Could someone be tracking you as you drive around your city or town?
You may think turning off your smartphone’s location will prevent this, but researchers from Northeastern University in Boston found that isn’t always the case.
“Not a lot of people are aware of this problem. Mainly because when we think about location, we associate it with the GPS on the phone,” said Sashank Narain a postdoctoral researcher at Northeastern.
In a test, Narain and his team were able to track people driving through Boston, Waltham, Massachusetts, and London. Traditional locators, like GPS were turned off — so the researchers used other sensors.
“The goal of our project is to make people aware that vulnerabilities such as these exist, and they should be taken care of,” Narain added.
Guevara Noubir, a professor at Northeastern University who was involved in the research and also directs Northeastern’s Cybersecurity & Information Assurance Graduate Program, told CNBC that “there’s a whole area, what's called the side channel attacks, where you use side information to infer something that can have an impact on security,” and specifically, privacy.
‘Best spying device’
Using Android phones running Google’s operating system, the researchers did the tracking using sensors in smartphones that were not designed to track location. Those tools included an accelerometer, which tracks how fast a phone is moving, a magnetometer, which works like a digital compass, and a gyroscope, which tracks rotation.
These sensors are responsible for things like changing the screen orientation from horizontal to vertical when the phone is moved.
“People don't really realize that their mobile phone, with access to all these sensors, is, in some sense, potentially like the best spying device you can imagine…” Noubir said.
In order to track the test subjects, the researchers had them download what seemed to be a flash light app — but actually was gathering sensor data.
“You need to have an app installed on the phone, but once that is done, all the other processes… [are] automatic,” Narain said.
Right now, the techniques used by the researchers work best in certain cities.
“In a place like Boston, which has a lot of unique turns and very curvy roads, you can get an accuracy of up to 50 percent of guessing the user's location in the top five search results. In case of a place like Manhattan, which is mostly grid-like, it's much more difficult,” Narain said.
The ability to track gets easier with more information.
“If you were to travel the same path every day, we have extremely high probability to guess where you live, where you work and what trajectories you took. Extremely high meaning that on repeated paths more than 90 percent,” Noubir said.
The researchers were surprised by the results and expect more accuracy over time.
“We were not honestly expecting such high accuracies,” he said. “As the sophistication of these sensors on smartphones improve, as they become more and more accurate, this may become a primary means of invading users' privacy.”
Although Northeastern used Android phones, Noubir said the hack “applies also to iPhones, because they have similar kind of permissions for the sensors and so on.”
In a statement to CNBC, a Google spokesperson said that Android P, its latest operating system, “restricts access to sensors such as accelerometers and gyroscopes. Smartphone sensors do not directly provide user location data, and this research highlights just how difficult it would be to use these sensors for location tracking.”
Apple declined to comment to CNBC.
To protect yourself, users should only download apps from Google and Apple’s official stores. Also, make sure your operating system is up to date.
On the Money airs on CNBC Saturday at 5:30 am ET, or check listings for air times in local markets.