Repairing Trust in the Location Lookup Table
The WILD Attack answers the opening question in a precise way: Wi-Fi geolocation can be poisoned remotely when a provider treats crowd-sourced observations as durable location state without adequately proving their provenance, independence, or consistency. The final design question is not whether to keep using Wi-Fi landmarks, but how Google WPS, Apple WPS, A-Map, and WiGLE can preserve their usefulness without turning a precise calculation into a false claim. That requires judging the whole lifecycle—from what an interface reveals to how a provider recovers a record after conflict.
Why the remote failure is possible
A later device does not need to receive a rogue signal for its WPS result to be wrong. The critical change can happen earlier, at a different location, when a genuine device carries a falsified observation through an ordinary crowd-sourcing path. The provider then decides how that observation relates to legitimate reports for the same BSSID and stores a current interpretation in the LLT. When a victim later scans local access points, the radio observation may be entirely ordinary; the provider-side meaning attached to that observation is what has changed.
That chain explains the WILD Attack's reach without requiring a claim that every WPS request is vulnerable. The study's threat model assumes a non-privileged attacker, legitimate access points that remain active at the victim site, and existing provider records for those access points. The attacker must know enough target identifiers to influence the records that matter, must cause observations of those identifiers to enter the reporting path from another location, and must encounter a provider policy that gives the conflicting stream some influence. The provider does not have to be breached, and the victim's device does not have to be controlled.
The study reports that all four investigated providers accepted falsified reports well enough to create records in controlled tests. That finding matters because it establishes the ingestion weakness before any provider comparison begins. The observation reached the system through a genuine device and a normal collection workflow, yet the provider did not reliably establish that the reported BSSID was physically present at the reported coordinates. The falsification was semantic: the identifier, the radio environment, the device location, and the claimed stationary access point did not describe one consistent fact.
What happened next depended on the provider's interpretation of conflict. Google WPS favored the location with the larger number of competing reports. Apple WPS and A-Map, as inferred from the study's outputs, refused to trust geographically conflicting reports and removed or withheld entries. WiGLE let successive reports pull an existing coordinate toward a new location. These are not merely different database implementations. They are different answers to the question of what a user should receive when the provider cannot reconcile its evidence.
The resulting failure can be silent, visible, or ambiguous. A tampered entry may preserve a small-looking uncertainty radius and keep an application running in the wrong place. A removed entry may force a less precise GPS or cellular fallback or leave the device without a WPS answer. A shifting entry may make the location drift in a way that resembles ordinary movement. The WILD study's downstream cases show that the application matters: a weak-GPS ride-hailing workflow can prioritize a more precise but false WPS result, while a GPS-less desktop can pass a poisoned location into local search and advertising.
Persistence completes the causal chain. Google records in the study did not fully recover in four weeks after falsified reporting ceased. Apple entries remained absent for at least two months, A-Map's observed effects lasted 13–19 days, and WiGLE records still remained near the false location after nine weeks in the reported medium-traffic test. Those windows do not prove permanence, but they do disprove the assumption that stopping anomalous input automatically restores the earlier map. A provider-side state change can outlive the activity that caused it.
The attack is therefore best understood as a failure of shared-state integrity.