  Wi-Fi-based Positioning Systems (WPSes) are used by modern mobile devices to
learn their position using nearby Wi-Fi access points as landmarks. In this
work, we show that Apple's WPS can be abused to create a privacy threat on a
global scale. We present an attack that allows an unprivileged attacker to
amass a worldwide snapshot of Wi-Fi BSSID geolocations in only a matter of
days. Our attack makes few assumptions, merely exploiting the fact that there
are relatively few dense regions of allocated MAC address space. Applying this
technique over the course of a year, we learned the precise locations of over 2
billion BSSIDs around the world.
  The privacy implications of such massive datasets become more stark when
taken longitudinally, allowing the attacker to track devices' movements. While
most Wi-Fi access points do not move for long periods of time, many devices --
like compact travel routers -- are specifically designed to be mobile. We
present several case studies that demonstrate the types of attacks on privacy
that Apple's WPS enables: We track devices moving in and out of war zones
(specifically Ukraine and Gaza), the effects of natural disasters (specifically
the fires in Maui), and the possibility of targeted individual tracking by
proxy -- all by remotely geolocating wireless access points. We provide
recommendations to WPS operators and Wi-Fi access point manufacturers to
enhance the privacy of hundreds of millions of users worldwide. Finally, we
detail our efforts at responsibly disclosing this privacy vulnerability, and
outline some mitigations that Apple and Wi-Fi access point manufacturers have
implemented both independently and as a result of our work.
