Robert Xiao found LocationSmart's demo tracked any US phone and got it fixed in a day

LocationSmart sold real-time, carrier-based phone locations to businesses, partnering with Verizon, AT&T, T-Mobile, Sprint and the Canadian carriers Bell, Rogers and Telus. Its public trial page let anyone enter a phone number and, once the phone owner replied to an SMS or call-back opt-in message, see that phone live on a map. The consent step was the entire point of the demo.

On May 16, 2018, researcher Robert Xiao found that the consent step could be skipped. The demo API answered the same operation in two formats, XML and JSON; asking for location with requesttype=locreq.json instead of the default XML suppressed the subscription check entirely. Two unauthenticated POST requests — one to obtain a token, one to request the location — returned the target street address and a map circle for any US wireless number, including phones that had never opted in.

Because the positioning was carrier-side triangulation, it worked on every phone regardless of operating system or privacy settings, and there was no way to opt out. Xiao did not sit on the finding or dump it: he reported it to US-CERT and worked with Brian Krebs, who published the story after LocationSmart fixed the flaw on the morning of May 17; Xiao released his technical write-up only after verifying the patch.

The disclosure landed while the industry was already under scrutiny for selling location data: the write-up cites reporting that carriers supplied data to Securus, which improperly disclosed it to a former law-enforcement official. Xiao's page drew 1,209 points and 270 comments on Hacker News the day the fix went in and was echoed across dozens of sites.

Alternate response format skipped the consent check

The JSON request type routed around the code path that enforced consent, so a one-word format change produced full location data with no opt-in.

A short proof-of-concept that printed a street address made the flaw concrete and credible, which is what got it fixed within roughly a day.

Coordinated disclosure through US-CERT and a trusted journalist meant the story broke with the patch already in place, not as a zero-day scare.

Carrier-side location affected every subscriber of four major US carriers with no opt-out, so the demo bug was a national privacy exposure, not a corner case.

Treat every response format as an attack surface: a consent check in one handler can be absent in another. Prove severity with a working demo, disclose via CERT, and publish only after the patch.

LocationSmart fixed the vulnerability by the morning of May 17, 2018, and Brian Krebs published the story the same day; Xiao then released his technical write-up and proof-of-concept. The page drew 1,209 points and 270 comments on Hacker News and was syndicated by dozens of outlets. The episode kept the spotlight on carriers' practice of selling real-time location data, which had already put LocationSmart and Securus in the news days earlier.