Spoofing Tool Lets You Catch Pokémon from Julian Assange's Embassy Prison

“The project brings into question the truth about metadata sources. Did you really visit the Ecuadorian Embassy?"
Janus Rose
New York, US
July 19, 2016, 6:54pm

Geolocation spoofing seems to be back in style lately with the release of Pokémon Go. In the few weeks since its release, players have tried all kinds of tricks to cheat and spoof the massively-popular geocaching game—from mounting their smartphones to a drone to mocking-up their location with VPNs.

But with "SKYLIFT," a new project from Berlin-based artist Adam Harvey, users can have their devices pretend to be in one location in particular: London's Ecuadorian Embassy, the home and de facto prison of Wikileaks boss Julian Assange for the past four years.

Advertisement

A collaboration between Harvey and the Zurich-based art collective !Mediengruppe Bitnik, the SKYLIFT geolocation emulator allows anyone connected to it to browse the web, check-in, and geotag photos as if they were physically present at Assange's embassy residence.

Part of Bitnik's newly-opened "Welcome to Ecuador" exhibit, SKYLIFT aims to highlight the increasingly murky reality of physical and digital presence as told through our data.

"The project brings into question the truth about metadata sources. Did you really visit the Ecuadorian Embassy? Did I? Maybe we both did," Harvey told me in an encrypted chat after installing the work at Zoo Galerie in Nantes, France. "We shouldn't accept a truth handed down to us through an opaque system."

To spoof the wireless environment surrounding one of the world's most-wanted people, Harvey and Bitnik traveled to the Ecuadorian embassy to scan and sample the profiles of 60 nearby Wi-Fi network broadcasts, or BSSIDs. By re-broadcasting those networks from a Raspberry Pi inside the gallery, anyone connecting can use the internet as if they were standing outside Assange's front door.

You may also know Bitnik as the collective behind the Random Darknet Shopper

"I wanted to contribute to [Bitnik's] work by heightening the simulated experience of visiting the embassy and further a discussion about transparency, surveillance, and our over-reliance on opaque infrastructures," said Harvey.

It isn't the first time these artists have presented projects involving Wikileaks' boss. In 2013, Bitnik's "Delivery for Mr. Assange" allowed online viewers to live-track a camera and sensor-equipped parcel that was bound for Assange's embassy hideaway. You may also know Bitnik as the collective behind the Random Darknet Shopper, a bot that was programmed to purchase random items from darknet marketplaces (and was briefly seized by the authorities).

Advertisement

Although SKYLIFT is currently installed inside the gallery in France, Harvey has provided instructions allowing anyone with a Raspberry Pi and $12 Wi-Fi adapter to spoof the embassy's wireless environment on their own. The BSSIDs can also be easily replaced with those from another area to spoof different geolocations.

Unfortunately for Pokémon Go players, it's unclear whether you can use the spoofer to catch rare Pokémon lurking in distant locales. Since the Pokémon Go app gets GPS signals in addition to Wi-Fi and cell tower-triangulated geolocation, a user would need to shield or block out the "real" GPS signals coming from overhead satellites while spoofing the desired latitude and longitude coordinates. UPDATE: You can. We just caught a pidgey.

SKYLIFT can transport Pokemon Go players to London's Ecuadorian embassy, which is a pokéstop. Photos: Adam Harvey

Developer Niantic has also been cracking down players who attempt to spoof their locations, so those who make the attempt should do so at their own risk.

"Spoofing GPS is pretty tricky, but increasingly doable. [You] need optimal conditions however," said Julian Oliver, a surveillance artist who helped Bengt Sjölen and Gordan Savicic on their "Packetbridge" Wi-Fi network spoofing project, which formed the basis of Harvey and Bitnik's piece. "I reckon the best way would be to 'shim' in dummy/simulated GPS input by MiTM [man-in-the-middle attack] between Location services and the [Pokémon Go] app itself."

As of this update, players have set a lure at the embassy, which is a pokéstop.

Correction and update: This post has been corrected to reflect that Packetbridge was the project of Bengt Sjölen and Gordan Savicic and updated to reflect the fact that you can use SKYLIFT to catch pokémon.