The Long Tail of a Poisoned Location

The WILD Attack's most consequential property is temporal. Once Google WPS, Apple WPS, A-Map, or WiGLE changes an LLT record, the false reporting can stop while the changed state remains. This chapter focuses on that lifecycle—creation, conflict, removal or tampering, persistence, and recovery—so readers can distinguish an entry that is wrong from one that is gone and avoid treating “the attacker stopped” as proof that the system healed.

From an original record to a changed one

The study uses three useful states for an access-point record. Original means the provider has a coordinate corresponding to the access point's legitimate location. Eliminated means the provider no longer has a usable entry for that BSSID. Tampered means an entry exists, but its recorded coordinates have been overwritten with falsified coordinates. WiGLE's gradual movement does not fit neatly into only those labels, so it is better understood as a changing record whose position is being pulled away from the original.

The lifecycle begins before the attack, with a record that the provider considers useful. Falsified observations then arrive from a geographically distinct location while legitimate access points continue operating at the victim site. The provider's conflict policy determines the next transition. A majority-oriented policy may require the false reports to outnumber legitimate ones. A zero-trust policy may invalidate the record instead of choosing a location. An incremental policy may move the coordinate as each new report contributes. In all three cases, the important change is in provider-owned state, not in the physical existence of the access point.

Google WPS provides the clearest example of a multi-stage path. In the study's experiments, target entries sometimes moved from the original state to an eliminated state and only later to a tampered state. The authors also observed direct movement from original to tampered for some records. They relate the difference to the confidence associated with a record: lower-confidence entries could be more susceptible to immediate replacement, while higher-confidence entries often needed to be invalidated before new coordinates were accepted.

The timing varied with the amount of legitimate reporting around the target. In the low-traffic location, after 11 days of falsified reporting, one of ten target access points had reached the tampered state and eight had been eliminated. By day 30, nine were tampered and one remained eliminated. In the medium-traffic location, eight of ten entries had shifted to an eliminated or tampered state by day 11. Even at the high-traffic location, where legitimate observations were more abundant, nine of ten entries were in one of those two changed states by day 30. The pattern is not a single countdown. It is a competition between streams of evidence whose intensity changes the path and speed of the transitions.

The difference between elimination and tampering matters beyond terminology. If an entry is eliminated, a later location query may have no Wi-Fi record to use. The device or application may fall back to GPS, cellular positioning, or a broader uncertainty estimate.