Re: Apple changed their documentation at my request but it proves they don't care about privacy

With the code supplied above, anyone can easily track the movements of 
every access point BSSID in the world (that is in Apple's WPS database).
 *Surveilling the Masses with Wi-Fi-Based Positioning Systems*
 <https://arxiv.org/abs/2405.14975>

Note the word "mass" indicates we can not only track a single BSSID's 
location, but we can track every single BSSID in the world's location.

It's trivial to do, but only with Apple's WPS database.
It cannot be done with any other WPS database that I am aware of.

To his credit, Jon Ribbens proved the veracity of these statements by 
tracking his own BSSID location using the Python code in that article.

 ====================================================================
 From: Jon Ribbens <[email protected]>
 Newsgroups: comp.lang.python,misc.phone.mobile.iphone,comp.mobile.android,alt.internet.wireless,alt.comp.os.windows-10
 Subject: Re: Apple changed their documentation at my request but it proves they don't care about privacy
 Date: Sun, 6 Sep 2026 00:06:34 -0000 (UTC)
 Message-ID: <[email protected]>

 > HINT: I can track the future location of every one of those billions of
 > government ID/GPS location pairs, without any restrictions on my scripts!
 >
 > Want to prove that?
 > What's your home router BSSID?
 >
 > I will not only tell you exactly where that router is located (I even wrote
 > the Python code to give me a dot on an OSM map for your location) but I can
 > trivially easily forever track that router's location forever, without any
 > restrictions on my part (which is the point of the paper, after all).

 Yes, I know that too now, after reading the paper. I downloaded the
 code at https://github.com/darkosancanin/apple_bssid_locator (which
 was originally uploaded in 2015) and ran it locally with my own AP
 MAC address and confirmed it showed my home location very accurately.

 It does concern me that there is an attack model here which is that
 a mildly technically-inclined stalker can very easily get the BSSID
 of their victim and, as you say, find out where they've gone if they
 move house to get away from them.
 ====================================================================

For others to benefit from, in my records is this initial version of
apple_bssid_locator.py where when I ran it, I was horrified to find
that every one of my dozens of hidden access point BSSIDs were there!

I suggest each user on this thread who wishes to better understand the
nature of the problem set (as described by the paper), run this code.

  #!/usr/bin/env -S uv run --script
  # -*- coding: utf-8 -*-
  
  # C:\app\os\python\apple_bssid_locator\apple_bssid_locator.py
  # Queries Apple WPS database for GPS:BSSID location pairs
  # Implementation based on https://github.com/hubert3/iSniff-GPS 
  #
  # Usage: apple_bssid_locator.py 11:22:33:AA:BB:CC 
  # Usage: apple_bssid_locator.py 11:22:33:AA:BB:CC --all
  # Usage: apple_bssid_locator.py 11:22:33:AA:BB:CC --map
  #
  # Changelog:
  # v1p0 20251205 - Initial version from apple_bssid_locator.py
  # v1p1 20251214 - Added logging to results.txt
  # v1p2 20251215 - Timestamped results.txt to avoid overwrites
  # v1p3 20251219 - Limited output to 6 decimal places
  # v1p4 20251219 - Added raw integer output alongside converted decimals
  # v1p5 20251222 - Fixed raw to decimal conversion (divide by 100 Million)
  
  import argparse
  import requests
  import webbrowser
  import AppleWLoc_pb2
  
  def parse_arguments():
      parser = argparse.ArgumentParser()
      parser.add_argument("bssid", type=str, help="display the location of 
the bssid")
      parser.add_argument("-m", "--map", help="shows the location on google 
maps", action='store_true')
      parser.add_argument("-a", "--all", help="shows all results returned, 
not just the requested one", action='store_true')
      args = parser.parse_args()
      return args
  
  def format_bssid(bssid):
      return ':'.join(e.rjust(2, '0') for e in bssid.split(':'))
  
  def query_bssid(bssid, output_file="results.txt"):
      apple_wloc = AppleWLoc_pb2.AppleWLoc()
      wifi_device = apple_wloc.wifi_devices.add()
      wifi_device.bssid = bssid
      apple_wloc.unknown_value1 = 0
      apple_wloc.return_single_result = 0   # request ALL results
      serialized_apple_wloc = apple_wloc.SerializeToString()
      length_serialized_apple_wloc = len(serialized_apple_wloc)
  
      headers = {'User-Agent':'locationd/1753.17 CFNetwork/889.9 
Darwin/17.2.0'}
      data = 
b"\x00\x01\x00\x05"+b"en_US"+b"\x00\x13"+b"com.apple.locationd"+b"\x00\x0a"+b"8.1.12B411"+b"\x00\x00\x00\x01\x00\x00\x00" 
+ bytes((length_serialized_apple_wloc,)) + serialized_apple_wloc
      r = requests.post('https://gs-loc.apple.com/clls/wloc', 
headers=headers, data=data)
  
      apple_wloc = AppleWLoc_pb2.AppleWLoc()
      apple_wloc.ParseFromString(r.content[10:])
  
      # Build dictionary of results
      results = {}
      with open(output_file, "w") as f:
          for wifi_device in apple_wloc.wifi_devices:
              if wifi_device.HasField('location'):
                  raw_lat = wifi_device.location.latitude
                  raw_lon = wifi_device.location.longitude
                  lat = raw_lat * 1e-8
                  lon = raw_lon * 1e-8
                  mac = format_bssid(wifi_device.bssid)
                  results[mac] = (lat, lon, raw_lat, raw_lon)
                  # Write both raw integers and converted decimals (8 
decimal places)
                  
f.write(f"{mac}\t{raw_lat}\t{raw_lon}\t{lat:.8f}\t{lon:.8f}\n")
  
      print(f"Saved {len(results)} entries to {output_file}")
      return results
  
  def main():
      args = parse_arguments()
      print("Searching for location of bssid: %s" % args.bssid)
      results = query_bssid(args.bssid)
  
      # Determine which BSSIDs to process
      bssids_to_process = results.keys() if args.all else 
[args.bssid.lower()]
  
      found = False
      for bssid in bssids_to_process:
          if bssid in results:
              lat, lon, raw_lat, raw_lon = results[bssid]
              if lat == -180.0 and lon == -180.0:
                  continue  # Skip entries that were not found
              if found:
                  print()
              print(f"BSSID: {bssid}")
              print(f"Raw latitude integer: {raw_lat}")
              print(f"Raw longitude integer: {raw_lon}")
              print(f"Latitude (degrees): {lat:.8f}")
              print(f"Longitude (degrees): {lon:.8f}")
              if args.map:
                  url = 
f"http://www.google.com/maps/place/{lat:.8f},{lon:.8f}"
                  webbrowser.open(url)
              found = True
      if not found:
          print("The bssid was not found.")
  
  if __name__ == '__main__':
      main()
  
  # end of C:\app\os\python\apple_bssid_locator\apple_bssid_locator.py
-- 
apple_bssid_locator.py