Unless you upgrade to Android Pie, a vulnerability leaves your phone trackable -- and Google won't fix it

A vulnerability in the Android operating system means that it is worryingly easy to track and locate phones. While the issue has been addressed in Android Pie, Google has no plans to patch the vulnerability in earlier versions of its mobile OS.

The vulnerability (CVE-2018-9489) was revealed in a report from Nightwatch Cybersecurity which warns that it can be used to "uniquely identify and track any Android device" and also to "geolocate users". As well as Google's own Android builds, the problem is also said to affect forked versions such as FireOS.

See also:

• If you want to record calls in Android 9 Pie, you'll need to root your phone
• Android 9 is... Android Pie! Seriously, Google?
• Google is able to track your offline purchases thanks to a secret deal with Mastercard

The vulnerability, which was first reported to Google back in March, means that it is possible for apps to bypass permissions and gain access to information that is contained in system broadcasts -- information that can be very revealing. The problem is made all the more serious thanks to the fact that the vast majority of people will never see Pie on their phones, meaning their handsets will remain vulnerable.

Describing the problem, Nightwatch Cybersecurity says:

System broadcasts by Android OS expose information about the user's device to all applications running on the device. This includes the WiFi network name, BSSID, local IP addresses, DNS server information and the MAC address. Some of this information (MAC address) is no longer available via APIs on Android 6 and higher, and extra permissions are normally required to access the rest of this information. However, by listening to these broadcasts, any application on the device can capture this information thus bypassing any permission checks and existing mitigations.

Because MAC addresses do not change and are tied to hardware, this can be used to uniquely identify and track any Android device even when MAC address randomization is used. The network name and BSSID can be used to geolocate users via a lookup against a database of BSSID such as WiGLE or SkyHook. Other networking information can be used by rogue apps to further explore and attack the local WiFi network.

It is not known whether the vulnerability has been exploited in the wild, but now it has been exposed, that risk has greatly increased. More information about the security issue can be found in the Nightwatch Cybersecurity report.

Image credit: quietbits / Shutterstock