Re: Tutorial: Query the Apple database with Python for your access point BSSID

Do *you* know your MAC address if presented with a list? I certainly don't.

It would be easier just to ask me for my physical address.

Am surprised there isn't a reference to the 80's comedy show 'Allo 'Allo!

I actually don't know my WAN MAC, but I know where to find it and could do so in a few seconds if I needed it. I was just joking with Andy, though.

I wonder if everyone realizes the script I posted will give them your MAC & location of your own access points, including your nearest 400 neighbors'.

You get a map (using Fermium) that shows all 400 of them, down to the very corner of the home where the access point is located (as mine show up exactly at the barn, in the stables, at the pool, in my office, etc.).

So every one of these is in Apple's WPS database with their GPS location

I will move one to the location of the Christmas Eve party later today. I'll then watch it move on Apple's WPS database, hopefully by tomorrow.

It's that easy to track its movement to the exact corner of your home!

The problem here I'm trying to resolve will protect the privacy of hundreds of millions of owners who opted out correctly from Apple's WPS database, and yet, Apple has decided not to respect any of their privacy wishes.

What Apple is doing is lying about privacy in a way that is reprehensible.

What Apple is doing is claiming they care about privacy, but clearly Apple is doing what is clearly the antithesis of privacy (read the research).

Apple "says" they care about privacy. Apple is lying.

What Apple is doing (by not honoring their own privacy policy) is the antithesis of privacy. It's legally, morally & ethically reprehensible.

Which is easy to prove. a. Only Apple does this b. Not Google c. Not Mozilla

Only Apple. Nobody else.

Just Apple. Think about that fact.

Since I have already posted a half dozen security research papers and articles that expressly claim otherwise, you're entitled to your own opinion which isn't backed up by a single security researcher on earth.

The research shows that BSSID + geolocation enables inference attacks, movement tracking, and household identification even without explicit personal identifiers. That's why every major security researcher treats Wi-Fi geolocation databases as sensitive.

This isn't a matter of your opinion; it's documented in the literature.

It's disconcerting that you've said that since it means you don't understand the problem set to even the most basic level.

For those lurking and learning, this isn't what people like Rudy think it is, since A-GPS has absolutely nothing directly to do with any of this.

A-GPS is simply a method for a phone to speed up its own location fix using network assistance. It has nothing to do with whether Apple collects and republishes the geolocation of privately owned Wi-Fi access points.

The vulnerability documented in the research applies to every access point, regardless of whether the owner uses A-GPS, GPS, or no smartphone at all.

So the A-GPS question is a separate topic and doesn't address the issue under discussion.

You perhaps didn't read the security research which explained the vulnerability has nothing directly to do with using Apple products.

There are over two billion APs alone in Apple's WPS database (according to the security research which you must have read by now, haven't you?).

Apple has a published privacy rule. Apple admits that they violated it.

Those are facts. They're not opinions. You not knowing the facts doesn't mean there isn't proof.

It just means you have a very strongly held opinion which nobody on the planet who understand how the system works would agree with you.

Certainly no security researcher on the planet would agree with you.

The existence of other privacy risks doesn't justify ignoring this one.

Opt-out mechanisms exist precisely so individuals can control how their infrastructure is used. Apple published a policy promising that AP owners could opt out, and the research shows they did not honor that policy.

That's the issue being discussed. It's not a matter of opinion. It's a matter of fact.

Personal remarks don't change the technical facts, and worse, if you think my behavior changes anything in Apple's WPS system, you're dead wrong.

The issue is not my behavior, my phone settings, or my credibility.

The issue is Apple's documented collection and redistribution of Wi-Fi access point locations, including those belonging to people who explicitly opted out.

The security research is publicly available, peer-reviewed, and independent of me personally. If you disagree with the findings, the appropriate response is to address the research itself, not the messenger of research.

Read it before repeating you don't believe in the security research, Rudy.

Arlen,

As you have thrown claims around that you refuse to substanciate in any way since forever I'm not going to believe the above either.

And neither is, as always, yours. Your point ?

Yep. Which is rather useless as long as you have no clue who you are targetting/tracking.

Yes. And than you have identified a random household. Thats as meaningless as the above.

Kiddo, come back when you figure out how you can identify a *specific* person / household from whats in that database. *Than* you have something to complain about.

:-)

:-) And what does that "network assistance" look like ? Riddle me dat batman.

Kiddo, have you *ever* stopped to think about why Apple would have spend money to create that database you have been free to access and now complaining about ? What's is purpose ? Can you answer me that ?

No, I don't think so.

And something else to think about : You have tracked the movement of a BSSID in real-time. Where do those updated coordinates come from ? Who / what is providing them ?

Regards, Rudy Wieser

Hi Andy,

I'm simply informing you and others on this newsgroup of this problem set. And I'm asking for solutions (in another thread) for resolving the problem.

I know you're intelligent and well informed, and I realize you're trying to make the point that carrying an access point in your pocket doesn't mean the access point is you, but my point is that being able to easily track it from anywhere in the world means anyone can essentially atrack you.

Or, um, er... specifically they can track that which is in your pocket. Your point may be you can leave your pants at someone else's house, and, in that case, it's really allowing the tracking of the location of your pants.

Especially since the GPS location is as accurate as it is for tracking us. To prove how easy it is to track anyone's movements from place to place, I'm setting up these three routers to prove that I can easily be tracked:

I'm going to simulate renting an apartment (flat to you in the UK) in Palo Alto at a friend's house who works for Google & then I'm going to "move" to an apartment in Cupertino (to simulate my movements over the next month). From: Marian snipped-for-privacy@helpfulpeople.com Newsgroups: alt.comp.os.windows-10,comp.mobile.android,alt.internet.wireless Subject: Help! How do we get Apple to care about privacy for entities who own access points? Date: Tue, 23 Dec 2025 23:42:17 -0700 Organization: BWH Usenet Archive

My tests will prove that Apple's WPS implementation is the antithesis of everything that Apple "says" they stand for, in terms of my privacy, in that anyone in the world can track my movements tied to my use of APs.

Also note that Apple themselves can track any device that uploads the router AP location information, but that flaw is NOT my concern today.

If I were to summarize my main issues, I would say that they are:

1. Apple's WPS implementation is vastly different than all others
2. Apple has no limits on who can obtain & track BSSID locations
3. Apple does not follow their own public privacy policy

This has nothing whatsoever to do with whether you own or use Apple products as it affects every entity who manages any Wi-Fi access point.

That's not only basically every home and apartment/flat in the developed world, but also many businesses, hospitals, government agencies, etc.

The research papers noted Apple's WPS allows easy tracking of smartphones in hotspot mode, portable travel routers, IoT gadgets, delivery robots, drones, vehicles with embedded Wi-Fi modules, buses, trains, and rideshare vehicles with onboard Wi-Fi (and individual Starlink devices also).

Apparently, even Starlink terminals could be tracked if their Wi-Fi BSSIDs are collected by nearby Apple devices.

That's because these all broadcast stable identifiers, so their movement patterns can be reconstructed just like a person's. The tracking risk goes far beyond fixed home routers.

Apple's WPS implementation makes it trivial to track billions of APs. I already proved that (just try the FOSS scripts that I modified). As for whether or not people care that they're being tracked, I care. That's all that matters. I know more about privacy than most people do.

And I care about privacy. But I am not the only one in the world who cares about privacy, Andy.

If people didn't care, then Mozilla wouldn't need this opt-out policy.

"Mozilla's client applications do not collect information about WiFi access points whose SSID is hidden or ends with the string '_nomap' (e.g. 'Simpson-family-wifi_nomap')."

If I didn't care, then I wouldn't need to follow Apple's opt-out policy.

"The owner of a Wi-Fi access point can opt it out of Apple's Location Services - which prevents its location from being sent to Apple to include in Apple's crowd-sourced location database - by changing the access point's SSID (name) to end with '_nomap.' For example, 'Access_Point' would be changed to 'Access_Point_nomap.'"

The University of Maryland paper "Surveilling the Masses with Wi-Fi-Based Positioning Systems" shows that Apple's WPS (the Wi-Fi Positioning System used by iPhones, Macs, and many apps) can be queried at massive scale to retrieve the physical locations of Wi-Fi access points worldwide.

All I did was reproduce what the researchers said was easily possible. And I proved that it is trivial for anyone in the world to do. I'd put these in the sig but you said you don't look at sig references.

Cybernews: *Anyone can tap into your WiFi location data to track you* explains how Apple's WPS can be exploited for mass surveillance.

Cybersecurity News: *Hackers Can Abuse Apple's Wi-Fi Positioning System* details the University of Maryland study showing global tracking risks.

Dark Reading: *Apple Geolocation API Exposes Wi-Fi Access Points Worldwide* notes that researchers could query hundreds of millions of APs in days.

Krebs on Security: *Why Your Wi-Fi Router Doubles as an Apple AirTag* describes how Apple's data was used to track billions of devices globally

Register: *Apple Wi-Fi Positioning System open to global tracking abuse* covers the academic paper "Surveilling the Masses with Wi-Fi-Based Positioning Systems" by Erik Rye and Dave Levin

Arlen,

And I'm informing you that you have dreamed up a problem where none exists.

Maybe you should start with clarifying the problem, instead of having us guess what you think it might be.

Ehhh.... If someone can do "x" that someone can essentially do "x" ? Yeah duh!

But as I already explained to you and you refused to respond to, from whats in that database you can only track a *random* person. Which, as I mentioned earlier, is useless.

You still don't get it, do you. You are still working your way backwards from the answer (you know what your BSSID is) to the question (find your BSSID and read your own location next to it). Anyone can do that.

Doing it the other way around however ...

Regards, Rudy Wieser

Hi Rudolph!

Thank you for your opinion, which I appreciate given I was shocked when, after reproducing the published research methods, that Apple was not respecting their own published privacy policy on how to opt out of their public WPS system that anyone in the world can access at will.

Lest you claim "I don't get it", it's important to reiterate that the insecurity of Apple's Wi-Fi Positioning System (WPS) isn't speculative. It's not an opinion as it's documented in peer-reviewed research. The recent paper "Surveilling the Masses with Wi-Fi-Based Positioning Systems" (Rye & Levin, 2024) demonstrates that Apple's WPS API can be queried at scale to reconstruct large portions of the global Wi-Fi map, including access points that the querier has never observed.

The entire database is open to everyone, as you've already seen when you ran the scripts I so kindly provided for you in this very thread prior. 1. modified working & tested "apple_bssid_locator.py" 2. 'bssid.bat' (looks up an AP) 3. 'bssidcompare.bat' (determines if/where the AP moved) 4. 'bssidgenerate.bat' (generates random BSSIDs to test) 5. 'bssidcheck.bat' (checks which BSSID is in Apple's insecure WPS DB) 6. 'bssidplot.py' (plots results en masse onto a map using Fermium) 7. gps:bssid results (text output directly from Apple's insecure WPS DB)

The key point is that Apple's WPS endpoint returns hundreds of nearby GPS:BSSIDs pairs for any submitted BSSID, not just the one requested.

The researchers claimed that behavior allows iterative expansion, which, listed in its simplest form (as described) is: a. Query any BSSID (it can be known, or random) b. Receive up to ~400 nearby BSSIDs c. Query the "edge" BSSIDs

Repeat until you have the entire database of GPS:BSSID pairs (which is trivial to do, and we proved that. It simply costs 120GB of disk space).

This is exactly the technique the researchers used to walk outward across cities and continents. I simply proved to Chris that it's trivial to do.

The researchers claimed you can easily track when those GPS:BSSID pairs have moved to a new location, which I also proved was trivial (my script looked for changes of 100KM or more - but any distance is feasible).

The researchers claim a simple public map shows the building address where that GPS:BSSID pair was before and after it was moved, and I proved that.

To verify the behavior the researchers claimed was the behavior all of us can trivially observe, I modified the open-source apple_bssid_locator tool so that it requests the full result set (return_single_result = 0) and logs all returned BSSID->GPS pairs. The modified script reliably returns hundreds of nearby access points per query, consistent with the behavior described in the paper.

This isn't "theoretical," and it isn't dependent on privileged access.

It's simply how Apple's WPS API responds today. The fact that random, unobserved BSSIDs can be queried without restriction, and that the API returns their coordinates and the GPS:BSSID pairs of all adjacent access points, is precisely the privacy issue the researchers highlighted.

Given I read the research papers and I reproduced their results, maybe you might want to rethink your assessment that "I don't get it", Rudolph.

Whether one considers this a vulnerability or a design flaw is a matter of interpretation, but the underlying behavior is not in dispute. The academic paper, the Register article summarizing it, and independent replication all confirm the same thing: Apple's WPS database can be enumerated at scale, and the API provides enough information to reconstruct the physical locations of Wi-Fi access points globally.

Even Apple didn't dispute all my facts when I presented them to Apple via my next-door neighbor who is a VP who entered the issue into Apple's RADAR.

So maybe I do get it when everything I did confirms what the researchers said, and Apple confirmed everything I did since I gave them the same data that I gave you as my goal is not only to stay out of Apple's insecure WPS database, but to help potentially hundreds of millions of others do so too!

I'm all about helping everyone - which is why all my tutorials use tools which are free to use and I provide my scripts when I modify FOSS tools.

Arlen,

Kiddo, you have changed your story. From a privacy issue to a "I can get the whole database".

You have not given me/us any explanation to why knowing *a random BSSID* and its location would be a privacy issue, and now not why you think that being able to get all the Apple databases contents would be one.

And as I've told you a number of times before, I'm not going on a wild goose hunt for something you *could* be meaning. You have it as a fact in your head, *you* explain it. I'm not going to play a ten guesses game with you.

No, you're not.

If you would be than you would take the time to make sure that your intended audience gets the facts instead of some guesswork as well as getting something thats easy to read and follow and thus understand.

I've told you that many times, but you have disregarded that for years now. Thats not something an /actual/ helpfull person would do.

Though I must say I was pleasantly surprised that your last "tutorial" was about a single subject and not multiple together, poored out after having gone to a food-blender. Yes, I remember those. :-(

Regards, Rudy Wieser

Rudolph, let's keep this focused on the technical issue rather than tone.

For you to tell me "I don't get it" a hundreds times, doesn't mean that I don't get it when I simply reproduced what researchers said could be done.

In other words, I got it. I got it the moment I read the security research (which I reproduced).

The papers and news articles you read are not speculation; they are fact. All I did was reproduce what the security researchers said was easy to do. And it was. In fact, it was so easy to reproduce what the security researchers warned about that I, myself, could easily get the entire Apple WPS database.

Worse, I, myself, could easily track any BSSID in the world. a. I could pick any address on the planet b. I could find the BSSID associated with that address c. And I could track it forever.

That's not random. I have no intention of tracking people, but I proved it's trivial to do. Just like the security researchers said it was.

Hence, the privacy concern isn't about a *single* nor random BSSID.

It's about the fact that each Apple's WPS endpoint returns *hundreds* of nearby BSSID-location pairs for any query, for any querier, and that you can't get opt out of Apple's WPS database using Apple's published method.

These flaws effectively exposes large portions of Apple's WPS database to anyone who knows how to query it, which is what the researchers said. Hundreds of millions of people who, like me, thought they opted out properly, are not opted out (which Apple replied to me in writing is the case, although we are taking a swag at how many people use the hidden feature found in almost every single router ever sold in the world).

That's the point I've been making.

If you disagree with the technical argument, I'm happy to discuss that. But dismissing it as 'guesswork' doesn't address the underlying issue.

Arlen,

Answer my questions, and I will consider it.

So, when are you going to explain how you being able to read BSSID's and coordinates from Apples database is a privacy problem ?

Kiddo, being able to repeat what others have detailed doesn't mean you understood what you where doing.

Kiddo, I've asked you several times to explain why, according to you, that that is a problem. You have refused to do so every time. No, *YOU DO NOT GET IT*.

Proof of that ? If you would than you would have been able to explain yourself to me/us. The fact that you don't ...

Yes, it is. Tell me, what is *the name of the person* behind the BSSID's you have been tracking ?

Ofcourse, you have no idea.

Its not a flaw, its on purpose. Kiddo, you have *NO* idea what that database is for, but you have already drawn your conclusions. You are, as I mentioned a few times, *WILLFULLY IGNORANT*.

And it doesn't help that *I already asked you* to consider what the purpose of that database is, and you simply refuse to do so.

Is that true ? So, if I pick a name than you can, assiming he's got a BSSID with him, tell me where that person is traveling ? Yes or no ? And ofcourse, explain your answer. :-)

Regards, Rudy Wieser

Arlen,

Another claim without anything to support it. Ignored.

Regards, Rudy Wieser

Hi Rudolph,

Let me address this at the technical level, because the privacy concerns are getting mixed up with how the data actually works.

1. What a BSSID is and is not a. A BSSID is the MAC address of a Wi-Fi access point. b. It identifies hardware at a fixed physical location. c. It does NOT identify a person. d. There is no built-in mapping between a person and a BSSID. e. The only inherent mapping is between the access point and the building where it is located f. Buildings have owners & ownership records are public information. g. So as not to dox people, the names I listed earlier were slightly altered to avoid posting identifiable data directly (but those looking at public records should recognize the pattern)

1. How the location association works a. Apple¢s WPS database stores BSSID-to-location pairs. b. In practice, these coordinates almost always correspond to a specific building. c. That building is associated with an owner through public property records (in the USA anyway) d. Apple devices passively observe nearby BSSIDs. e. Those observations are uploaded to Apple¢s WPS database. f. Apple aggregates these observations into a large, publicly queryable location database with no controls whatsoever! g. This is the same mechanism described in the published research.

2. Where the "1 to 1" linkage comes from a. Apple provides only BSSID-to-location. b. Yet, that location is almost always a building. c. Buildings have owners. d. Property ownership records are public in the United States. e. Combining these two data sources yields: BSSID -> address -> homeowner name f. This derived linkage is not present in Apple's data itself. g. It is, however, trivial for anyone to construct using publicly available information (which I easily proved) h. I am not posting the fully assembled chain in a single message, because that might dox people too easily for people like you. But it's close enough to make the point for someone who knows how to use a web page to obtain the ownership data themselves.

This is the technical explanation. The privacy boundary is simply that I am not going to publish a combined BSSID + address + homeowner name dataset in one place, even though the individual components are public.

The underlying point is straightforward: if a BSSID is tied to a fixed home, and home ownership records are public, then correlating the two is trivial. Anyone familiar with how these systems work already understands this, and the research literature has demonstrated it clearly.

And yet I proved it's trivial to obtain the named owner of every building in the United States (since that's public information) and to obtain the location of every BSSID in that building which, if it's a home, typically has only one (although mine has half a dozen or more tied to my home).

BSSID <-> Owner (via the building location)

Arlen,

...

So, your initial accusation that the contents of Apples database constitutes to a privacy violation is false.

Kiddo, thats what I've been trying to tell you all along, but you have been dancing around, trying to evade having to say that. You infact still do. :-)

In short, you need to access *other* publicly available databases to *try to* link a BSSID to a specific person.

"Try to" as it will still fail when muliple persons live close together (appartment building, GPS is *very* bad at altitude measurement, or even a row of appartments against each other), or when Apple has "seeded" those coordinates, randomly shifting them away from the actual ones. Just a few meters (inside the precision tolerance) is enough to make them point to a neighbour.

Kiddo, you are WILLFULLY IGNORANT, as you refuse to consider the implications of what you try to claim.

But ok, now you have found a *random person*. What good does that do ?

My question still stands :

If you can answer that one *than* you perhaps have something to complain about.

... but than the question is : complain to whom ? Why have you been accusing Apple of spilling the beans when those "public property records" are spilling /whole bags/ of them ?

Also, I've been telling you that getting personal information - like location information - can be bought by anyone who is willing to spend a buck.

But *if* you can find the home-addres of *a specific person* - which is not a given - and from there the BSSID of devices owned by that person - which is also not a given - you have merely found /another way/ to track that person. Congratulations.

And another question you have refused to answer : how does Apples database get the real-time coordinates of those BSSIDs (so you can track their movment) ? If its not the persons own devices that upload them, than how does that work ?

... An when a persons own device is doing it, why not point at that person (you?) for being a dumbass for not understanding how his phone works.

Regards, Rudy Wieser

Arlen,

I've got a name for you :John Smith. Now tell me, where does he live and whats his BSSID ?

Do I have to explain the above to you or are you smart enough to figure it out for yourself ?

Regards, Rudy Wieser

Essentially...

1. Every home in the USA is tied to an owner in a public database
2. Every BSSID in every home in the USA is in the Apple public database

BSSID <-> GPS <-> Address <-> Owner

Only an extremely unimaginative person wouldn't be able to connect the dots (which is why the researchers said that the Apple implementation is flawed)

Remember, Apple's WPS is DIFFERENT than how Google/Mozilla do their WPS. That DIFFERENCE is what the security researchers pointed out so forcefully.

Apple makes that task of correlating every name to every location trivial because there are absolutely no controls on the Apple WPS database.

None. You can download the entire Apple database using basic commands.

Basically, you get every BSSID:LOCATION pair in the world. (Actually every BSSID:LOCATION in Apple's WPS but that's close to all.)

The problem is two fold:

1. Apple's WPS implementation has no controls.
2. Apple won't let you opt out.

That's what I've been saying for weeks now, so if people don't get it after having read the papers and run the scripts, then they'll never ever get it.

Google's WPS has controls; Apple's WPS does not. Mozilla's WPS allows you to opt out with certainty; Apple's WPS does not.

This isn't speculation. It's fact.

BSSID <-> GPS <=> Address <-> Owner

Every person who knows anything understands that every owner of every home in the United States is in a public database and that every BSSID:GPS in every home in the world (essentially) is in Apple's public database.

For someone to not be able to connect the dots would mean they lack ability to use tools as simple as a hammer and a nail, as it's that trivial to do.

It's a simple merging of 2 data files, both of which have no controls: BSSID <-> GPS <=> Address <-> Owner

What's DIFFERENT is Google's WPS has controls; Apple's WPS does not. And Mozilla's WPS works like it should; Apple's WPS does not.

What Apple is doing is the antithesis of everything Apple "says" it does.

Arlen,

You have adjusted your claim to mean only a small part of the world. Your claim that everyone all over the world could be followed is therefore false.

Also, the owner doesn't need to live in that house or being the person carrying the BSSID with him. Your claim that everyone all over the world could be followed is therefore false.

Nope. And I'm not even going to explain that to you.

Kiddo, you have both been shrinking the reach of your claim as well as refusing to consider any of the problems I've mentioned in regard to your above chain - making your "connect the dots" a farce.

Kiddo, I say it again : YOU ARE WILLFULLY IGNORANT. And you know it.

You can't do the above, its as simple as that.

And than there are ofcourse all my other hints and questions you have refused to respond to.

Regards, Rudy Wieser