Hacker News new | ask | show | jobs
by pravda 2233 days ago
A question for the Android experts: is it possible to block or spoof location data, through a custom build?

Could I have an Android phone running a program that spoofs a long steady drive from Tampa to Butte?
5 comments
rmrfstar 2232 days ago
Yes, but that does not stop the cell providers from selling your location [1].

You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble [2].

[1] https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hu...

[2] https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hac...

link
oarsinsync 2232 days ago
> You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble

The article also points to WhatsApp as the infection vector.

I agree that anything Facebook produces is fair game as far as being sketchy goes, but it’s not the only messaging platform to have been exploited.

Do we run all messaging services in independent sandboxes in VMs?

link
laegooose 2232 days ago
[2] says Bezos' iPhone was hacked via WhatsApp with the NSO Group-developed exploit. It is not possible to run iOS VM in the cloud, and even for Android it does not sound practical at all.
link
cosmojg 2232 days ago
I had the option to spoof location data under "Developer options" in Settings with the original OnePlus ROM, but it's even easier to accomplish now that I'm running LineageOS.

In short, yes.

link
seibelj 2233 days ago
Yes, it’s very possible, I did similar work years ago patching functions on jail broken phones for seamless encryption.
link
drivebycomment 2232 days ago
Why bother spoofing when you can simply turn location permission off ?
link
panpanna 2232 days ago
Spoofing adds noise to the data, making it worth less.

If enough people do it in a way that cannot be easily detected, the market for this sort of data will shrink quickly.

link
drivebycomment 2232 days ago
I don't see how spoofing is better than blocking. If enough people block it, the market will shrink even faster. It's also much easier for people to block than "spoof". Spoofing seems practically pointless and academic compared to blocking.
link
realharo 2233 days ago
On a custom ROM, sure. That's why games like Pokemon Go blocked them.

Using it as a daily driver is not advisable though.

link
Firerouge 2233 days ago
At worst, having root should be the most that's required, which only on some phones requires a custom rom.

Android has built in support for location spoofing with the developer mode option, select mock location app.

link
realharo 2233 days ago
Other apps can easily check whether the location comes from a mock source and discard such data.

https://developer.android.com/reference/android/location/Loc...

link
mindslight 2232 days ago
These type of security vulnerabilities are due to the core OS/APIs being developed by a surveillance company that isn't concerned with user privacy, and they're countless.

There isn't enough will in the Free world to mitigate even the most glaring ones either, such as LineageOS not incorporating the MicroG patches. The end result being more forks, more confusion, and groups of users remaining unprotected.

Commoditize your complements, indeed.

link