Overview
The WILD Attack shows how falsified observations from genuine devices can poison the shared BSSID-to-coordinate records used by Google WPS, Apple WPS, A-Map, and WiGLE. The series follows the path from radio observation through provider ingestion, conflict handling, persistence, remote identifier discovery, and downstream impact. Controlled black-box tests found provider-specific tampering, removal, or shifting—not proof of a universal outage—so resilient systems need provenance, independence, cautious arbitration, safe consumption, and deliberate recovery.
Learning outcomes
- WILD Attack targets provider-side BSSID-to-coordinate state, not only the victim's live radio environment.
- Controlled tests found falsified observations entered all four studied providers, but the evidence is provider-specific and not a public-outage report.
- The study inferred different policies: majority-wins for Google, zero-trust for Apple and A-Map, and incremental updates for WiGLE.
- Stopping falsified reports does not promptly restore the map; recovery needs trusted corrective evidence.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What does the WILD Attack target?
It targets provider-side BSSID-to-coordinate records in a shared Wi-Fi location map, rather than only the victim's local radio signals.
How can a false Wi-Fi observation enter a provider's map?
It can enter when a genuine device uses an ordinary collection path to report an engineered BSSID observation that the provider accepts without reliably proving the identifier's physical presence at the reported coordinates.
How do Google WPS, Apple WPS, A-Map, and WiGLE respond to conflicting reports?
In the study, Google favored the larger report count, Apple and A-Map removed or withheld conflicting entries, and WiGLE let successive reports shift coordinates.
Does stopping falsified reports restore Wi-Fi location?
Not promptly in the study: changed records persisted across measured follow-up windows, so recovery required more than simply ending the falsified input.