MITRE ATT&CKtechnique

T1430 Location Tracking

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection, Discovery
Platforms
Android, iOS
Version
1.2
Created
2017-10-25

Description

Adversaries may track a device’s physical location through use of standard operating system APIs via malicious or exploited applications on the compromised device. On Android, applications holding the `ACCESS_COAURSE_LOCATION` or `ACCESS_FINE_LOCATION` permissions provide access to the device’s physical location. On Android 10 and up, declaration of the `ACCESS_BACKGROUND_LOCATION` permission in an application’s manifest will allow applications to request location access even when the application is running in the background. Some adversaries have utilized integration of Baidu map services to retrieve geographical location once the location access permissions had been obtained. On iOS, applications must include the `NSLocationWhenInUseUsageDescription`, `NSLocationAlwaysAndWhenInUseUsageDescription`, and/or `NSLocationAlwaysUsageDescription` keys in their `Info.plist` file depending on the extent of requested access to location information. On iOS 8.0 and up, applications call `requestWhenInUseAuthorization()` to request access to location information when the application is in use or `requestAlwaysAuthorization()` to request access to location information regardless of whether the application is in use. With elevated privileges, an adversary may be able to access location data without explicit user consent with the `com.apple.locationd.preauthorized` entitlement key.

Related

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1011 User Guidance mitigation
  • M1006 Use Recent OS Version mitigation
  • M1012 Enterprise Policy mitigation
  • M1014 Interconnection Filtering mitigation

Referenced by MITRE ATT&CK · subtechnique of (2)

  • T1430.001 Remote Device Management Services sub-technique
  • T1430.002 Impersonate SS7 Nodes sub-technique

Referenced by MITRE ATT&CK · uses (60)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S1243 DCHSpy software (malware)
  • S1241 RatMilad software (malware)
  • C0054 Operation Triangulation campaign
  • S1216 TriangleDB software (malware)
  • S1185 LightSpy software (malware)
  • S1128 HilalRAT software (malware)
  • C0033 C0033 campaign
  • S1195 SpyC23 software (malware)
  • S1094 BRATA software (malware)
  • S1095 AhRat software (malware)
  • S1092 Escobar software (malware)
  • S1093 FlyTrap software (malware)
  • S1083 Chameleon software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S1069 TangleBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S0655 BusyGasper software (malware)
  • S0577 FrozenCell software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0555 CHEMISTGAMES software (malware)
  • S0549 SilkBean software (malware)
  • S0551 GoldenEagle software (malware)
  • S0544 HenBox software (malware)
  • S0536 GPlayed software (malware)
  • S0535 Golden Cup software (malware)
Show all 60 ›

References