iPhone Wi-Fi positioning 'open to spoofing'

Experts have raised doubts about the Skyhook positioning system used in Apple's iPhone

The Wi-Fi positioning system used in Apple's iPhone is vulnerable to " relatively simple" location spoofing attacks, computer experts warned today.

The flaw is alleged to centre on the use of Skyhook's Wi-Fi positioning system, which contains information on access points throughout the world, for Apple's popular Map applications.

Skyhook provides most of the information in the database, but users contribute via direct entries to the database and requests for localisation.

However, a team led by Professor Srdjan Capkun, of the Department of Computer Science at ETH Zurich, questioned the security of Skyhook's positioning system.

The team claimed that its results demonstrate the vulnerability of Skyhook's and similar public wireless local area network positioning systems to location spoofing attacks.

The scientists explained that, when an Apple iPod or iPhone wants to find its position, it detects its neighbouring access points and sends this information to Skyhook's servers.

The servers then return the access point locations to the device. Based on this data, the device computes its location.

To attack this localisation process, Professor Capkun's team used a dual approach. First, access points from a known remote location were impersonated. Second, signals sent by access points in the vicinity were eliminated by jamming.

These actions created the illusion in localised devices that their locations were different from their actual physical locations.

"Skyhook's Wi-Fi positioning system works by requiring a device to report the Media Access Control addresses that it detects," said Professor Capkun.

"However, since Media Access Control addresses can be forged by rogue access points, they can be easily impersonated."

Access point signals can also be jammed and signals from access points in the vicinity of the device can thus be eliminated. These two actions make location spoofing attacks possible, according to the team.

"Given the relative simplicity of the performed attacks, it is clear that the use of wireless Lan-based public localisation systems, such as Skyhook's, should be restricted in security and safety-critical applications," said Professor Capkun.