Re: Was Google Location Accuracy (now is How to Spoof Wi-Fi Location)

Andy Burns wrote on Mon, 28 Oct 2024 09:08:01 +0000 :

I just have to figure out HOW to tell what the heck they're spoofing.

 I doubt anything goes over the wire to be wiresharked, it's a local API on the phone.
 There's sample code on github/stack overflow etc, or just use an existing mock app?

I realize I told Jeff Liebermann a slight mistruth when I said in the post
that Andy is responding to...
  "I just have to figure out HOW to tell what the heck they're spoofing.
   Maybe WireShark, Netstumbler, WiGle, etc., might tell me. Dunno.
   You're the Wi-Fi expert who taught me everything I know, way back in the
   day when I was trying to spoof my MAC address (now the AP MAC addresses    are spoofed by default on iOS and Android).
   You told me, long ago, that you can't spoof the ROUTER's WAN-facing MAC
   address though - which - unfortunately - is the one we'd want to spoof!"
Since this thread wasn't about randomizing a MAC address, I didn't notice
that what I said above is slightly wrong in "what" MAC address is
randomized.
To be clear on the current state of Android MAC address randomization:
1. The home router's outward-facing (WAN) MAC address is NOT randomized
   (unless the router software allows that - which I don't know about).
2. What's randomized by default now is the mobile device MAC address
   that connects to the router's LAN-facing access point. This default
   mobile device (iOS & Android) randomization is per access point.
3. For Android only in Developer options" is another privacy setting    to randomize #2 per connection (so it changes every time you connect).
When Jeff Liebermann and I last spoke about MAC randomization (oh, maybe
ten or fifteen years ago or so), this default randomization didn't exist.
Now both iOS & Android do MAC randomization (per AP) by default.