Location leaking
daniellge opened this issue · comments
every app is getting a spoofed location besides seesmic. I've disabled all location services and added various cities to the xpiracy location field. anyone else experiencing this problem?
Can you please post a link to the app, so I can look into it?
when you select "attach loocation" on a new tweet it will post your real location instead if the spoofed one.
I have just tested and for me the location is 'Christmass Island'.
Could you please post a logcat like this:
- Power off your device
- run 'adb logcat | grep XPrivacy' on the command line
- Power on your device
I like to see at least all messages with '... hooked ...'
Still getting the same errors, now it won't spoof the location of maps? Anyway I can send you my log file?
Yes, please send me a log file.
Do you get an alert saying 'Incompatible ...' when you start XPrivacy?
Did you flash the Xposed fix?
Was there a ROM update after you have flashed the Xposed fix?
Location didn't leak for me using the app Network info II, but Wifi SSID does.
Seems the app uses the hidden function getWifiApConfiguration inside the WifiManager
I have flashed the xposed fix, i know for a fact its working because spoofing gps on gmaps does not work with out it.
Could somebody try with this version? http://d-h.st/nST
At least leaking the SSID should be fixed and maybe the location leak too.
ok ill grab it
Also try to flash the Xposed fix again, it is the most logical explanation for the location leak.
@vipere decompiled Network Info II, thanks!
getLastKnownLocation and requestLocationUpdates are used to get the location, which are both hooked by XPrivacy. In the one log I got I see requestLocationUpdates, but no getLastKnownLocation.
If the previous test version still doesn't restrict the location, then please try this version: http://d-h.st/Noc
SSID leak is fixed. The issue with location in network info II is still there, its not grabbing my spoofed location like it used to. Still did not fix the issue of network info saying location was unavailable.
SO then i decided to give network info all perms back. everything in it got proper info BUT location info. so then i uninstalled network info II. reinstalled. STILL could not get the spoofed location to work. then i exported my xprivacy data, wiped xprivacys cache and data. rebooted re-imported xprivacy's settings checked that network info II worked and it did and now location was proper. so then i went into xprivacy limited the perms on network info II the exact same way i had before when location was not working. and BAM its picking up my spoofed location now.
I have no idea what going on. i tried to grep for xprivacy touching network info when it was all buggered up but i gave it all perms back, and didn't see a single thing.
Could you please send me your exported XPrivacy settings?
sure ill email them
email has been sent
Hi,
This morning i updated my rom, flashed the fix and installed the second testversion. The problem remains thesame in wechat
Did anybody try the second test version from above?
well, i did.
I tested it as well that's what my above report was based on that you asked for my settings XML from
@GhostlyCrowd thanks for your exported settings.
The strange thing there is no trace of Network Info II in the export file.
It is unlikely that there is something wrong with the settings, else there would have been massive other problems.
I have no idea how this is caused.
Did you update Network Info II recently?
Could everybody report which Android version / ROM / device is being used, to see if there is a system in it.
Device: Samsung SGH-I747M
ROM: CM nightly updated daily.
Android Version: 4.2.2
xposed Version: 2.1.4
xposed Fix Version: 4.2
Samsung Galaxy SIII (GT-I9300), Vanilla rootbox nightly 4.2.2, Fix 4.2
Sony Ericsson Xperia Z (C6603 Yuga), Pacman 4.2.2, Fix 4.2
"CM nightly updated daily": do you also flash the Xposed fix daily?
(sorry if this is a stupid question for you, but it is one of the possible causes)
Yep, here is my update process
I download the nightly, back up my apps with titanium just in case.
Install the Rom and reboot.
Install xposed with the installer and reboot to recovery.
Install the xposed fix V4.2 and reboot
Boot into CM fully, then reboot one last time to make sure exposed has a chance to load all modules with the new fix.
Use CM
Are you able to enable debugging on a special build for us who are having issues with apps after we give permissions back and either have to reinstall the app and/or clear xprivacys data?
Another user who reported the ingress issues is having the exact same issues where when he gives perms back something is still not right and he had ot uninstall and reinstall. Which is the same scenario we/i has with all in one tool box and network info II something must be happening that is not logging.
Given the one log I got, I can tell getLastKnownLocation is hooked by XPrivacy, but calls to it are not intercepted.
(there is enough logging to cover 99% of the problems)
You could try to grep on getLastKnownLocation to get more insight.
This could be a bug in the Xposed framework.
Network Info II does call both getLastKnownLocation and requestLocationUpdates, but seems to get the location from the first one. The second one is also covered by XPrivacy.
i gave whatsapp another try. blocked nothing except for location. for a second it uses the fake location (2 seconds or so) and then goes to my actual location.
EDIT: i killed whatsapp after this test, didn't touch anything in xprivacy and waited for a minute. strangely enough NO fake location anymore but instantly the actual location
Hi,
First of all: let me know if the info i post is not helpfull. i don't wanna spam.
i played with wechat again. i disabled blockings in location one by one untill the app could find my real location. If i block location functions again it keeps on finding my real location. (i waited long enough for the caching thing)
This probably means wechat is caching the location itself.
This is not something XPrivacy can prevent.
Just thinking: wechat caching locations is consistent with not calling getLastKnowLocation.
it doesn't need getlastknownlocation it seems
So even though xprivacy is hooking to getLastKnownLocation its not intercepting them. Can you fix this some how?
In regards to issue #278 that has been categorized as a dupe of this issue
I dont actually have country code mcc and mnc leaking in Network Info II on my device. it is defaced or spoofed properly. I just still have the weird location issue with it.
something funny is afoot
v 1.7 now prevents leaking the location in MyBestBrands and Facebook.
But Whatsapp still gets my real location (network based), and can even use all sensors :/
Xposed fix is properly installed ;) And I don't get any "Incompatible..." warning...
@GhostlyCrowd what is "the weird location issue" ?
@28Black isn't the Whatsapp location not a location acquired based on external IP?
in Network Info II my location is perfectly veiled ;)
@M66B I'm not pretty sure about that :/ but maybe you're right. That would be a shame because I do not see how you could prevent it properly.
whatsapp knows my location to the exact street number (while blocked ofcourse). can this be done by external IP?
@treare no it is at most accurate to a city
Please check if all the functions in the location category for the application are restricted.
Go to the XPrivacy application settings and drill down the location category and make sure there is a check everywhere.
@ M66B The weird location issue is the fact that xprivacy will spoof the location data in Network Info II only once, after that it always shows as "Not Available"
It used to actually work.
it used to report
for example
provider: network
location: spoofed location
Fix time: however long it took to gather the spoofed location
AH i have figured it out, If i have google services location spoofed. Network info II is unable to use spoofed location. If i dont spoof google services and just spoof network info II it does get the spoofed location, instead of "Not available"
Whats happening here? even if i have GS spoofed and network info uses it for location. it should report the spoofed location since google services should be seeing the spoofed location.
Edit: just went back and rechecked all of GS's location check boxes to block location again, and network info II still works what the hell is going on here?????
Edit2: and then i reboot and Network Info II reports "not available" for all location stuff again.
I think it must be using Google services., since i have google services spoofed it SHOULD be reporting the spoofed location, but instead its malfunctioning?
tried another app. flight radar. i blocked everything except for internet (also the dangerous ones, /proc etc etc etc). also this app is perfectly able to find my location. (even after a reboot, clearing data and clearing cache etc)!
@M66B Of course I have set the hooks everywhere! The location is completely restricted. I have also deleted the cache and restarted.
Try blocking Google play services location see what happens.
I just verified that with google play services location "spoofed" with xprivacy Network info II gets "Not avalable" as my location instead of reporting the spoofed location like i want it to. With google services not location spoofed, Network Info II gets my spoofed location properly.
The reason why i was loosing it on reboot was because the spoofing of location on google play services became active on reboot, since i didnt force close it before.
@GhostlyCrowd If I block it, the location is no longer that exactly! :)
But it is still my real location!
;) :(
EUREKA!
i was able to spoof location for whatsapp and flightradar! ixcept for blocking location for these apps i also blocked location AND network for google services!!! please try and confirm.
BUT:
- wechat was still not working in this way.
- what is the hardest thing that can happen with spoofing location and network for GS? a banned google account? I once had an error when i was roaming. so i guess being on the other side of the world in 5 minutes wont look ok to them :(
We are getting somewhere.
WhatsApp is using Google Play services to get a location.
If I fully restrict Google Play services (the category + all functions), clear data, force stop, WhatsApp will find me on Christmass Island.
Please report for the other apps (not WhatsApp) if this helps too.
ok so can we block apps/hook on to them so they dont prod google play services for location? and instead use our preferred spoofed/blocked data in xprivacy
wierd thing with wechat:
before i told you:
-if location not blocked it finds correct location.
-if location blocked it finds nothing.
now... i blocked GS location and network but not in wechat. it again finds nothing. so also here GS is involved i think
or at the very least have google play services report our spoofed data to the app. right now it doesnt seem to be respecting its restriction by xprivacy and is returning correct data or no data at all in my case for network info II
Yes, I will make this easier in the next release, so this can be done per app.
@treare, yes my exact same issue if i block GS, then apps that use it for location return nothing. GS is not respecting the blocking/spoofing of location.
About the "weird issue", it depends on the method the application gets a location if a spoofed location can be returned.
@M66B, the weird thing about it now is, if i spoof location in network info II and not GS, then the location in network info II shows the correct spoofed location, "i spoofed it to a town 30 minutes away"
If i spoof location on network info II and GS's then network info II returns "not available"
weird eh
@GhostlyCrowd: well, what you wrote is what i did, and it did work for me it seems. but not for wechat. flightradar and whatsapp need GS and the location shown was indeed the one i entered in xprivacy settings.
we're all testing on version 1.7 correct? letsm ake sure we're on the same version
Here 1.7+ ;-)
1.7
@M66B I've noticed that if you block location on GS, then reboot. do a full reboot thats when i get the location "weirdness" where it reports as not available in network info II thats how i reproduce it every time.
I just tried clearing the data and force closing GS with the location blocked and same result. "Not available" in network info II
Just as a fyi.
The real weird part is, if i dont spoof location on GS network info II shows my spoofed location.
@GhostlyCrowd this cannot be prevented, it is not possible to spoof the location in all cases, so it depends on the method(s) the application is using for spoofing to work. Some applications use multiple methods and grab the location that comes first.
@M66B
Ah, well why isnt GS returing the spoofed location since thats what its fed ?
if an app uses GS network/location:
can it be that users blocks "something" for this app so that it cannot ask GS for the location?
@treare Already working on that ;-)
Thanks. Still i have doubts about what i wrote earlier. I think wechat has nothing much to do with GS after all. What bothers me most is that wechat is the only app that only triggers the gps icon when its location is not blocked. All other apps ive tried, i think 5 or 6, get the gps icon, blocked or not. Even whatsapp and flightradarOp 21:18, 17 juli 2013, schreef Marcel Bokhorst:@treare Already working on that ;-)
—Reply to this email directly or view it on GitHub.
XPrivacy doesn't block the GPS, it only spoof the location or returns an empty location.
So the GPS icon will appear as normal.
Well... you told me that before but thats exactly the problem with wechat. If i block location and i enter location feature in wechat the icon is not shown. In other apps if i block location and ask for the location the icon is shown like you say (but location is spoofed ofcourse)Op 21:29, 17 juli 2013, schreef Marcel Bokhorst:XPrivacy doesn't block the GPS, it only spoof the location or returns an empty location.
So the GPS icon will appear as normal.
—Reply to this email directly or view it on GitHub.
If the gps icon is not shown then it means wechat must be probing something else besides the actual gps hardware for location. maybe GS or something. that icon only shows up when something probes the actual hardware so ive been told.
@GhostlyCrowd: i tested with GS which makes no difference. But as said before: the icon is there if i dont block location. Its not there if location is blocked. Wechat is the only app that doesnt turn on the icon when location is blocked.Op 21:42, 17 juli 2013, schreef GhostlyCrowd:If the gps icon is not shown then it means wechat must be probing something else besides the actual gps hardware for location. maybe GS or something. that icon only shows up when something probes the actual hardware so ive been told.
—Reply to this email directly or view it on GitHub.
Test version 1.7.1: http://d-h.st/0of
Install, wait until XPrivacy notifies 'Reboot required'
Drill down category location and check 'connect'
This will prevent the application from connecting to Google Play services.
Reboot is still required to make it work ...
Installed 1.7.1 like you described and tested it with flightradar. Afterwards with whatsapp. GS has nothing blocked. The 2 apps could find my correct location. I think "connect" doesnt work.Op 21:55, 17 juli 2013, schreef Marcel Bokhorst:Reboot is still required to make it work ...
—Reply to this email directly or view it on GitHub.
Whatsapp caches the location itself. Clearing data helps.
Ok wiped whatsapp completely. I have set moscow as location. Whatsapp thinks im somewhere in san fransisco now. Flightradar stayed thesame. It finds my coorect location. Everything blocked for flightradar (also connect) except for internet. Some more tests in the morning.Op 22:07, 17 juli 2013, schreef Marcel Bokhorst:Whatsapp caches the location itself. Clearing data helps.
—Reply to this email directly or view it on GitHub.
@M66B Alright, installed 1.7.1, drilled down "Connect" and now when i launch Network Info II it sees my spoofed location even with GS location spoofed.looks like you have solved the leak in this aspect. I will test whats app now with the others. As well as Flight Radar.
Flightradar is using Google maps, see the wiki for how to restrict Google Maps.
Speaking about the wiki, could you please document in the wiki what we have found out here?
Am I correct we have an explanation/fix for all leaks now?
@treare Whatsapp is in fact seeing my gps location as spoofed, it just doesn't auto move the map to that location instead it is sitting on the default map area that whats app has in San Fransisco but if i zoom out i can see my blue gps marker and when i zoom in its indeed my spoofed location. Flight radar is also showing my proper spoofed location. i have Connect drilled down on both these apps as well as the rest of the location stuff
good stuff! @M66B
Hi again,
Here's what i did. This morning i wiped whatsapp's data. blocked everything in location and in netword adressess for whatsapp. connect ofcourse also. i did NOT block GS as i assume it cannot be reached by whatsapp. instead of using wifi at home i started driving. it finds my correct location. this could not have been cached.
Flightradar: it uses google maps? i don't have that installed. also here:
- a phone without sim connected to unknow wifi point
- location and network address fully blocked including "connect", it finds my correct location
- enable GS network and location blocking and wait for a while
- FR shows the spoofed location (with connect still blocked for FR!!!)
- remove blocking for GS and wait for a while
- FR shows my correct location
it's clear to me that "connect" does something but that it's not fully working or am i missing something?
with "connect" enabled for an app blocking GS from location/network should not be necessary, right?
Ghost wrote earlier: "Alright, installed 1.7.1, drilled down "Connect" and now when i launch Network Info II it sees my spoofed location even with GS location spoofed."
why spoof GS when connect is ticked? as i understand with connect for lets say, flightradar enabled, GS shouldnt be spoofed
Flight radar comes with the Google Maps library, meaning that it should be restricted as Google Maps (GS).
Did you also kill WhatsApp after clearing data?
To be clear: if connect is ticked it should not be necessary to restrict GS.
I killed, wiped data, wipe cache, rebooted etc etc etc. Between all critical steps. Will read about google maps in the wiki again later on but im sure that i do it correct for flightradar as i am able to spoof its location. Only not with using "connect".Op 08:15, 18 juli 2013, schreef Marcel Bokhorst:Flight radar comes with the Google Maps library, meaning that it should be restricted as Google Maps (GS).
Did you also kill WhatsApp after clearing data?
To be clear: if connect is ticked it should not be necessary to restrict GS.
—Reply to this email directly or view it on GitHub.
"Did you also kill WhatsApp after clearing data?": yes
arg... second time i lose a comment here.
sorry for the unclear answers.
i killed whatsapp, cleared data and cache and rebooted to be sure.
for flightradar: i know how to spoof it, thats not the problem, but not using "connect":
if i tick "connect" for FR and do not spoof GS: FR DOES find my real location.
if i untick "connect" for FR and spoof GS: FR does NOT find my real location.
GS spoofing: network address and location + reboot after every change
@M66B did you mean whatsapps data or cache?
I dont wanna lose all my histories etc..
Btw: I have Version 1.7.1 installed. Whatsapp can no longer access on my real location:)
I am closing this issue now, since the discussion is getting to long and the problem for most cases seemed to be explained/fixed. Create a new issue for the apps where there is still a location leak.
Last question: There's anything about the fix in the newest changelog. Is this fix here still included?
Yes, I will add it to the changelog, I just forgot.
:)