Finding the Identifiers That Matter

The WILD Attack has an information prerequisite that is easy to overlook: changing one LLT entry may not change a device's final location if enough correct access points remain around it. The specific question here is how the study evaluates remote knowledge of a target neighborhood without relying on a physical visit. The answer is an observed information leak in a geolocation interface, combined with measured but incomplete coverage; it is evidence about exposure and scale, not a universal promise of remote discovery.

Why coverage is part of the attack surface

A BSSID is more than a label in this setting. It is the key that links a live Wi-Fi observation to a provider's stored coordinate. If a device sees several nearby access points, the provider can use the whole set to estimate a location. That creates a coverage requirement for an attacker who wants to influence the result: altering one record may be insufficient if the remaining correct records still point toward the victim's real location and dominate the lookup.

The study therefore treats the surrounding BSSID set as a target environment. The authors selected access points already represented in the providers' location databases and compared the identifiers found through remote discovery with a physical scan of each site. They were not trying to learn every radio signal in the world. They were trying to learn the subset that already mattered to WPS localization. That distinction keeps the discovery problem tied to the LLT: an identifier absent from the provider's records may be interesting for wireless mapping, but it is not necessarily useful for changing that provider's location answer.

The remote path evaluated by the researchers relies on a behavior they observed in the Apple Geolocation API. When queried with one BSSID, the interface returned nearby BSSIDs and their coordinates, sometimes reaching roughly 300 meters from the queried access point rather than stopping at the immediate vicinity. In information-flow terms, a query about one known landmark could reveal part of the surrounding graph of landmarks. A starting identifier could therefore become a way to learn about neighboring provider state.

This behavior was not documented on the Apple privacy page supplied with the study. The paper says that Apple's geolocation interface was not officially exposed and that earlier research had reverse-engineered its use. The neighboring-record behavior is consequently a research observation, not a public Apple guarantee. That source boundary matters: the result is important precisely because it exposes a possible interface-level weakness, but its availability, response format, and coverage may change without the official privacy documentation becoming inaccurate.

The study names its conceptual approach Hop-by-Hop Expansion. Starting with one known access point, the process uses newly revealed nearby identifiers to extend knowledge toward a target area. The important idea is not the mechanics of a search routine; it is that the API exposes enough adjacency information for the attacker to move through the provider's map without standing at every intermediate location. Each newly learned identifier can serve as another view of the surrounding area, and the geographic coordinates provide a way to judge whether the expansion is moving closer to the target.

That expansion resembles exploring a graph whose nodes are BSSIDs and whose spatial positions are supplied by the provider.