LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
robertxiao.ca
robertxiao.ca
I guarantee that by next week, this whole thing will be forgotten and nothing will have changed because privacy and surveillance are too abstract for most people -- they need to see all their personal information that's being collected. I admire the researcher's integrity for exposing it the right way (reporting it to CERT and the company itself), but going full Snowden would have had so much more impact on getting better privacy-preserving laws and technology.
From wikipedia:
“noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained”
My personal opinion is corporations have excessive influence over the US government.
What a nut job.
But yeah, accessing public information probably shouldn’t get you 41 Months in jail.
Agreed.
> If we are going to have a flawed system, I’m glad when folks like this guy take the brunt of it.
This is wrong on multiple levels.
1. It normalizes and makes it seem slightly more acceptable to have a flawed system;
2. This guy did not "take the brunt" of it. Plenty of other people — dangerous nut jobs and otherwise — have unjustly suffered similarly or worse at the hands of the US judicial system.
3. His conviction was later vacated and he was released.
If our system fails 1/100 times, I’d rather it fail on a pool of people who include neo-Nazi trolls than, you, for instance.
I’m glad the conviction was overturned as well.
However, I still hold a position that when a system fails, I’d rather it fail in the direction of Nazis.
But perhaps you are saying is that in a system with 1/100 failure, I might be less incentivized to fix the problem if the 1% end up being people I don’t like — that seems to be an incentive to be aware of.
I don’t think someone should go to jail for accessing public data (or for being stupid and having “neoNazi” beliefs). I’d vote for laws to correct such problems in the system.
However, as a human, when the system fails, I’d prefer it fail in the direction of Nazis.
Perhaps I have room to mature or grow in this area, I’m open to it.
Neither cancer nor the US judicial system's unfairness discriminate towards Nazis. Your sentiment, "when the system fails, I’d prefer it fail in the direction of Nazis", goes nowhere because when the system fails, it does not look for Nazis to fail in the direction of. There's just no connection between the two parts of your statement.
The AT&T hack is a perfectly good example, probably the most relevant one we have, of someone doing exactly what the GP suggested. Which undoubtedly would face much the same kind of overzealous prosecution, if not much worse given the current climate.
I do agree with GP though, and wish more researchers would be a lot less polite and well-behaved with their disclosures, sow a little more chaos even. This really was a golden opportunity to have a real national impact, and to give a huge number of non-tech people an unprecedentedly effective wake-up call.
Blogging about being a bad boy and pretending to be master of anonymous/the cyber aryan nation is his gimmick. He wishes he was david koresh, but he's completely harmless.
He demonstrated a thorough familiarity with ptmalloc internals, enough to correct someone else's remark about fastbins (meanwhile taking frighteningly large hits of whippets).
Additionally, he was the first person I had ever heard mention Rust.... wayyy back in 2012 (I'm embarrassed to say I thought he was talking about Racket and tried to correct him - I was 19 and thought I knew everything). He seemed to know quite a bit about the language even then.
He continued to discuss other topics arising from this with other hackers. One such conversation I remember more clearly was his exchange with another hacker (a quite skilled one by my estimation) where he seemed to speak rather cogently about the relative merits of a complete semantic tableaux and SMT solvers to determine "real ptr lifetime" (beyond just adhering to a set of idioms that enable a constraint solver to verify reference use).
So if he can't code PHP, then that's even more impressive.
As an aside - in person, he came across as very warm, funny, charming and even deliberately inclusive.
It feels strange now, but long ago, if you looked at him with the right shades on, he'd seem to give a nudge-and-a-wink that the "trolling", including his iconoclastic project of the time: the posthumous baptism of Muhammad's remains via becoming a Mormon deacon (of some sort??) were all intended to be thought-provoking irreverence rather than chaotic evil. No matter what was discussed he always gave the impression there was something more there, something almost hermetic.
In those intervening years my view of him has assumed a different proportion. Those weren't all harmless culturejamming tricks pulled off in the name of some Discordian spirit which lies somewhere behind the neocortex of the hacker mindset. At that time, and many years before then, there were pranks, tricks and trolls that were unimaginably cruel, purposeless and petty.
Since, prison has hardened him further into a wicked racist, who, lacking a better word, is insane.
He might know about how to pimp-out a livejournal page, but that's about it.
[0] - https://www.theatlantic.com/magazine/archive/2017/12/the-mak...
I'd hope after years of Mr Robot larping he figured out how to install a CMS.
Any proof?
You're one person making claims that run counter to everything published about the man.
Weev just talks a good game.
That's ends up being conspiracy to commit the crime, which hits you just about as hard as the crime itself. You better be _very_ confident that the FBI/NSA won't be able to intercept your communications or tie you to the foreign national who commits the crime.
EDIT: I can't tell if you're being sarcastic or not
A suggestion would be: if you want to research vulnerabilities without the possibility of prosecution, why not research other countries' companies' vulnerabilities, where those countries have no treaty criminal-deportation agreement with your home country? Such companies can still pay you if they appreciate what you've done, but they can't sue you if they don't; and even complaining to their government about what you've done won't really amount to anything in the end.
This, I think, solves the problem, at the cost of raising two other problems:
• Your own government might not appreciate you improving the security of [essential industries of] its enemies;
• the foreign government might interpret the vulnerability research as an act of cyberwar (much like, say, flying your own drones over a foreign military installation as a private citizen would be interpreted as an act of regular war), and your own government might have to trump up some domestic charge to pin on you in order to appease them.
The first factor is more important in time of war (you might be branded a collaborator!); while the second is more important in time of peace (you might be branded an instigator!) So there's probably very few "exactly right" times to do this where you'd likely get away with doing it scot-free.
Auction leaked data to foreign intelligence or companies, then make the price known. We’ve been warned enough times. That’s the only way Americans will put a price on privacy, and fines for unsecured systems will climb through the roof, with wilful enforcement by both companies and customers. And the whistleblower gets paid, better than rotting in Russia for years.
If this has been a black hat leak where someone was caught selling 300 million peoples' location data, it would have made a bigger story yes, but it would be in the same bucket as Equifax right now (and to an extent, Snowden as well).
The point is to make it public. Not claim its out there somewhere. The ability to go in and see your data just sitting there in the public is what makes it 'real' to people that don't think they care about privacy.
Imagine the chaos caused by a distributed, automated, nationwide creation of fraudulent accounts and debts being created.
It would bring the financial system to a halt until the fraudulent transactions could be identified and filtered out.
I appreciate the sentiment here but no. I'm going to show you how easily you can be robbed with poor locks by robbing you is a crime. Infringing everyone's privacy to show it is possible is infringing everyone's privacy.
You can't claim to infringe privacy because you understand why it's so bad to infringe privacy any more than you can mug people to show them how bad it is being mugged.
We need to be.
Happy to answer questions and provide any additional context.
Wonder how long this was open for any bad actors to exploit.
All I can say is wow.
I was going to poke around that site yesterday after I saw the article, because looking at their website it really looked like there had to be some vulnerabilities. What you tried is exactly the kind of thing I would have looked at first.
Yep, there’s no way you’re the first to find this. Honestly I’m at a loss for words how absurd this is. We just need to assume this was actively exploited for who knows how long.
We won't know what the real exposure level was unless someone asks LocationSmart very persuasively.
Your descriptions thus far are pretty vague but man... it sounds like there is a VERY high likelihood that this was being exploited by malicious actors on an ongoing basis.
I didn’t mean this to be offensive or crass. I was asking because generally security exploits are ranked by (a) severity and (b) triviality. That is, a severe bug that is extremely difficult to exploit is not as alarming as a severe bug that is trivial to exploit.
When laypeople read that a CMU researcher discovered a bug, they might assume it is not trivial. So in that sense mentioning the PhD almost does a disservice to expressing the triviality of the bug.
When a high school kid in Hungary discovered he could purchase train tickets for any price by changing it client side, non-technical people could understand it was a trivial bug. When a CMU researcher discovers a bug, they likely assume the opposite.
Any context at all would be appreciated. The Krebs article mentions almost no context whatsoever about the bug except that you found an unauthenticated API.
Can you give some details about the API?
• Did you need to exploit SS7 flaws?
• Did you reuse some kind of nonce or session auth token, or was there no security whatsoever?
• Did it take phone numbers, hashes of phone numbers, bulk queries, etc.?
• Can we see example output data that you collected from the API?
• Did you notice the API endpoint in the devtools network tab, or did you have to dig much deeper?
You should do a write-up on the issue you found.
In short: it was a fairly straightforward modification of the usual API flow, to omit the secondary API call that requests consent, then request a JSON location payload instead of an XML payload. For whatever reason, that bypassed the usual consent check and just dumped the phone's location.
(Submitted url was https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...)
The first thing that comes to mind is if this is on a well known framework, I want to know because those security defaults are awful.
However if these guys rolled their own API auth system and messed up something this simple, or deliberately modified framework defaults... I can't even imagine what conversations happened at their offices this morning.
To me that sounds like you stumbled upon an unauthenticated development/debug mode.
I've also noticed multiple in that group will purposefully leave their phone behind & drive their older cars when they choose to have a tracking free day, even 2 decades later exposure to how easy it is to pull live location data still notably impacts their behavior.
https://www.fcc.gov/consumers/guides/911-wireless-services
"Phase II E911 rules require wireless service providers to provide more precise location information to PSAPs; specifically, the latitude and longitude of the caller. This information must be accurate to within 50 to 300 meters depending upon the type of location technology used."
Not the law I'm guessing you were after, huh?
Even doing something like an nmap or a simple ping against a server that you're "not supposed to" could put a target on your back from an overzealous prosecutor.
See https://www.theguardian.com/technology/2014/may/29/us-cyberc...
phone--carrier--LocationSmart.
The carrier determines the location of the phone because it's a cell phone. The Carrier provides the information to LocationSmart. There's no querying of the devices by LocationSmart per se.
If the CFAA bars legitimate security research like this, then we would all be truly fucked.
It's a good find. Congrats.
You must be new here. This is why we have all been saying that the CFAA is truly fucked, for many years now :)
But yes, you did play with fire on this one. People have been convicted for far more innocent activities than this. I assume you're a student or recent grad and may be a bit optimistic about the world we are in. Don't fuck around under your real name or IP address when you do this kind of thing. "Accidentally" dropping a ' into a webform just to see what happens is one thing, but you won't be able to feign innocence with something this involved. Unless you are both the client and the server, or the other party is unambiguously inviting testing (such as a bug bounty), you have no claim to legitimate security research.
It's still awesome that you found and drew attention to this. It's important work. But, cover your ass next time, or know what you're getting into. Especially hitting obscure companies like this, who notoriously exist in a culture very unlike the typical valley-type company, where such activity makes them feel very threatened and outraged, often turning to law enforcement or initiating legal action.
Also, the term you're looking for is coordinated disclosure. Do not let the vendors define "responsibility" as they have attempted to do with the injection of that term into the lexicon ;)
First Sentence: >> LocationSmart has built the most secure LBS location data exchange available today.
They go on:
>> Privacy and security are paramount in LBS services. Locking down privacy is not only core to our brand, it's also our unwavering business practice.
what a crock
To be fair, they are not wrong. I looked into getting real time cell location data a while back, and the security was basically IP whitelisting.
But for some reason, access control has something to do with LocationSmart's entity body serialization format... hmm, okay then.
Props for finding the vuln.
At most, hitting location smart over and over would probably just hit the carrier databases over and over.
You can strike “most likely” from your statement. Carriers definitively do this.
When I tried their own trial (before it was taken down), they were unable to locate my iPhone on AT&T.
Nope, AGPS isn’t required. At any given time, multiple cell towers can hear your devices signal. In the rare event it’s just one, you still get a surprisingly accurate location due to a quirk of cell towers (there’s never just one antenna, except for small cells in places like subways, it’s usually three or more using sector panels). Given a 120° direction (or less) and a distance based on time of flight, you usually get within a few blocks in most cities, and that’s without factoring in triangulation or other more advanced localization techniques. One carrier (maybe more) has the ability to localize a person with a range of ten feet (not everywhere, but enough places to turn it into a product they sell), which is generally more accurate than AGPS.
I'd imagine a cellular network has some "exception handling" for devices that are not switched on or in range of any of it's base stations. And I hypothesise that whatever mechanism this is using might not crank up whatever "scan the whole network" behaviour that might occur if a not-currently-geolocated phone gets an incoming call/message? 1/10 seems too high to account for that though...
Funny how they removed the corporate logos they had on their website from yesterday to today:
Yesterday: http://web.archive.org/web/20180516060611/https://www.locati...
Yesterday's had the carrier logos prominently displayed. Today's has not carrier logos that I can see.
https://www.locationsmart.com/cms/resources/
Look for 't-mobile' or 'verizon'
Just put a lock on top, even if it's not actually securing anything.
Hopefully this answers some of the technical questions about the exploit :)
all of them replied saying "we will cut clients not following the program guidelines"... what are those guidelines?! and why is that arbitrary for the companies to decide, and not mentioned anywhere on the consumer agreements other than some vague "we may share your data with whoever"?
This sounds like Cambridge Analytic for TelCos.
The guidelines are not enforced or audited.
I'm just learning about this whole thing now and I'm very upset.
And provide a straightforward mechanism of checking what has had access, what still has access, and a way to revoke it.
But as I read the article, the location data is only at the resolution of which cell tower they're connected to. Doesn't 911 get better location info than that?
“It's funny that this is coming up now. The other day I was on the phone with Geico's roadside assistance and they wanted to know my location. I told them I didn't have their app downloaded, they said it wasn't a problem and they could get it without it. Sure enough they could. I checked their disclaimers [1] and they purchase the data from my cell carrier. They didn't even have to know which one.
[1] https://www.geico.com/web-and-mobile/mobile-apps/roadside-as... (see disclaimers at the bottom)”
――――――
It is definitely based entirely on inferred data from cell tower usage. No gps involved whatsoever.
https://www.ptsecurity.com/upload/iblock/8c0/8c065c70984c93d...
Source: I used to have direct access to such an API
I'm pretty sure that won't happen, though...
A warrant is not an unreasonable handicap. No warrant? No data. If you don't need the data bad enough to get a warrant, you don't need the data bad enough to get it.
On a more serious note, being young makes it appears as though the congress-person is taking advantage of an "impressionable" employee. Being good looking makes it look like the relationship only exists because of the congress-person's rank.
My hope is that a vulnerability like this sparks the right public discussion to get real change effected in a positive way, but in the current political climate I am sadly not optimistic.
1. The National Security Whisleblowers Coalition http://nswbc.org/contact_us.htm
2. The ACLU https://www.aclu.org/contact-us
3. The EFF https://www.eff.org/security
4. Your State Attorney General, Congressperson and U.S. Senators. http://www.naag.org/naag/attorneys-general/whos-my-ag.php
5. Jennifer Valentino DeVries https://jennifervalentinodevries.com/contact/
(Jennifer wrote a recent story for the New York Times about cell phone tracking abuse [1]. Krebs links to her story in his post.)
[1] https://www.nytimes.com/2018/05/10/technology/cellphone-trac...
:)
And would further prove malice on the telco part.
All sort of contractual gags that keep people from commenting on bad and sometimes malicious behavior. Because it's the only way to get the job they're trained for, etc.
Companies insisting on the contractual right -- in small and seldom-read print buried within a sea of other print, for an "everyday" purchase -- to essentially violate the 4th Amendment (I'm thinking; maybe I've got that wrong) against unreasonable search and seizure. I guess that right was targeted against the government, but it seems it should apply to these government-size corporations and multi-nationals, as well. Selling us what has become an essential service; try living most people's lives in the U.S. without a cell phone.
And hey, we know governments are making use of those data, as well. A typical government ploy; purchase data from a private, third party that the government is not allowed to directly collect, itself. Sorry, that "scrubbing" indirection shouldn't disqualify it from constitutional protections.
Divide and conquer. Whereas solidarity actually requires some privacy and wiggle room, to function effectively and autonomously in the real world.
As far as I can tell, this is because Constitutional amendments are hard to enact (in the case of the EPA and Obamacare) and for reasons I don't understand, Congress doesn't seem to want to declare war any more.
Is that a fair assessment, or am I getting only part of the picture?
Agreed that declarations of war can just be declarations of war, no amendments required. It strikes me as odd that Congresscritters would be okay invading a country, but not okay with declaring war against them.
Obamacare (Patient Protection and Affordable Care Act) was also created by Congress - bill passed in both houses, signed by the President, upheld by the Supreme Court. That's basically a textbook example of how the system is supposed to work.
I'm not sure why the EPA (and others, like FEMA) were created by Executive Order instead.
As far as why Congress hasn't declared war since WW2, they've basically rolled up their say into the War Powers Act and the War Powers Resolution which provides for them being informed and issuing continuing approvals. They can then support the President (as Commander in Chief) but not officially declare war.
Federal laws (Obamacare/ACA) and federal entities (EPA) are created by Congress.
The executive branch (President), can issue executive orders, but they are limited to authority granted by Congress and the constitution.
The judicial branch is there to verify that the other two branches are staying within their constitutional authority.
Constitutional Amendments are difficult to enact, but that is intentional. Amendments limit government at all levels. Congress can't make any law, and the executive branch can't issue any order that conflicts with the constitution. The only thing you can do is amend the constitution again.
The problem is that Congress has become a gridlocked mess while also offloading a lot of it's authority to government agencies acting on it's behalf under the executive branch. Effectively increasing the scope and power of the presidency and by extension the reach of executive orders. This has also pushed the judicial branch into a much more active role than it was designed for.
Edit: It's also one of the contributing factors in the heated elections in the USA. As the power of the presidency grows, people become more invested in seeing their person in charge.
I could see a corporation tracking people for good. E.g. A travel agency that detects where it's clients are in route until they get to their final destination, and automatically reroutes for flight delays, or traffic jams. That would be something I might pay for.
Untill there are proper protests and pushback the creep will continue and the useful idiots and the ignorant will continue to muddy the waters and dilute the threat only to slink back into the woodwork once the real consequences become visible.
And with all encompassing surveillance even organizing protests and dissent will become difficult without the kind of sacrifices most people are unwilling to make. Just today there is story of a guy getting a knock on the door from the police [1] a few hours after posting about eating mushrooms on facebook.
[1] https://munchies.vice.com/en_uk/article/gykbe3/cops-show-up-...
It is the same thing as if a bank would sell their customers' bank card numbers and SSNs.
Yet, we allow American branches of multinationals, or domestic companies owned by foreigners to directly influence politics and politicians, so I'm still not sure where the issue is.
If you don't want embarrassing scandals from your preferred political party sinking their chances at winning elections, perhaps it should stop having embarrassing scandals? No, surely, the fault is in the people publicizing them...
Do we need to opt-in with our Carrier, or with LocationSmart?
The first one would make more sense than the second.
What is going on here doesn't make any sense. Basically the carriers give access to the data of EVERYONE and the latest link of the chain is the one supposed to check the "opt-in"? Meaning everyone on the chain in between got access ?
I think the carriers carry way more blame in this whole thing than people are acknowledging in this whole thread. Users that didn't opt in are still having their data made available to these third parties cause it's easier to implement. It reminds me of the legal fiction the NSA uses. They collect ALL the data / traffic. But they can only ACCESSS the data with a warrant. In this case the virtual firewall leaks horribly between the carrier and LS and the incentive to make it strong does not exist. Totally different situation but the parallels are there.
US cell carriers are selling access to real-time phone location data https://news.ycombinator.com/item?id=17081684 https://news.ycombinator.com/item?id=17069459
Service Meant to Monitor Inmates’ Calls Could Track You, Too https://news.ycombinator.com/item?id=17046632
Bad API's used in IoT are a huge vector for attack and too few companies in the mobile first world have a bug bounty program. I found a similar problem with an API for an app that comes default installed on most android phones I've purchased (think smart phone as a TV remote). I reported it and got no response. Their homepage claims the app is being used for 10's of millions of smart devices like A/C, TV's, Fridges, Microwaves, etc. The vulnerability allowed full account access.
Then again, that of course gets into murky water and it's best to at least try to get legal council or work with a responsible disclosure website. IANAL.
"asuhdfo8a7ys8dfas.website.com" type of setup. In front of this origin they had a server that did auth and auth only. If your auth worked at the edge, the request was sent to origin. The problem is I found a specific input that caused an error dumping a stack trace that contained the origin hostname. I took the original request and replayed it directly at the origin. To my surprise the response was the same as going through the auth server. Then I changed the user id some integer that wasn't mine and got information back. Then I quit playing with it and sent an email.
This leaves me in a weird spot because I was fuzzing them looking for details when I was fully aware they did not have a bug bounty program. Why did I do this? Because I was using the app myself, I'm a security guy, and had read about a cool exploit with the uber app. It only took about 5 minutes of setting up burp proxy for my phone with ssl and 5 more minutes of auditing to find an input that dumped the stack trace.
Hello XX,
I am concerned about the security of my cell phone location information.
Yesterday, a vulnerability was found that leaked the real-time location of 95% of the cell phones in the US. That is unacceptable.
US cell phone carriers including AT&T, Sprint, T-Mobile and Verizon share personal information, including phone numbers and real-time location of cell phones, with companies such as LocationSmart, who then resells the information to other companies for marketing and other purposes. Carriers to not provide a way for users to opt-out of such sharing. This is completely legal under the current Electronic Communications Privacy Act. LocationSmart claims that they will not share the gathered information without user consent, but the definition of consent is vague, and that doesn't protect the public from security breaches. I understand that carriers need to have location data to comply with emergency 911 regulations, but it is unacceptable that they are able to share it with 3rd parties who may use it for dubious purposes, and may have lax security standards.
We need to have laws that protect the privacy of cell phone users, and do not allow carriers to sell personal information to 3rd parties. Or, and the very least, customers should be able to opt-out of such sharing from their carriers.
For more information on the vulnerability found yesterday, please see: https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...
Please contact me if you have any questions.
Thank you, XX
Would it be unfeasible to only track once a 911 call is placed?
It's not like the networks send a message out via every cell tower on the planet asking if $rolandog{'mobile_number'} is listening every time you get a call or text.
Whenever your phone is switched on, it regularly contacts the tower it's got the strongest signal from and says "Hi, it's rolandog's phone here, if you get a call for me, this is where I'm hanging out! kthxbye"
And the scariest thing me in the article (besides being able to bypass the auth) is that they were able to send several requests and track movement in near real time. Did they really not have a request limiter in place?
"Phase II E911 rules require wireless service providers to provide more precise location information to PSAPs; specifically, the latitude and longitude of the caller. This information must be accurate to within 50 to 300 meters depending upon the type of location technology used."
Then you need to identify what device it's for, that's another 32 bits if you're being conservative. I'll ignore timestamp, since you could infer that from the location in the data store (assuming you have nice even 30s intervals), but it would otherwise be a bonus 64 bits.
That's 10TB, but also pretty useless because you've got a giant pile of u32s. If you were going to do this for real, you'd probably store the user's location with full precision for the first sample, then simply have diffs with a precision that assumes, say, the device isn't going to move faster than the speed of sound. The index is likely going to be pretty massive, and you'll constantly be reindexing because you're getting new data all the time (with a cardinality of 300M).
Even then, you're probably looking at something that's triple or quadruple that size. Let's say 40TB. That's only 14.6PB/year, which is not unreasonable storage for the government. But then you need to consider other things:
- You're ingesting 600M data points per minute. If you're only getting the minimum (96bits/user), that's over 7GB/s.
- But of course, it's probably not in a binary format (in the article, it was JSON and XML). Make that 50GB/s.
- Now you're parsing XML and JSON. That's not free when you're parsing 600M documents/minute. You'd likely have a pretty damn big server farm to ingest all this data.
- Your carriers need to be able to send that data to you, so they need to be equipped to (collectively) deliver 50GB/s of encoded location data; not to mention be able to dump the latest record for every customer in their location database twice per minute.
I wouldn't bet money that the government cares enough about every last device in the country to rig together such a big system only to keep track of where my grandmother's Jitterbug is. It's nonsensical to think that they couldn't just send an API request to AT&T or Verizon and be like "Hey guys, where's John Doe's phone been in the last week?" That's almost certainly more practical and cost effective in every way.
Why would they want this data? Because they want to be able to not just track in real time 'persons of interest' but also to recreate past movements to establish associations.
As to the difficulty (if any) for the major telecoms to provide such a feed - chump change to the NSA to assist in that matter, just like regular law enforcement pays for wiretaps.
See: https://www.verizonwireless.com/legal/notices/customer-cpni/
Seriously. There is no other option. Only niche local providers won't share with these types of companies.
That is what I am looking for! Do you know where to find those providers?
I’ve heard stories of how telcos track down things like broken fridges etc that are adding noise to their network (and buy the owners a new fridge) so clearly they have the ability to track things that aren’t part of their network.
I can't think of any business for which it should be reasonable to make additional money by selling the users data. If a service is for free, I can understand that somehow the bills have to be paid and that selling data is an obvious option here. But if you paid for a service you normally don't expect the service provider to sell your data anyway. That kind of business should be illegal IMHO.
I kinda had no clue 3rd-party services like this existed, and assumed realtime cellphone location data was only available to law enforcement in emergency situations... Cool..
https://books.google.com/books?id=wg4XBQAAQBAJ&pg=PA336&dq=0...
The historical record doesn't support this.
So given that these tools, even when abused, don't lead to the kind of wanton destruction nuclear weapons do (that trigger our primal survival instincts), the odds of everyone on the planet generally refraining from accessing surveillance technologies when available are low, and those that do so will tend to become more powerful (and therefore spread the cultural meme that "hey, this stuff is okay in moderation").
What products use this that expose me to this?
A Catalan seperatist was arrested in Europe this way.
Operating as a MVNO wouldn't help; the parent carrier can still collect data from their customers.
[1] https://www.google.com/search?q=TMUS
[2] https://www.cnbc.com/2018/02/01/apple-earnings-q1-2018-how-m...
It seems like there's room in the market.
(Ask HN about this yesterday: https://news.ycombinator.com/item?id=17088252)
Anyone else?