A list of nearby Wi-Fi networks, Bluetooth devices and cell towers tells an adversary where a phone is, what it connects to and whether it is worth staying on. MITRE ATT&CK for Mobile T1421 System Network Connections Discovery covers adversaries listing network connections to or from the device, typically through device APIs for Wi-Fi, Bluetooth and cellular information. ATT&CK lists the technique for Android only, under Discovery (TA0032), and names no mitigations for it. This guide explains the Android APIs and permissions involved, what the procedure examples collected, how to detect the behaviour and which controls still apply. It is for mobile security engineers, app vetting teams and analysts supporting staff at risk of targeted surveillance. The Enterprise equivalent is T1049 System Network Connections Discovery.
Key takeaways
- Network discovery is location discovery. Android ties Wi-Fi scan results and cell information to
ACCESS_FINE_LOCATIONbecause nearby networks and towers reveal where the device is. - Android only in ATT&CK. The technique is listed for Android; ATT&CK does record Pegasus for iOS monitoring connection state, but the technique's platform list does not include iOS, so do not assume an iOS detection exists.
- Permissions are the control point. Android 10 requires fine location for several Wi-Fi, Bluetooth and telephony methods; Android 13 adds
NEARBY_WIFI_DEVICESwith aneverForLocationflag. - No ATT&CK mitigation is listed. Defence rests on permission review, OS currency, app source control and network monitoring.
- Spyware collects it routinely. Monokle, Exodus, ViperRAT and Pallas collected Wi-Fi or cell tower data; LightSpy collected cellular network lists and Wi-Fi history.
How the technique works on Android
ATT&CK names three API families. The permission behaviour below comes from Android documentation:
| Information | APIs named by ATT&CK or Android docs | Permission gate |
|---|---|---|
| Current and nearby Wi-Fi | WifiInfo; WifiManager.getScanResults(), startScan(), getConnectionInfo() | ACCESS_FINE_LOCATION for apps targeting Android 10 or later; scan results still need it on Android 13; NEARBY_WIFI_DEVICES for apps targeting Android 13 that manage Wi-Fi |
| Bluetooth devices | BluetoothAdapter, startDiscovery(), BluetoothLeScanner.startScan() | Runtime permissions granted by the user; fine location for discovery methods from Android 10 |
| Cell towers | TelephonyManager.getNeighboringCellInfo() before Android 10; getAllCellInfo() from Android 10 | ACCESS_FINE_LOCATION |
| Connectivity state | ACCESS_NETWORK_STATE (requested by NGate, per ATT&CK) | Install-time permission |
Android's Wi-Fi permission guidance lets apps targeting Android 13 assert neverForLocation on NEARBY_WIFI_DEVICES. In app vetting, an app that holds fine location and nearby devices permissions without a location or connectivity feature is the pattern to question.
What about iOS
ATT&CK v20 lists T1421 for Android only. The technique's procedure list does include Pegasus for iOS, which monitored connection state and the types of networks the phone used, potentially to decide whether it could send full data, and LightSpy collected cellular network lists and Wi-Fi history. Treat these as evidence that implants with elevated access gather network context on iOS too, but ATT&CK provides no iOS detection analytic for this technique. For iOS, the practical controls are current OS versions and, for high-risk staff, Lockdown Mode, which among other things stops automatic joining of non-secure Wi-Fi networks and turns off 2G and 3G.
Real cases from ATT&CK procedure examples
- Monokle (S0407): retrieved nearby cell tower and Wi-Fi network information.
- Exodus (S0405): Exodus Two collected a list of nearby base stations.
- Pallas (S0399): gathered and exfiltrated data about nearby Wi-Fi access points (Dark Caracal reporting).
- ViperRAT (S0506) and FakeSpy (S0509): collected cell tower and network information.
- FlexiSpy (S0408): commercial monitoring tool that can collect known Wi-Fi access points.
- C0033: PROMETHIUM (G0056) used StrongPity to collect available Wi-Fi networks.
For the broader category, see the Spyware and Stalkerware Guide.
Prevention and hardening
- Govern location and nearby devices permissions. On managed Android devices use the device policy controller to review and, where policy allows, deny location and nearby devices grants for apps without a need.
- Set an OS floor. Android 10 or later puts Wi-Fi, Bluetooth and telephony scanning behind fine location; Android 13 or later adds the nearby devices permission.
- Control app sources. Most procedure examples are spyware delivered outside official stores; block unknown sources on managed devices.
- Vet for location without purpose. In static and dynamic review, flag apps that call Wi-Fi scan or cell info APIs without a user-facing location or connectivity feature.
- Protect high-risk users. Offer Lockdown Mode on iOS and Android Advanced Protection guidance for staff at risk of targeted surveillance.
Detection and measurement
ATT&CK's Android analytic for T1421 correlates a runtime trace of WifiInfo.getBSSID() from app vetting, Android Enterprise network logging or VPN flows, and permission grant state from the device policy controller. In practice:
| Source | Signal |
|---|---|
| Dynamic app analysis | Calls to BSSID, scan result or cell info APIs shortly after launch, without user action |
| Permission state (DPC) | Apps holding ACCESS_FINE_LOCATION and nearby devices permissions outside the approved list |
| Android Enterprise network logging | DNS lookups and TCP connections from the app to unfamiliar hosts; device owner from Android 8, work profile owner from Android 12 |
| MTD or gateway | Periodic small uploads consistent with telemetry beaconing |
Network logging records DNS lookups and TCP connections but not apps that make direct system calls, so pair it with VPN or gateway data. Measures:
- Number of approved third-party apps holding fine location without a documented need (target zero).
- Percentage of managed devices at Android 13 or later.
- Percentage of app vetting reports that include location and network API use.
- Number of high-risk staff enrolled in Lockdown Mode or equivalent hardening.
Common failure patterns
- Treating Wi-Fi scanning as harmless. Nearby BSSIDs and towers locate a person as well as GPS does in many places.
- Approving location for convenience. Users grant location to apps that do not need it, which also unlocks network discovery.
- Assuming network logging sees everything. Android documents that direct system calls and some streaming and messaging apps are not logged.
- Inventing iOS coverage. ATT&CK lists no iOS analytic for T1421; claiming one in a coverage map overstates detection.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK for Mobile | T1421; TA0032 | Technique and tactic (no mitigations listed) |
| NIST SP 800-53 Rev 5 | AC-19; CM-11; SI-4 | Mobile restrictions, app control, monitoring |
| NIST CSF 2.0 | PR.AA-05; DE.CM-09 | Least privilege for permissions; monitoring |
| OWASP MASVS | MASVS-PRIVACY | Minimise location and network data use in your own apps |
Practitioner checklist
- Review fine location and nearby devices grants on managed Android devices.
- Require Android 10 or later, preferably 13 or later.
- Block unknown sources on managed devices.
- Include Wi-Fi, Bluetooth and cell API use in app vetting.
- Collect Android Enterprise network logs and pair them with gateway data.
- Offer Lockdown Mode or Advanced Protection guidance to high-risk staff.
Standards and references
- MITRE ATT&CK: System Network Connections Discovery, Mobile T1421
- Android Developers: Privacy changes in Android 10
- Android Developers: Request permission to access nearby Wi-Fi devices
- Android Developers: Network activity logging
- Apple Support: About Lockdown Mode
- OWASP: Mobile Application Security Verification Standard
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide · T1049 System Network Connections Discovery · Android Advanced Protection · Mobile App Permissions · Spyware and Stalkerware Guide · Mobile T1422 System Network Configuration Discovery · Mobile T1430 Location Tracking