Pixel 8 phone blocks secret location tracking by SMS triggers
SMS-delivered network-initiated SUPL on Pixel 8: a privacy assessment
Cryptography and SecurityNetworking and Internet Architecture
Summary
Some messages sent to phones can start a location check without the user knowing. The authors checked if this happens on the Pixel 8 phone, which uses certain chips for GPS and communication. They found the phone does not send its location or ID to a bad server when it gets this kind of message without permission. This means the Pixel 8 is safe from this type of secret tracking.
What this means in practice
- •For mobile device security teams: Ensure device configurations prevent unauthorized location reports triggered by SMS messages in handset deployments.
- •For mobile network operators: Verify that network-initiated location requests do not leak subscriber location or identity to unintended servers on supported devices.
Authors
Douglas Leith
Abstract
A SUPL\_INIT message is a network-initiated trigger that can be sent to a handset using an SMS to unilaterally start a location session: on receipt, the handset is instructed to determine its own position and report it, together with an identifier such as its IMSI, to a server specified in the message, without any action by the phone's user. The concern motivating this investigation is whether such a message could be used to silently exfiltrate a handset's location and subscriber identity to a server under an attacker's control. We investigated this on a Google Pixel 8 handset, which uses a Samsung Exynos modem and a Broadcom GPS/GNSS subsystem. We find no privacy issue: the handset never sends location data to an attacker-chosen server as a result of an unsolicited SUPL\_INIT delivered by SMS.