Most mobile devices today include ability to locate themselves on the Earth’s surface by using the Global Positioning System (GPS), a system originally developed and currently maintained by the US military. There are also some attacks that allow the device to be crashed and those have been fixed by both Qualcomm and Google. While HTTPS and digitally-signed files are both available, they are newer and not widely used yet. This can allow a network-level attacker to mount a MITM attack and modify the data while in transit.
Additionally many of these files do not provide a digital signature to ensure that data was not tampered in transit. Assisted GPS/GNSS data provided by Qualcomm for compatible receivers is often being served over HTTP without SSL.
0 kommentar(er)
