If you think an app has to ask permission to find information about you, think again.
According to new research from Northeastern University, Android apps can track a user’s location even without access to the device’s GPS.
Guevara Noubir, a professor at Northeastern University’s College of Computer and Information Science, and a team of student researchers—Sashank Narain, Triet Vo-Huu, and Kenneth Block—set out to discover just how easy it is for an app to tap into a phone’s data by building one of their own.
The team crafted its own app—which, Noubir told the Daily Dot, could access the accelerometer, gyroscope, and compass without being granted access by the user via the typical permissions process.
The information from those sensors is uploaded to a server, where Noubir and his team host an algorithm that can sift through the data to infer a range of motion from the user. According to Noubir, the algorithm isn’t using anything proprietary; instead, it checks against OpenStreetMap, a free and collaborative public database of maps and roads.
Noubir and the researchers applied the algorithm to a variety of simulated and real road trips and tasked the system with determining the route the user took. They simulated trips in 11 major cities—including Atlanta, Berlin, London, and Rome—and drove more than 70 routes around the Boston area.
For each trip, the algorithm generated five paths that it believed to be the most likely route traveled.
Fifty percent of the time, one of the five paths generated by the algorithm was the correct route.