While browsing the internet on my laptop, I've allowed an internet site to access my location data. What I had expected was that it will show the name of my city based on my IP. I was quite shocked when I've seen the precise address of my location, with the street name and house number! You can try it yourself at: https://browserleaks.com/geo
What I've read is that all browsers nowadays are using GEOLOCATION API. The data source of geo position might be:
Common sources of location information include Global Positioning System (GPS) and location inferred from network signals such as IP address, RFID, WiFi and Bluetooth MAC addresses, and GSM/CDMA cell IDs, as well as user input.
As my laptop has no GPS and nothing to do with mobile phones - it's pretty obvious that my precise location was achieved by mapping WiFis. How exactly was it done?
Based on this article, which is 10 years old:
- Basically my browser asked my system* for a list of Wifi access points.
- Then my browser parsed it into JSON string
- Then my browser sent it to any Location-Based Services like Google Maps , which has mapped infrastructure of all WiFi access points.
- Then the Location-Based Service calculated my position (I guess some kind of triangulation technique based on location of known access points) and returned my very precise latitude and longitude (and additionally actual address associated with those data, if requested)
- as I am on Windows it was probably by WinApi call, using Native Wifi API
So the questions are:
- If my Windows System grants my browser permission to WiFi Access Points list, without any questions - does it mean that ANY random program with internet access on my system could possibly get my very precise real location based on the WiFi mapping?
- And would it be ignored by any AV and almost undetectable (only trace I can imagine could be firewall log of a connection to Geolocation Services Provider)?
- Is there any way on Windows to block programs from accessing that WiFi data?
It blows my mind from the standpoint of privacy how easy it seems to be for a malicious developer to track my real home/work location without my knowledge and permission.