Technology 3 min read

LocationSmart Demo Tool Leaks Real-Time Location of Everyone in the U.S.

Andrey_Popov /

Andrey_Popov /

A tracking website’s demo tool has allegedly leaked the real-time location of almost every mobile phone users in the United States.

LocationSmart, a company that offers tracking services, has reportedly allowed anyone to see the real-time location of smartphone users in the United States through a demo tool on its website. The incident was allegedly triggered by a bug in the tool’s system.

LocationSmart’s services involve collecting aggregated real-time data of the exact location of every mobile phone devices in the U.S. They obtain the positions by using the nearby cell towers of mobile carriers like AT&T, Sprint, T-Mobile, and Verizon.

The company then offered a free demonstration of its tracking services via its website. All a potential customer has to do is type the phone number of a person. It will prompt the system to send a consent text to the owner of the number. If the person replies “yes,” his or her location would be revealed.

However, a bug on the API of the system has enabled anyone without a website password or form of authentication to do a search and see the location of virtually every U.S. mobile phone user without their consent.

“I stumbled upon this almost by accident, and it wasn’t terribly hard to do,” Robert Xiao, a researcher at the Carnegie Mellon University who discovered the bug, said. “This is something anyone could discover with minimal effort. And the gist of it is I can track most people’s cell phones without their consent.”

Read More: iPhone Users are Warned About the Black dot of Death bug

According to Xiao, he was able to track a friend’s number by pinging his mobile network multiple times. He then plugged the coordinates into Google Maps and was able to follow his friend’s directional movement.

When asked for comment about the incident, LocationSmart founder and CEO Mario Proietti told KrebsonSecurity:

“We don’t give away data,” Proietti said. “We make it available for legitimate and authorized purposes. It’s based on legitimate and authorized use of location data that only takes place on consent. We take privacy seriously, and we’ll review all facts and look into them.”

The company has already taken down the compromised service offline yesterday afternoon right after Krebs contacted them.

Are you in favor of having a tool that could potentially be exploited by cybercriminals to trace your exact location in real-time?

First AI Web Content Optimization Platform Just for Writers

Found this article interesting?

Let Chelle Fuertes know how much you appreciate this article by clicking the heart icon and by sharing this article on social media.

Profile Image

Chelle Fuertes

Chelle is the Product Management Lead at INK. She's an experienced SEO professional as well as UX researcher and designer. She enjoys traveling and spending time anywhere near the sea with her family and friends.

Comments (0)
Most Recent most recent
share Scroll to top

Link Copied Successfully

Sign in

Sign in to access your personalized homepage, follow authors and topics you love, and clap for stories that matter to you.

Sign in with Google Sign in with Facebook

By using our site you agree to our privacy policy.