3

I played with Eslint and eslint-scanjs security plugin and came across the check 'property_geolocation'. The source code of the check is:

"use strict";

module.exports = function (context) {

  return {
    "MemberExpression": function (node) {
      if (node.property.name == 'geolocation') {
        context.report(node, "geolocation can be unsafe");

      }
    }
  }
}  

so it gives no clue about why it's dangerous to use the property. Can anyone explain what risks of using the 'geolocation' property and how it can be abused?

1
  • 1
    Research the commit logs of this rule and maybe ask on their issue tracker?
    – billc.cn
    Dec 12, 2016 at 14:24

1 Answer 1

1

According to the Mozilla documentation and caniuse.com, some browsers will allow geolocation to be served over HTTP, in which case the usual risks of a MITM apply.

This is a guess on my part, but if an attacker can uncover your physical location, they could exploit it in any of the following ways:

  • Find your home/work addresses, and use that for any of the following:
    • knowing when it's safer to break in or when's the best time to swat you.
    • framing you for possessing illicit material (as (nearly) happened to Brian Krebs).
    • covering their tracks.
  • Use it to create more targeted phishing attempts (we know that Pilib Uí Rólaun regularly goes to Bank A on the main street of Ballycac - so, he's more likely to fall for a request to log into this than for Bank B).
  • Sell it to a third party that might find it useful (for any of the above reasons).
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .