When Location Services Fail in the Real World
The WILD Attack matters only insofar as a changed LLT record reaches a decision made by a device or service. This chapter examines that boundary through the study's three operating conditions: missing GPS, weak GPS, and GPS-less hardware. The result is not one universal failure, but three different symptoms—unavailable location, degraded accuracy, and false precision—whose severity depends on how an application combines the sources it receives.
When GPS is weak or unavailable
A poisoned WPS result does not automatically become a device's final location. Modern systems can combine Wi-Fi, GPS, cellular positioning, and other sensors, then select or weight the sources according to their reported quality and the application's own logic. That is why the same LLT change may have little visible effect on one device and produce a consequential error on another. The WILD study's cases are useful because they hold the provider-side failure constant enough to show how the surrounding signal conditions change the outcome.
The first condition is a location where GPS is absent or unusable. The study uses Tallinn as a feasibility scenario for a large-scale attack in a GPS-denied environment. The authors discovered 262,073 BSSIDs within a 10-kilometer radius centered on the city and used their measured broadcasting capacity to estimate the hardware needed to represent that set. On their assumptions, about 5,242 low-cost units would cost roughly US$5,242. The point of the calculation is not the price tag alone. It is that the attacker would be changing a shared provider map from a chosen location, after which many devices could encounter the changed state without requiring one rogue transmitter at every victim site.
That city-scale scenario was not executed. The researchers explicitly evaluated the cost and stealth of the proposed operation rather than performing LLT subversion across Tallinn. The BSSID count and hardware arithmetic are feasibility estimates, and they depend on radio capacity, provider limits, local coverage, and the price and behavior of the equipment. The paper contrasts the estimate with traditional short-range WPS spoofing, which it calculates would require at least 40,000 continuously operating devices spread across the same zone. That comparison illustrates a change in scaling model, not a measured public outage.
The second condition is more ordinary: GPS is available but weak. Dense urban environments can obstruct satellite signals and create multipath effects, so a device may receive a GPS estimate with a broad uncertainty radius while WPS produces a tighter one. In the study's controlled ride-hailing test, GPS alone was measured at about 115 meters of accuracy and WPS at about 12 meters. Under those conditions, a location system that prefers the more precise source can give WPS practical authority even though the provider-side association has been poisoned.
The Apple and Google outcomes differed because their LLT failure modes differed. After Apple WPS removed the surrounding entries, an iOS device could no longer rely on the same Wi-Fi result. It fell back to GPS, and the estimated position was about 60 meters from the user's actual position with an uncertainty radius of roughly 100 meters. In a dense city, that difference can span several blocks and make an automatically chosen pickup point inconvenient or ambiguous.