  Localization services for wireless devices play an increasingly important
role in our daily lives and a plethora of emerging services and applications
already rely on precise position information. Widely used on-device positioning
methods, such as the global positioning system, enable accurate outdoor
positioning and provide the users with full control over what services and
applications are allowed to access their location information. In order to
provide accurate positioning indoors or in cluttered urban scenarios without
line-of-sight satellite connectivity, powerful off-device positioning systems,
which process channel state information (CSI) measured at the infrastructure
base stations or access points with deep neural networks, have emerged
recently. Such off-device wireless positioning systems inherently link a user's
data transmission with its localization, since accurate CSI measurements are
necessary for reliable wireless communication -- this not only prevents the
users from controlling who can access this information but also enables
virtually everyone in the device's range to estimate its location, resulting in
serious privacy and security concerns. We therefore propose on-device attacks
against off-device wireless positioning systems in multi-antenna orthogonal
frequency-division multiplexing systems while remaining standard compliant and
minimizing the impact on quality-of-service, and we demonstrate their efficacy
using real-world measured datasets for cellular outdoor and wireless LAN indoor
scenarios. We also investigate defenses to counter such attack mechanisms, and
we discuss the limitations and implications on protecting location privacy in
existing and future wireless communication systems.
