SMS-delivered network-initiated SUPL on Pixel 8: a privacy assessment

2026-09-19

AI Summary

研究通过测试谷歌Pixel 8手机对SUPL_INIT消息的响应，评估了其位置隐私安全性，发现不会因SMS触发的消息而泄露位置和用户身份。

Abstract

A SUPL\_INIT message is a network-initiated trigger that can be sent to a handset using an SMS to unilaterally start a location session: on receipt, the handset is instructed to determine its own position and report it, together with an identifier such as its IMSI, to a server specified in the message, without any action by the phone's user. The concern motivating this investigation is whether such a message could be used to silently exfiltrate a handset's location and subscriber identity to a server under an attacker's control. We investigated this on a Google Pixel 8 handset, which uses a Samsung Exynos modem and a Broadcom GPS/GNSS subsystem. We find no privacy issue: the handset never sends location data to an attacker-chosen server as a result of an unsolicited SUPL\_INIT delivered by SMS.

Problem

• SUPL_INIT
• SMS
• location privacy
• subscriber identity
• exfiltration

Innovation

• SUPL _INIT
• SMS
• Privacy Assessment
• Google Pixel 8