title: Where Are We? Security, Misuse, and Manipulation of Location-based Systems
Creators: name: Heinrich, Alexander
Publisher: name: UNSPECIFIED
Year: 2025

description: Location-based systems allow us to perform many tasks: we can check the weather wherever we are, navigate unfamiliar environments, and track our running workouts as well as valuables such as laptops or luggage. However, all of these examples require access to highly sensitive and private location data. Misuse of this data allows adversaries to identify individuals based on a few locations, track them digitally without consent, or manipulate location data to bypass location-based access policies, such as those implemented in cars or smart door locks. 
In this thesis, we contribute to three emerging areas of location-based systems: (1) Security and misuse of Bluetooth offline-finding networks; (2) Security, reliability, and accuracy of localization with UWB; and (3) Secure location sharing via satellite. Our methodology is diverse. We reverse-engineer implementations to investigate their privacy and security protections, open up proprietary systems and provide open-source implementations. Furthermore, we develop tools to protect users from unwanted location tracking, research novel attack vectors and protections, and conduct user studies to understand the needs of victims of unwanted tracking. 
To summarize our main research results: (1) We analyze Apple’s Find My network, uncover vulnerabilities that expose individuals’ location data, and demonstrate that the network can be misused for tracking and stalking. Based on our results, we open up the proprietary network and publish a framework that allows any programmable Bluetooth device to be integrated into the Find My network, making it locatable. To protect users from unwanted tracking attacks, we develop and publish the AirGuard app, which identifies malicious trackers following a person and alerts them. We conduct a survey with over 5,000 participants and find that 44% of stalking victims have suffered from unwanted location tracking. With the study results and AirGuard user data, we identify patterns and methods used by stalkers, and where trackers are hidden. (2) We measure the accuracy and reliability of Ultra-Wide Band (UWB) distance measurements in consumer smartphones and find that, while results are accurate in most cases, all devices measured a small number of large outliers. Furthermore, we analyze the security of UWB against distance manipulation attacks and develop a novel physical-layer attack that can reduce the measured distance by several meters. (3) Encryption and privacy protection mechanisms are often neglected in satellite communication. We evaluate the iPhone’s location-sharing via satellite feature and find robust security mechanisms with multi-layer encryption in place. Nevertheless, we identify bypasses around Apple’s restrictions and manage to use satellite services from restricted areas and send text messages encoded in location updates. We propose countermeasures for all vulnerabilities we find. 
In addition to academic publications, our work has demonstrated real-world impact with the AirGuard apps for Android and iOS. They have been installed over 1.3million times in the last three and a half years. Several victims of unwanted tracking informed us that they had found trackers using our application, preventing further tracking. By pushing for better detection mechanisms, we influenced major companies: Apple and Google have proposed standardized tracking detection for all Bluetooth trackers.