Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

AndroCon: Conning Location Services in Android

Soham Nag, Smruti R. Sarangi

TL;DR

AndroCon demonstrates that semi-processed GPS data, available to Android apps with location permissions, can serve as a powerful covert ambient-sensing channel. By preprocessing with an Unscented Kalman Filter, reducing features with Linear Discriminant Analysis, and applying six ML classifiers to fused GPS parameters, the approach achieves ambient-class accuracies above 90% across diverse settings and HAR accuracies up to 87%, with indoor-floor layout estimation errors typically under 4 meters. The study encompasses year-long, large-area data collection from multiple devices and real-world environments, supplemented by synthetic datasets, confirming robustness and cross-device generalizability. These findings reveal a substantial privacy risk: even when devices are in flight mode and other sensors are disabled, adversaries can infer ambience, activities, and indoor layouts, underscoring the need for privacy-aware design and stricter data-access disclosures. AndroCon thus provides a comprehensive, end-to-end demonstration of GPS-based covert sensing, highlighting practical implications for Android permissions, defense strategies, and future research on mitigating semi-processed GNSS leakage.

Abstract

Mobile device hackers often target ambient sensing, human activity identification, and interior floor mapping. In addition to overt signals like microphones and cameras, covert channels like WiFi, Bluetooth, and augmented GPS signal strengths have been employed to gather this information. Until date, passive, receive-only satellite GPS sensing relied solely on signal strength and location information. This paper demonstrates that semi-processed GPS data (39 features) accessible to apps since Android 7 with precise location permissions can be used as a highly accurate leaky channel for sensing ambient, recognising human activity, and mapping indoor spaces (99%+ accuracy). This report describes a longitudinal research that used semi-processed GPS readings from mobile devices throughout a 40,000 sq. km region for a year. Data was acquired from aeroplanes, cruise ships, and high-altitude places. To retain crucial information, we analyse all satellite GPS signals and select the best characteristics using cross-correlation analysis. Our work, AndroCon, combines lin-ear discriminant analysis, unscented Kalman filtering, gradient boosting, and random forest learning to provide an accurate ambient and human activity sensor. At AndroCon, basic ML algorithms are used for discreet and somewhat explainable outcomes. We can readily recognise challenging situations, such as being in a subway, when someone is waving a hand in front of a mobile device, in front of a stairway, or with others present (not always carrying phones). This is the most extensive study on satellite GPS-based sensing as of yet.

AndroCon: Conning Location Services in Android

TL;DR

AndroCon demonstrates that semi-processed GPS data, available to Android apps with location permissions, can serve as a powerful covert ambient-sensing channel. By preprocessing with an Unscented Kalman Filter, reducing features with Linear Discriminant Analysis, and applying six ML classifiers to fused GPS parameters, the approach achieves ambient-class accuracies above 90% across diverse settings and HAR accuracies up to 87%, with indoor-floor layout estimation errors typically under 4 meters. The study encompasses year-long, large-area data collection from multiple devices and real-world environments, supplemented by synthetic datasets, confirming robustness and cross-device generalizability. These findings reveal a substantial privacy risk: even when devices are in flight mode and other sensors are disabled, adversaries can infer ambience, activities, and indoor layouts, underscoring the need for privacy-aware design and stricter data-access disclosures. AndroCon thus provides a comprehensive, end-to-end demonstration of GPS-based covert sensing, highlighting practical implications for Android permissions, defense strategies, and future research on mitigating semi-processed GNSS leakage.

Abstract

Mobile device hackers often target ambient sensing, human activity identification, and interior floor mapping. In addition to overt signals like microphones and cameras, covert channels like WiFi, Bluetooth, and augmented GPS signal strengths have been employed to gather this information. Until date, passive, receive-only satellite GPS sensing relied solely on signal strength and location information. This paper demonstrates that semi-processed GPS data (39 features) accessible to apps since Android 7 with precise location permissions can be used as a highly accurate leaky channel for sensing ambient, recognising human activity, and mapping indoor spaces (99%+ accuracy). This report describes a longitudinal research that used semi-processed GPS readings from mobile devices throughout a 40,000 sq. km region for a year. Data was acquired from aeroplanes, cruise ships, and high-altitude places. To retain crucial information, we analyse all satellite GPS signals and select the best characteristics using cross-correlation analysis. Our work, AndroCon, combines lin-ear discriminant analysis, unscented Kalman filtering, gradient boosting, and random forest learning to provide an accurate ambient and human activity sensor. At AndroCon, basic ML algorithms are used for discreet and somewhat explainable outcomes. We can readily recognise challenging situations, such as being in a subway, when someone is waving a hand in front of a mobile device, in front of a stairway, or with others present (not always carrying phones). This is the most extensive study on satellite GPS-based sensing as of yet.
Paper Structure (58 sections, 20 equations, 18 figures, 8 tables)

This paper contains 58 sections, 20 equations, 18 figures, 8 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Overview of GPS
  4. GPS pipeline
  5. Location Accuracy Permissions in Android
  6. Linear Discriminant Analysis (LDA)
  7. Unscented Kalman Filter
  8. The Value of Semi-processed GPS Data
  9. Accessing Semi-Processed GPS Measurements
  10. Information Present in Semi-Processed GPS Measurements
  11. Empirical study of the semi-processed GPS signal characteristics
  12. Real-World Data Collection
  13. Datasets: Synthetic (Kaggle) and Real-World
  14. Calibration with Real Sensors: Signal Power
  15. Correlation Results across the GPS Parameters: Feature Selection and LDA
  16. ...and 43 more sections

Figures (18)

  • Figure 1: GPS pipeline: From signal acquisition to position calculation
  • Figure 2: Representation of the semi-processed GPS signal parameters that we use. RSS is "Received Signal Strength"
  • Figure 3: Correlation between Agc and RSS
  • Figure 4: Correlation of various semi-processed GPS parameters
  • Figure 5: Flow diagram of our ML model
  • ...and 13 more figures