wifi_device.HasField('location'):
                  raw_lat = wifi_device.location.latitude
                  raw_lon = wifi_device.location.longitude
                  lat = raw_lat * 1e-8
                  lon = raw_lon * 1e-8
                  mac = format_bssid(wifi_device.bssid)
                  results[mac] = (lat, lon, raw_lat, raw_lon)
                  # Write both raw integers and converted decimals (8 decimal places)
                  f.write(f"{mac}\t{raw_lat}\t{raw_lon}\t{lat:.8f}\t{lon:.8f}\n")
  
      print(f"Saved {len(results)} entries to {output_file}")
      return results
  
  def main():
      args = parse_arguments()
      print("Searching for location of bssid: %s" % args.bssid)
      results = query_bssid(args.bssid)
  
      # Determine which BSSIDs to process
      bssids_to_process = results.keys() if args.all else [args.bssid.lower()]
  
      found = False
      for bssid in bssids_to_process:
          if bssid in results:
              lat, lon, raw_lat, raw_lon = results[bssid]
              if lat == -180.0 and lon == -180.0:
                  continue  # Skip entries that were not found
              if found:
                  print()
              print(f"BSSID: {bssid}")
              print(f"Raw latitude integer: {raw_lat}")
              print(f"Raw longitude integer: {raw_lon}")
              print(f"Latitude (degrees): {lat:.8f}")
              print(f"Longitude (degrees): {lon:.8f}")
              if args.map:
                  url = f"http://www.google.com/maps/place/{lat:.8f},{lon:.8f}"
                  webbrowser.open(url)
              found = True
      if not found:
          print("The bssid was not found.")
  
  if __name__ == '__main__':
      main()
  
  # end of C:\app\os\python\apple_bssid_locator\apple_bssid_locator.py