Tracking Firm Location Smart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site
Summary: LocationSmart, a U.S. aggregator of real-time mobile location data, left an unauthenticated API on its demo page that KrebsOnSecurity verified could reveal the location of any AT&T, Sprint, T-Mobile or Verizon phone in the U.S. to within a few hundred yards, and the company took the service offline only after being contacted. Carnegie Mellon researcher Robert Xiao found the flaw, tracked a friend's directional movement over a few minutes, and located five consenting KrebsOnSecurity sources within seconds, with results ranging from about 100 yards to 1.5 miles of their actual positions.
Why it matters: A third-party aggregator holding location data on customers of all four major U.S. carriers exposed it through a demo page that required no password, and the carriers would not confirm or deny a business relationship with the firm even as it displayed their logos. The same intermediary, per Senator Ron Wyden's letter, supplied Securus with real-time AT&T customer location data that Securus shared with government clients without verifying the court documents it required.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026