Is it difficult to intercept & spoof skyhook location requests with corrected mifi GPS data?

Question

Apple's WiFi-only iPad uses location services provided by SkyHook to determine your location for Maps, and such. I frequently use my iPad with a Sprint Overdrive device, which has GPS built in. I'm wondering if anyone has put much thought into an intermediary daemon that will look for outbound requests for SkyHook and reply with updated/correct GPS coordinates. Obviously this wouldn't be possible on an unmolested MiFi router, but I'm just thinking about the concept overall... Thoughts?

Answer 1

I believe the Skyhook-related data connection is made by locationd to an Apple server such "mac-services.apple.com" over HTTPS (that is, it's secured by TLS or SSL), so that your location information isn't available in the clear to anyone intercepting your network traffic. This would probably prevent man-in-the-middle attacks as well.

If you don't mind running a jailbroken iPad, I could theorize ways to add or replace trusted certificates and /etc/hosts records to get locationd to talk to a local custom process on your iPad when it thinks it's talking to its server, but it would take some work.

See also: Wikipedia: Skyhook Wireless: Privacy and Hacking, which links to a useful article on the XML-in-HTTPS -based protocol that Skyhook apparently uses.