Location leaking

[daniellge]

every app is getting a spoofed location besides seesmic. I've disabled all location services and added various cities to the xpiracy location field. anyone else experiencing this problem?

[M66B]

Can you please post a link to the app, so I can look into it?

[daniellge]

https://www.google.com/url?q=https://play.google.com/store/apps/details%3Fid%3Dcom.seesmic%26hl%3Den&sa=U&ei=XP_iUdi-E8W44AOWv4D4DA&ved=0CAkQFjAA&usg=AFQjCNHWFDkmlzwUm9JcJCjFAc7ygrwNzA

when you select "attach loocation" on a new tweet it will post your real location instead if the spoofed one.

[M66B]

I have just tested and for me the location is 'Christmass Island'.
Could you please post a logcat like this:

• Power off your device
• run 'adb logcat | grep XPrivacy' on the command line
• Power on your device

I like to see at least all messages with '... hooked ...'

[daniellge]

Still getting the same errors, now it won't spoof the location of maps? Anyway I can send you my log file?

[M66B]

Yes, please send me a log file.

[M66B]

Do you get an alert saying 'Incompatible ...' when you start XPrivacy?

[M66B]

Did you flash the Xposed fix?
Was there a ROM update after you have flashed the Xposed fix?

[vipere]

Location didn't leak for me using the app Network info II, but Wifi SSID does.
Seems the app uses the hidden function getWifiApConfiguration inside the WifiManager

[GhostlyCrowd]

I have flashed the xposed fix, i know for a fact its working because spoofing gps on gmaps does not work with out it.

[M66B]

Could somebody try with this version? http://d-h.st/nST
At least leaking the SSID should be fixed and maybe the location leak too.

[GhostlyCrowd]

ok ill grab it

[M66B]

Also try to flash the Xposed fix again, it is the most logical explanation for the location leak.

[M66B]

@vipere decompiled Network Info II, thanks!
getLastKnownLocation and requestLocationUpdates are used to get the location, which are both hooked by XPrivacy. In the one log I got I see requestLocationUpdates, but no getLastKnownLocation.

[M66B]

If the previous test version still doesn't restrict the location, then please try this version: http://d-h.st/Noc

[GhostlyCrowd]

SSID leak is fixed. The issue with location in network info II is still there, its not grabbing my spoofed location like it used to. Still did not fix the issue of network info saying location was unavailable.

SO then i decided to give network info all perms back. everything in it got proper info BUT location info. so then i uninstalled network info II. reinstalled. STILL could not get the spoofed location to work. then i exported my xprivacy data, wiped xprivacys cache and data. rebooted re-imported xprivacy's settings checked that network info II worked and it did and now location was proper. so then i went into xprivacy limited the perms on network info II the exact same way i had before when location was not working. and BAM its picking up my spoofed location now.

I have no idea what going on. i tried to grep for xprivacy touching network info when it was all buggered up but i gave it all perms back, and didn't see a single thing.

[M66B]

Could you please send me your exported XPrivacy settings?

[GhostlyCrowd]

sure ill email them

[GhostlyCrowd]

email has been sent

[treare]

Hi,

This morning i updated my rom, flashed the fix and installed the second testversion. The problem remains thesame in wechat

[M66B]

Did anybody try the second test version from above?

[treare]

well, i did.

[GhostlyCrowd]

I tested it as well that's what my above report was based on that you asked for my settings XML from

[M66B]

@GhostlyCrowd thanks for your exported settings.
The strange thing there is no trace of Network Info II in the export file.
It is unlikely that there is something wrong with the settings, else there would have been massive other problems.
I have no idea how this is caused.

Did you update Network Info II recently?
Could everybody report which Android version / ROM / device is being used, to see if there is a system in it.

[GhostlyCrowd]

Device: Samsung SGH-I747M
ROM: CM nightly updated daily.
Android Version: 4.2.2
xposed Version: 2.1.4
xposed Fix Version: 4.2

[treare]

Samsung Galaxy SIII (GT-I9300), Vanilla rootbox nightly 4.2.2, Fix 4.2
Sony Ericsson Xperia Z (C6603 Yuga), Pacman 4.2.2, Fix 4.2

[M66B]

"CM nightly updated daily": do you also flash the Xposed fix daily?
(sorry if this is a stupid question for you, but it is one of the possible causes)

[treare]

@M66B: do i need to give up on wechat after reading your answer to GhostlyCrowd?

[GhostlyCrowd]

@M66B
Ah, well why isnt GS returing the spoofed location since thats what its fed ?

[treare]

if an app uses GS network/location:

can it be that users blocks "something" for this app so that it cannot ask GS for the location?

[M66B]

@treare Already working on that ;-)

[treare]

Thanks. Still i have doubts about what i wrote earlier. I think wechat has nothing much to do with GS after all. What bothers me most is that wechat is the only app that only triggers the gps icon when its location is not blocked. All other apps ive tried, i think 5 or 6, get the gps icon, blocked or not. Even whatsapp and flightradarOp 21:18, 17 juli 2013, schreef Marcel Bokhorst:@treare Already working on that ;-)

—Reply to this email directly or view it on GitHub.

[M66B]

XPrivacy doesn't block the GPS, it only spoof the location or returns an empty location.
So the GPS icon will appear as normal.

[treare]

Well... you told me that before but thats exactly the problem with wechat. If i block location and i enter location feature in wechat the icon is not shown. In other apps if i block location and ask for the location the icon is shown like you say (but location is spoofed ofcourse)Op 21:29, 17 juli 2013, schreef Marcel Bokhorst:XPrivacy doesn't block the GPS, it only spoof the location or returns an empty location.
So the GPS icon will appear as normal.

—Reply to this email directly or view it on GitHub.

[GhostlyCrowd]

If the gps icon is not shown then it means wechat must be probing something else besides the actual gps hardware for location. maybe GS or something. that icon only shows up when something probes the actual hardware so ive been told.

[treare]

@GhostlyCrowd: i tested with GS which makes no difference. But as said before: the icon is there if i dont block location. Its not there if location is blocked. Wechat is the only app that doesnt turn on the icon when location is blocked.Op 21:42, 17 juli 2013, schreef GhostlyCrowd:If the gps icon is not shown then it means wechat must be probing something else besides the actual gps hardware for location. maybe GS or something. that icon only shows up when something probes the actual hardware so ive been told.

—Reply to this email directly or view it on GitHub.

[M66B]

Test version 1.7.1: http://d-h.st/0of
Install, wait until XPrivacy notifies 'Reboot required'
Drill down category location and check 'connect'
This will prevent the application from connecting to Google Play services.

[M66B]

Reboot is still required to make it work ...

[treare]

Installed 1.7.1 like you described and tested it with flightradar. Afterwards with whatsapp. GS has nothing blocked. The 2 apps could find my correct location. I think "connect" doesnt work.Op 21:55, 17 juli 2013, schreef Marcel Bokhorst:Reboot is still required to make it work ...

—Reply to this email directly or view it on GitHub.

[M66B]

Whatsapp caches the location itself. Clearing data helps.

[treare]

Ok wiped whatsapp completely. I have set moscow as location. Whatsapp thinks im somewhere in san fransisco now. Flightradar stayed thesame. It finds my coorect location. Everything blocked for flightradar (also connect) except for internet. Some more tests in the morning.Op 22:07, 17 juli 2013, schreef Marcel Bokhorst:Whatsapp caches the location itself. Clearing data helps.

—Reply to this email directly or view it on GitHub.

[GhostlyCrowd]

@M66B Alright, installed 1.7.1, drilled down "Connect" and now when i launch Network Info II it sees my spoofed location even with GS location spoofed.looks like you have solved the leak in this aspect. I will test whats app now with the others. As well as Flight Radar.

[M66B]

Flightradar is using Google maps, see the wiki for how to restrict Google Maps.

Speaking about the wiki, could you please document in the wiki what we have found out here?

Am I correct we have an explanation/fix for all leaks now?

[GhostlyCrowd]

@treare Whatsapp is in fact seeing my gps location as spoofed, it just doesn't auto move the map to that location instead it is sitting on the default map area that whats app has in San Fransisco but if i zoom out i can see my blue gps marker and when i zoom in its indeed my spoofed location. Flight radar is also showing my proper spoofed location. i have Connect drilled down on both these apps as well as the rest of the location stuff

good stuff! @M66B

[treare]

Hi again,

Here's what i did. This morning i wiped whatsapp's data. blocked everything in location and in netword adressess for whatsapp. connect ofcourse also. i did NOT block GS as i assume it cannot be reached by whatsapp. instead of using wifi at home i started driving. it finds my correct location. this could not have been cached.

Flightradar: it uses google maps? i don't have that installed. also here:

• a phone without sim connected to unknow wifi point
• location and network address fully blocked including "connect", it finds my correct location
• enable GS network and location blocking and wait for a while
• FR shows the spoofed location (with connect still blocked for FR!!!)
• remove blocking for GS and wait for a while
• FR shows my correct location

it's clear to me that "connect" does something but that it's not fully working or am i missing something?

with "connect" enabled for an app blocking GS from location/network should not be necessary, right?

Ghost wrote earlier: "Alright, installed 1.7.1, drilled down "Connect" and now when i launch Network Info II it sees my spoofed location even with GS location spoofed."

why spoof GS when connect is ticked? as i understand with connect for lets say, flightradar enabled, GS shouldnt be spoofed

[M66B]

Flight radar comes with the Google Maps library, meaning that it should be restricted as Google Maps (GS).
Did you also kill WhatsApp after clearing data?

To be clear: if connect is ticked it should not be necessary to restrict GS.

[treare]

I killed, wiped data, wipe cache, rebooted etc etc etc. Between all critical steps. Will read about google maps in the wiki again later on but im sure that i do it correct for flightradar as i am able to spoof its location. Only not with using "connect".Op 08:15, 18 juli 2013, schreef Marcel Bokhorst:Flight radar comes with the Google Maps library, meaning that it should be restricted as Google Maps (GS).
Did you also kill WhatsApp after clearing data?

To be clear: if connect is ticked it should not be necessary to restrict GS.

—Reply to this email directly or view it on GitHub.

[M66B]

"Did you also kill WhatsApp after clearing data?": yes

[treare]

arg... second time i lose a comment here.

sorry for the unclear answers.

i killed whatsapp, cleared data and cache and rebooted to be sure.

for flightradar: i know how to spoof it, thats not the problem, but not using "connect":

if i tick "connect" for FR and do not spoof GS: FR DOES find my real location.
if i untick "connect" for FR and spoof GS: FR does NOT find my real location.

GS spoofing: network address and location + reboot after every change

[28Black]

@M66B did you mean whatsapps data or cache?

I dont wanna lose all my histories etc..

[28Black]

Btw: I have Version 1.7.1 installed. Whatsapp can no longer access on my real location:)

[M66B]

I am closing this issue now, since the discussion is getting to long and the problem for most cases seemed to be explained/fixed. Create a new issue for the apps where there is still a location leak.

[28Black]

Last question: There's anything about the fix in the newest changelog. Is this fix here still included?

[M66B]

Yes, I will add it to the changelog, I just forgot.

[28Black]

:)