WaveDigger maps Wi-Fi and cell towers by querying Apple's hidden location API

WaveDigger is an open-source web app that turns wireless identifiers into physical coordinates. Feed it a Wi-Fi access point’s BSSID (MAC address) or the network parameters of an LTE or 5G NR cell tower, and it returns an approximate location plotted on an interactive deck.gl map. For 5G lookups it also surfaces neighboring cells in the same cluster, and it keeps a local history of recent searches. The project is built on Next.js and TypeScript, with a hosted instance available and an AGPL v3 license that forces anyone running a modified copy as a service to publish their changes.

The tool works by hitting Apple’s undocumented WLOC endpoint (gs-loc.apple.com/clls/wloc), the same crowdsourced database Apple devices use to speed up positioning. It leans entirely on the apple-corelocation-experiments project’s reverse engineering — the protobuf request format, endpoint behavior, coordinate encoding, and the magic byte prefix needed for valid queries. No API key or Apple account is required; the app just impersonates a normal location request.

The significance is less the code and more what it exposes: Apple’s location service will happily geolocate hardware identifiers that were never meant to be publicly queryable, and it does so without authentication. That makes device tracking and physical reconnaissance trivial for anyone with a target’s BSSID, echoing prior academic work showing Apple’s WPS can be abused for mass surveillance. Not every access point is indexed — new or private routers may return nothing — but the broader lesson is that a hidden, unauthenticated backend keeps turning MAC addresses into map pins.