Three Ways a Shared Map Can Fail

The WILD Attack is easiest to understand when the earlier findings are treated as one system rather than as separate flaws. A device observes Wi-Fi, a provider turns observations into shared state, and a later application consumes that state. The useful judgment is therefore to locate the failure in that chain: the victim's signal can be ordinary while the provider's interpretation is wrong, and the provider's policy determines whether the result is false, absent, or unstable.

The common failure is a broken chain of trust

Start with the assertion the system is trying to make: a particular BSSID belongs to a particular place. A device can genuinely observe the identifier. A provider can genuinely receive the report. Yet the relationship between the identifier and the reported coordinates can still be false. That is the common mechanism connecting the WILD Attack's remote reporting path to the provider comparison. The attack does not have to defeat every layer of the system. It has to get one unverified relationship accepted into the shared state that later lookups treat as evidence.

This reframing also clarifies why the attack is different from placing a rogue access point next to a victim. In a local spoofing scenario, the victim's device is presented with an unusual radio environment at the moment of the lookup. In the WILD scenario, the important change occurs earlier and elsewhere. Legitimate access points continue operating at the victim location, and later devices can observe them normally. The provider has nevertheless received competing accounts of where those identifiers belong and may have changed the LLT that interprets the later scan.

The attack's three broad outcomes are not unrelated vulnerabilities. They are different answers to the same provider-side question. If the provider selects one location, the record is tampered with. If it refuses to select either location, the record can be removed or withheld. If it lets every report influence an estimate, the record can shift. The underlying conflict is the same; the state transition is different.

stateDiagram-v2 [*] --> Original Original --> Conflicting: reports point to separate locations Conflicting --> Tampered: provider accepts one coordinate Conflicting --> Removed: provider rejects the conflict Conflicting --> Shifting: each report changes the estimate Tampered --> Persistent: anomalous reporting stops Removed --> Persistent: anomalous reporting stops Shifting --> Persistent: anomalous reporting stops Persistent --> Recovery: provider obtains and trusts corrective evidence Recovery --> Original: stable record restored

This is a conceptual model, not a claim that all four providers implement the same state machine. It helps identify the transition that matters. A correct record becomes contested; the provider applies a rule; the resulting state can outlive the reports that caused it. The WILD study observed versions of these paths in different providers, but its black-box experiments cannot expose every internal state or guarantee that every record follows the same route.

The model also explains why the attacker's lack of privileged access is significant. The attacker does not need to edit the LLT directly.