Abstract
While Internet users may often believe they have anonymity online, a culmination of technologies and recent research may allow an adversary to precisely locate an online user’s geophysical location. In many cases, such as peer-to-peer applications, an adversary can easily use a target’s IP address to quickly obtain the general geographical location of the target. Recent research has scoped this general area to a 690m (0.43 mile) radius circle. In this work, we show how an adversary can exploit Internet communication for geophysical location by embedding covert signals in communication with a target on a remote wireless local area network.
We evaluated the approach in two common real-world settings: a residential neighborhood and an apartment building. In the neighborhood case, we used a single-blind trial in which an observer located a target network to within three houses in less than 40 minutes. Directional antennas may have allowed even more precise geolocation. This approach had only a 0.38% false positive rate, despite 24,000 observed unrelated packets and many unrelated networks. This low rate allowed the observer to exclude false locations and continue searching for the target.
Our results enable law enforcement or copyright holders to quickly locate online Internet users without requiring time-consuming subpoenas to Internet Service Providers. Other privacy use cases include rapidly locating individuals based on their online speech or interests. We hope to raise awareness of these issues and to spur discussion on privacy and geolocating techniques.