Slashdot Mirror
WiFi Triangulation
mikegroovy writes "WiFi software
tracks you down: 'Positioning technology company Ekahau has released an updated version of its software, which allows devices to be physically tracked when they are connected to an 802.11 WLAN network.' Maybe connections that are made from the street(or outside of a predefined area) could be automatically disconnected... It may spell an end to warchalking."
I hate the thought of other users being able to access my wireless connection. Even though I rarely have important files that I'm concerned about, it's nice to have some security.
The Political Programmer
Hint: War-chalking happens because people are clueless about their networks. The problem is networks that let everyone on board by default without any encryption.
"Ekahau reckons there is a market for networks used primarily for location-based purposes as opposed to carrying other data. "
Can't remember the last time I saw the word, "reckons" in a major publication. I reckon it was some time ago.
there was a article in wired about students use triangulation in 802.11b networks for all kinds of crap. since they only have a wireless lan there, professors and students write software for it because everyone uses it on their laptops and pdas
For some more info check out the company's website. Here's the page on EPE. Looks like pretty neat technology. Easy to set up and accurate to within 1 meter. I doubt warchalkers will be deterred though. :)
Karma: Excellent (In Soviet Russia, karma pimps YOU)
Not likely. The systems that get picked up by war____ers are generally the ones that someone took out of the box and plugged into the wall. Anyone who bothers to set up a triangulation system would probably already be using MAC restriction or other security measures. (Technically, you can still see a secured network and mark its location, but you could do that with a triangulation-restricted network too).
Inside of highrise buildings that have many different companies in them. - use marker on the walls instead of chalk!
I'd rather be a conservative nutjob than a liberal with no nuts and no job.
>It may spell an end to warchalking.
I thought that warchalking existed more for those who are offering wireless access to alert others than revealing the open status of another's network. Any warchalkers want to chime in? Are you guys mostly ID'ing your own WAPs or the WAPs of others?
this sound more like something the gonvermnet would be doing instead of some company. imagine the advertisement companies, you walk in front of a star-bucks, and a pop-up for star-bucks coffe pops up, and the same for gas and what not. it raises the question of which is better knowing where you/your labtop are Vs. personal privacy. i'm sure not a lot of you will see what i'm saying, but think about it
The 802.11b network at my school fails after 50 feet.
Don't throw away that chalk just yet!
There are a lot of benefits to having this ability. At work, I can now equip our parking officers with wireless PDA's and soon I will be able to make sure that they are not sleeping in the lobby of some building instead of writing parking tickets. Maybe they will actually be out to ticket people parked illegally while attempting to warchalk from their vehicle! Now that's irony!
You should take a look at this article. Students at Dartmouth College have been using / developing wi-fi tracking systems for a while now. A nice way to track down your buddies at the campus.
Jesus, first the music industry tries to stop people from stealing their product, now companies are trying to stop people from stealing their bandwidth. What's next? Will department stores stop letting people shoplift? Maybe my landlord will start charging me rent! What will I do?
- paying-for-it", of course).
My god, don't these people realize that everything is supposed to be free? (That's "free" as in "I-should-be-free-to-take-whatever-I-want-without
One way to get around a measure like this is to obtain a surface which can reflect EM radiation at 2.4ghz, such as AMQ coated polycarbonates or crystalline-structured metallics. By using a small set of these "mirrors" at strategic locations, you could fool the software into thinking you're actually receiving from inside the CEO's office.
Since most modern triangulation techniques, including Ekahau's, depend on standard mathematical models of radius delta-reduction, it's trivial to set up your reflectors in such a way that the tracking mechanism can't deduce a logical place for your signal to originate from. Hopefully as location-spoofing becomes more commonplace, the government won't enact any laws restricting the use or registration of EM reflective surfaces.
They are just spreading FUD, pure and simple. With any luck on their part, they'll sucker a ton of non-EE-informed companies into paying for their crap software before anyone realizes what's wrong.
--sdem
The article doesn't mention how accurate this technology is - only that it's accurate enough to find an isle in a grocery store.
I'm hoping that technology like this gets cheap and accurate enough to have my lawnmower drive itself.
Triangulation of EM is based on the assumption that the strength of a signal will diminish with the square of the distance from the source, or some other constant function with other signals.
When was the last time you were using wireless (especially through a wall) that had the same range from the access point in any direction?
I can't picture it working in a supermarket, with the metal shelving, compressors for the cold storage, etc. Sure, in a lab it'll work great, but with any kind of range or non-uniform building structures, not a chance.
reckon Pronunciation Key (rkn)
v. reckoned, reckoning, reckons
v. tr.
1. To count or compute: reckon the cost. See Synonyms at calculate.
2. To consider as being; regard as. See Synonyms at consider.
3. Informal. To think or assume.
v. intr.
1. To make a calculation; figure.
2. To rely with confident expectancy. See Synonyms at rely.
3. Informal. To think or assume.
This post was generated by a Cadre of Uber Monkeys for Monkey-Man2000 (603495).
Since a huge proportion of us who have publicly-accessible Wi-Fi networks do so by choice you have to wonder what the value of tracking users is. If people use my hub I'm okay with it as long as they're not abusing it, more power (or bandwidth) to them. I don't need to track people using my hub, if I didn't want them I would spend a few minutes reading about security and prevent people from using my hub. The only people who would need to track users would be corporations but their security departments are so damn paranoid they're barely ready to admit Ethernet may be secure, let alone cool shit like Wi-Fi.
The technology to fool technology tends to always be slightly ahead. Expect WiFi location spoofing to follow.
I used to find people by pinging their computers! I'd ping a friend's laptop (using their Windows computer name), look at their IP, then go find them on campus. I think I scared a few people when I'd say "Stay right where you are" and walk over to the study room where they were hiding.
Although I guess using triangulation accurate to a meter would let me say "You're on my spot on on the couch. When I get back from class, you gotta move."
Out of the various possible routes taken by a TCP/IP packet in transmission, one line l may be chosen with peak in point p relative to which the line is symmetric (relative distance and velocity, v(p), are minimal).
Therefore, the scalar potential field created by such movement obeys Zipf's Law of Power (so do Web links, but that's for another post perhaps).
Bottom line -- be weary of news releases such as this one that proclaim to track you via traditional IP methods. Unlike the X10 cam, most of these software crocks of crud simply don't work!
Also, here in the UK our 802.11 cards are very different from traditional eth0s you folks may have in the States. Yet another question to ponder...
Department of Physics and Atmospheric Science, Dalhousie University, Halifax, N.S., Canada, B3H 3J5
And it implies that triangulation is not involved:
So perhaps if you bump the power of your signal from the outside they will think you are inside.
www.bannination.com Two things float to the top he
I found a new open network near my girlfriends apartment,opened up my browser to /. and saw this as the lead story.
Perhaps I'd better log off now....
Where does the school board find them and why do they keep sending them to ME?
This kind of triangulation would be useless, since you'll need three WiFi access points (thus the term "triangulation". I've yet to see a business that has some dire need for more than one access point. And as for the thing for denying people access when they're too far away, what makes you think someone's gonna point their Pringles can to your building from 800 feet away.
(c) tokachu. all rights reserved. deal with it.
I am walking down the street right now hijacking a wireless connection and nothing is happen to...[End of Transmission]
What happens if you use an assimetric aereal? like when you use directional aerials. Will this confuse the algorithm they use to triangulate?
When his defense asked, "Which computer has Jon Johansen trespassed upon?" the answer was: "His own."
I can think of several ways it might work, but all of them present significant challengs. Relying on relative signal level would be ludicrous, because signal level changes dramatically with card orientation, reflections, and whatever's in the middle. Heck, I get significant variance in signal level on the fixed links between the antenna on my roof and neighbor's sites.
Using a GPS-like timing comparison might do the trick, but it's set up backwards. With GPS you have a bunch of atomic clocks in orbit, and one device correlates the relative signal phase between them. With APs, you have to have extremely accurate timing across all the APs, which is a very hard problem (I've researched it...). Once you have that, you can compare reception times of a packet from the device being tracked, and triangulate. Problem is 1 meter accuracy represents some scary clock accuracy numbers across several APs with just an Ethernet between them.
If anyone can think of any other way to pull this off (WITHOUT modifying the client, and ideally without any special hardware, i.e. implementable in the HostAP driver), post them here.
GStreamer - The only way to stream!
Triangulation works great in two dimensions, but when you use a third you have to do quadrangulation (is that even a word? I'll bet it is) like say you work for a company in a five story office building, when you triangulate where a person is in relation to you distance wise and in which general direction, but you don't really know where he is, maybe he's 15 meters in front of you and maybe he's 5 meters in front of you, but three floors down. They could both register as the same with triangulation. I will start the quadrangulating WiFi revolution.
Whiteboard capturing devices use a similar principle. Two microphones are at opposite ends of the whiteboard and an ulrasound emitter is attached to the pen. When you move the pen the CPU unit attached to the mikes triangulates the postion of the pen and renders the digital image of the whiteboard. I always thought it was a simple and elegant solution compared to the touch sensitive whiteboards that cost much more. Another company now has a mini version of this technology for iPaq which attaches to a normal writing pad and allows you save anything you write on your iPaq.
Because a tetrahedron is the shape you get when you connect 4 points in 3D.
WiFi SA is launched. Access points deploying Selective Availability, technology the military used to degrade GPS signals to the enemy. The technology inserts random packet lag in to defeat evil hacker terrorist and government ufo's from accurately triangulating the position of the base station and thus hacking in (with an axe) to steal precious pr0n.
Slashdot reader paran0id welcomed the news saying this saved him allot of money he would have needed to wallpaper the house in tin foil.
In post on the cs forums the terrorist responded defiantly saying they would kidnap any scientists working on such technology (cs_militia) and bomb any crates containg devices utilizing it (de_dust). When asked why they would take such drastic action one terrorist said "lag suxors, what kinda n00b would add lag to his connect on purpose".
When a Counter-Terrorist agent was asked if WiFi SA would hinder thier ability to find terrorist and steal thier pr0n he replied "d00d, who needs that trianglation crap when you got a colt, a aimbot, and the ogc wallhack."
Comment removed based on user account deletion
Such scalar fields can easily be integrated using quaternions, where the 4th dimension is time. Zipf's Law in this case actually helps find the solution path, as you merely have to choose some constant of integration that will agree with all possible paths.
So a bit of heavy math is involved to get traction on the problem but hey, someone paid all those 19th century mathematicians to come up with these algebraic tools. We might as well use them when they apply.
The point was that I was 300 miles away from the campus at the time.
To buy more Wi-Fi repeaters! My wife is gonna kill me when the bills come due!
Always going forward, 'cause we can't find reverse.
i don't see how you can possibly be right..
if you know the direction, you'll know whether they're level with you, or below you, or whatever. if you point your directional antenna straight ahead of you and get the strongest signal, the person is level with you. if you turn your antenna 15 degrees downwards, they're below you. use of a second antenna determines the distance to your target. the only thing a third antenna would do is tell you what you already know from using the second antenna.
I can see it now.. the BOFH getting out of a weekend at the helldesk because the Boss spent forty-five minutes in the bathroom the day before downloading pictures from nymphoasianlesbians.com. Bring on the blackmail and the lawsuits!
I learned from my first wife - keep a second account she knows nothing about and have the contact info for the bank registered to a p.o. box and cell phone (in only your name).
I am not suggesting you do anything she REALLY wouldn't approve of (like cheat). Just she doesn't have to know how you spend every dollar.
Even the very term "triangulation" implies that you'll need 3 access points to do it.
- With 3 access points, you can generally locate a signal rather well, because they can see more points, and in particular if the 3 APs are located in a triangular fashion, with the user in the middle, youcan quite accurately track them.
The accuracy of the system will be almost entirely dependent on the number of access points that a user can see at a given moment, the more APs, the more accurate. Just like GPS.not really, triangulation means two detectors, one working on the x axis, saying left or right is stronger, one working on the y axis saying up or down is stronger. the third point in this trangulation is the transmitter you are hunting. your explanation is correct for 3d space. where you would need a z-axis detector.
Well, I very well could be wrong about this, but I think you're thinking along the lines of radar, not beacon triangulation.
When you're dealing with triangulating the position of a beacon, you can only "listen" and make judgements based on relative differences. Based on common knowledge of interference and the decay of that particular frequency of radio you can determine, based on three or more points, where an object is in relative space.
With only two points to work with, you're able to get at most that the beacon is at "point a or point b" both points being the exact same distance away, but in semi-opposite directions. Try it, if you draw on a piece of paper two points, representing APs, and draw a circle around each representing a received signal and its strength, you would notice that with two points, they overlap at two points, but with three, they overlap at only one position.
Yes, it will confuse it.
:-)
Their method will probably even fail if you switch WiFi cards. I've got a Compaq WL110 which has a range of about 10 feet. My Lucent card on the other hand sees the access point from 100 feet, without line-of-sight (I assume the radio waves bounce off the ceiling through the window; no other way to explain _that_ range).
My access point has antennas that can be moved into different polarisations, and in an off-colour configuration, access without line-of-sight becomes really spotty: it works in one place, and a few feet to the side it stops.
But it seems to me the point of the seller is not to track abusers, but rather to track known-good devices in a known area. That alone is a cool concept, if you see what contortions people go through now when designing warehouse positioning systems. I've seen the results of an automated fork lift running through the wall of a warehouse because the reflective pad that marked the end of the aisle was covered in grime.
Hmmmm, I can envision the next hobby: sit outside a warehouse with a 2.4GHz klystron, wait until you hear the fork lift come down the aisle, then switch on the jammer and watch the fireworks
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
Microsoft Research did some work on this a couple of years ago - they called it RADAR.
The equations they use are pretty simple, and they seem to be getting very optimistic results. They, too, use signal-strength triangulation, together with a model of the local area (so you feed in how many walls are between you and the AP, for instance), and some processing based on recent history. That's to say, four out of the five latest samples have you outside on the pavement, and one of them has a 50 yards away in the eastern wing, you're probably still on the pavement.
Venkata N. Padmanabhan has some more papers on this on his homepage. Victor Bahl has a demonstration here but I guess it only works on IE.
Just use a slightly directional antenna--anything that relies on signal strength to triangulate you will end up being way off. If you set it up carefully, you can even choose your "virtual" location. And, no, the government can't really outlaw directional antennas.
Sure, if may have an end to warchalking, but what about your privacy. If you can be tracked everywhere based on your mobile device, how long before somebody cracks the system or it's used against you?
TCP/IP has nothing at all to do with this, nor Zipf's law, nor any inverse square law, nor any kind of physical model. The system simply builds an empirical numerical model relating received power at the access points to location. As long as received power varies reproducibly with distance (not even necessarily monotonically) and you get enough independent measurements, that is possible.
If the system used triangulation, you would be right. But it doesn't. All that is required is that relative signal strengths are reasonably reproducible for each location and that you have enough measurements to distinguish all locations you are interested in. The system internally produces a map of which combinations of signal strengths correspond to which locations. To reduce the number of calibration points you need, you can try use interpolation between nearby measurements, which will usually work reasonably well/
Nobody puts gay porn onto my open Windows shares, even though I leave my 802.11b completely open. I have to go out and buy it myself.
There was a cool hack at MacHack in June 2001 that did this.
H ac ks/Airport%20Radar%e2%84%a2/
A quick Google search turns up a copy:
href=http://blueg3.homeip.net:81/MacHack/The%20
Not the best option if you want security... Triangulation requires 3 WAPs in distinctly different spots. Most home users don't have a WAP in their kitchen, bedroom, and bathroom. It may be argued that universities have WAPs all over the campus. That may be so, but is a wardriver usually in the range of 3? I am no expert on campus WAP placement, but the only places I immagine could be triangulated would be roughly the center of the campus. So while multiple gradebooks are being accessed by a host with an unknown MAC address, the triangulation software will say "Not enough base stations to determine location".
That also depends on your beam shape. If one uses an antenna that receives a very narrow beam but has a lobe at 180 degrees in addition to one at 0 degrees (and is steerable), you'll be able to trianglulate easily on the signal unless the signal originates at or near a point between the two antennas. The error elipse would be rather elongated at that point. If the source was at 45 degrees relative to both antennas, your error elipse would be small and you'd have an accurate fix on their location.
When calculating position on range alone, two antenna sites will indeed result in two intersection points, but that's not really trianulation anyway.
Don't anthropomorphize computers, they don't like it.
>the current guesstimate is that sales will drop >about 20% due to online copyright infringement.
> CD sales went up when Napster was in its prime
So when Napster was around sales where good and now that's it not they're bad?
I know it sounds simplistic but its the RIAA where talking about....
I demand a new CampChaos version of the Metallica neanderthal going:'Napster G-O-O-O-O-O-D!!!'
zeke
...at ~US$600 to triangulate two users. Gimme a break. Someone create an open source version, quick.
The research group I work in used many of the same techquies that this software company uses to create Nibble which also can do positioning using Wifi; http://mmsl.cs.ucla.edu/nibble/. Free. GPL'd source is available too.
Things to note, however, about any 802.11 tracking software it that its accuracy is poor > 5 meters, unless you are using 5 or 6 *simultaneously* accessible access points (it even states this in the Ekahau manual). Tracking software can be thrown off by even seemingly minor enviornmental changes like crowds of people etc. Also some calibration is also required.
Don't worry about this shutting down free access points as it is way harder to do location tracking than it is to set up an encryption system (even really good VPN style encrytion) or a simple MAC address filter.
Mike
that the other Slash-nomads have marked this post as "interesting". I will stay for a while, then continue my search for one which is marked "farmer's daughters to sleep with".
"I assumed blithely that there were no elves out there in the darkness"
So, this is easy to solve...what's the new symbol going to be for a WAP that's triangulating?
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon
What if someone used a directional antenna? The third antenna would be able to connect the signal and triangulating would be next to impossible. The other thing is you cant just drop the connection when two antennas dont see it since there are bound to be dead spots.
There aint no such site as nymphoasianlesbians.com. Get me hopes like that....
Rather than using signal strength for triangulation, you use it to record a "radio map", and compare your current position to the map. The basic steps are:
1) Walk around a room, recording the signal strength to each AP (so you get a file such as "Access Point #1, Avg signal: 96 AP#2, Avg signal: 74 ..."
). Netstumbler or other software can help you make this file.
Create a "profile" like this for every location you wish to map (roughly, one every square foot or meter). The number of profiles determines the granularity of the system, but too many profiles can cause "collisions" in the sense that different locations have similar profiles, for some reason or another. There are ways to combat this, one of which is to make an educated guess on the new location based on the last one. (i.e., the user could not have walked over 10m in one interval)
2) When a user connects, they can compare their current signal strength info ( such as AP#1, signal: 34 AP#2, signal: 74) to the map: the closest point is probably their location.
I did a simple euclidean distance calculation (taking each profile as a vector in some large space [cool how the pythagorean thm. generalizes, eh?]. There are many better ways, which I am researching this semester, but euclidean distance is fine for now.
I'm pretty sure this is why they must spend an hour per 10,000 square feet to "calibrate" the system. I had to do the same, but it was a *lot* slower; I need to make a tool to do this automagically.
This semester I am also looking to get my system working with an ipaq robot running familiar. It's the combination of the palm pilot robot kit and this positioning system. Hopefully, the little robot should know (roughly) where it is, and be able to be controlled via the internet.
Check out my webpage if you are interested in more details.
Once you introduce random delays, measuring the delays will not give a clue. Of course these delays should be really random (pseudo random is not enough), which may be harder than you think.
Another way of fooling the system is using constant delays per base station: your wireless device can convince the tracking system you are at a position you choose yourself.
"It may spell an end to warchalking"
Not really. Warchalking means exposing unsecure Networks. Everyone can encrypt his WLAN, anyway. So finding the location of the connecting machine doesn't really help any further.
But randomizing the signal strength should fool the system too, however.
Sorry.. why dont you just secure your network with encryption? Triangulation is a neat idea, but its just not going to work with so many obsticles (some moving) in a building. Why bother calibrating 1000's of square feet when you can just use a password?
This comment does not represent the views or opinions of the user.
Odds are about 100% that if you are setting up multiple wifi base stations, you are placing them for optimal coverage of your own intended users. Wifi triangulation works best when the user is somewhere within the perimiter of the base stations, and works most poorly when the strongest received signal is a station on the perimiter.
So to accurately determine if someone is outside the intended coverage area, wouldn't you really need to deploy additional base stations? For instance, if you have three stations at your business, one near the front, and two in the rear corners of your building, and someone is wifi'ing in from the bus stop bench outside, he's going to hit the front station and not do much for the two in back. It's very hard to tell this user apart from someone just inside the building and very near the front base station. To settle this, you'd need a base station like across the street or something.
I don't see wifi triangulation as a practical way of identifying users outside the perimiter for this reason.
It's also worth noting that it would be a poor choice to place the base station right at the front of the building, because you'd be wasting 50% of the station's coverage area. But to pull the stations in toward the building's center would further degrade your triangulation abilities because relative signal strength differences would lower your triangulation precision.
Just tossing ideas out, I'd propose the best way to keep warchalkers out if that is your intention, is to deploy your base stations in such a way as to not provide (effective) coverage to areas outside your premisis. If your business is already too small to keep coverage just inside your building, then obviously buying several base stations to try for triangulation is patently absurd.
Of course, my final suggestion would be to openly allow public access, and use it as a P.R. booster. Free advertisement is handy, and in most cases, this would almost be free.
For the entrepeneur: I haven't seen anyone selling warchalking plaques yet. I bet there are some businesses out there (cafe's etc) that would buy a custom made brass or bronze wall plaque they could affix to the outside of their buildings to attract more customers.
I work for the Department of Redundancy Department.
Now I can find exactly where they are.
Any use of this technology for security will be hampered by the fact that it apparently runs on the client - at least the web page lists requirements (Java, etc) for the client.
My own experience with 802.11b is that the inside range is so small - about 30 meters, that just knowing which access point was handling the traffic would be enough geographic information for most of the applications they list.
The data would miraculously appear in the destination system?
you are so damn smart, I wish I was that smart.
As there are already many surfaces that will reflect RF in the range that you specify, why would you think that these folks haven't already accounted for multipathing?
They must have or the shit wouldn't work.
But you are really really smart
you need THREE points or else you end up with the location along a circle UNLESS the point of interest is directly between the two (if you only have two).
Unless someone can point out a flaw in my logic.
The effect may be far too small to use in practice, though.
You're right, you need four, but this isn't why, and the math is ugly. You can't tell how far away a signal is from a given point, unless it's broadcasting with known constant strength or sending a time signal or something like that. What you can tell (sometimes) is how far away the signal is from router A, compared to router B. You might have a ratio of distances, or a difference of distances, either of which pinpoints location on a hyperboloid. This surface is two-dimensional, and for every reference you add, you strip off one dimension, so you need two more references. After that, the solution will be unique with high probability, as long as your references are not coplanar. The math, requiring simultaneous quadratics, is not pretty.
If you could tell the exact distance to the signal from each access point, you could probably place 3 of them cleverly to give you a good location. For example, if the access points were on the top floor, you take the solution below them, unless you believe the person accessing your network to be warskydriving.
I hereby place the above post in the public domain.
I'm not sure this "party line" of "check your network often for rogue APs" is all that sensible of a solution.
I'm not saying there's anything wrong with doing it, if you so choose. I just feel like it's playing "whack a mole" with a technology that network admins would be better off dealing with "head-on".
If a given environment requires a high level of security from people outside the building gaining network access, they should make efforts to block the radiation of the wi-fi signal beyond their perimeter. A farraday cage of sorts could be constructed to shield the signals from getting out. This might make a lot of sense in the construction of new bank buildings, for example. (Just place wire mesh behind the drywall that goes up against outer walls.)
For those unwilling to go this far to solve the problem, it still seems like good network practices should "save the day". Let's say, for example, war-driver X does find your sale guy's new, unsecured access point, and gets on your corporate LAN. How is he/she any different from a visitor who decided to plug his laptop into an available network port when he sits down in one of your company's conference rooms for a meeting?
In both cases, you'd assume the person wouldn't be able to do much more than get issued a valid IP address and be able to "ping" stuff. He/she doesn't have a username or password, so therefore, no security granted to modify or open any resources. (Or is your network lacking security on important files and/or directories, so all users get default access? If so, *there* is your primary issue!)
Even if your only concern is that war-driver X not be able to bum free Internet access off of you - that's solvable too. If you set up a front-end that requires authentication before using the web (or ftp), you can stop that. Of course, your employees might resist the inconvenience of having to "log in again" to use the net each time.... but hey, you should really be logging what sites they're visiting anyway if you're concerned about security and legal liability.
Assuming they use timed response averages to triangulate the devices position, it should be a simple matter to programatically fluctuate response times. This would at least make automatic proximity exclusion un-reliable (we don't want to drop the guys in white hats and we can't tell if this guy is wearing a white hat so we'd better not kill this connection). And as usual at this point i am rambling on.
Go ahead. Mod me down.
Eye, says I.
You raise some good points, but Joe Salesman plugging in an AP - even if it's already strictly against policy - will usually be a big problem.
If conference rooms are set up to allow outsiders, then if you're sane (and you were able to get your bosses to cough up the money, admittedly), it's set up in a DMZ of it's own, unlike the internal networks.
Now, I set up my DHCP in a paranoid fashion - if I don't know the MAC, it doesn't get an address... but that's often not workable for bigger places, and if the WAP-adder has enough technical savvy, he may realize he needs to make his WAP pretend to be his old box by MAC, and get on that way. If the WAP is handing out it's own addresses to those that connect by it, now you can't MAC filter anymore.
And once the person's on the inside LAN, a little bit of arpflooding (which, admittedly, your IDS should be picking up, but folks often don't have them internally because of the false alarms all the time) will make the switches failover and start acting like hubs - and he can sniff away at traffic to get passwords.
In essence, I view it not as re-checking for AP's specifically, but just another part of the constant check and recheck of your setups that you need to do to see if something has been changed in a way to break access controls that exist. HIDS, NIDS, tripwire, etc all factor in to this, making sure you haven't opened up a new vulnerability is just part of the big picture. It won't make you safe in and of itself, but neither should it be ignored based on trust that the rest is all "strong enough".
NATTY'S TITTIES!
Remember this? They used an ultrasonic echo-location system to build a spatial "mouse" which could be used to turn posters on walls into "smart posters" (click here to turn the lights on and off, etc.) and also to track users within their lab, so that your phone calls are forwarded to the phone nearest you, etc. At the time, I thought, how redundant... they need ultrasound for tracking and an RF system of some sort to transmit "clicks". Why not just use a wireless network and come up with a triangulation method to find the location of the WiFi device using its own emissions. Well now it's been done. So it should be possible to use a PDA with a WiFi card as that magic 3D mouse thing. Imagine having location-relevant UIs for things: as you walk down a hall you get light-switch controls on your screen for nearby rooms, a map, the meeting schedule for the nearby conference room, reminders about stuff you need to do while you are in this area of the building, instant-messaging informs your colleagues that you are nearby, etc.
Of course for smart-poster purposes, the resolution ought to be better (1 meter isn't good enough) but perhaps that could be improved.
I think in the future location tracking will usually have 2 tiers: outside you use GPS, and inside buildings you use radio-triangulation of some kind. It will be a sort of standard eventually. Because you need higher resolution indoors, for various reasons. And since buildings don't move, the building triangulation system can tell you precisely where the building's "origin" is in lat/long space, so you would still be using GPS-style coordinates, just with greater accuracy in indoor situations. Instead of being deprived due to the fact that GPS signals don't penetrate well enough, you actually get better quality.
Anybody else tired of security always being in the limelight? Yes we need that kind of geek very much, but fundamentally their job is a lot more boring than what's going on in the research labs... And these security "mine's bigger than yours" wars are getting almost as annoying as the MS hate-fest, or the Apple hate-fest of a decade ago.
A lot of people are misunderstanding what Ekahau's technology does. They merely provide a way of easily creating and maintaining database that links RSSI measurements to locations. Mobile devices ask for their own locations and presumably required software to capture the RSSI measurements. It is not a tool for network owners to track the locations of uncooperative clients.
> Yes, it will confuse it.
Bzzzt...
> Their method will probably even fail if you switch WiFi cards.
Cards can be calibrated as well.
> My access point has antennas that can be moved into different polarisations, and in an off-colour configuration, access without line-of-sight becomes really spotty: it works in one place, and a few feet to the side it stops.
Ok, now from the RSSI point of view you can easily distinguish locations a few feet away. Now imagine for example four APs like that and figure out how many locations you can trivially distinguish with all those RSSI combinations. Then build some intelligent algorithms on top of that.
Been there, done that.
http://www.kismetwireless.net/
While it wouldn't be implemented on the AP itself, 3-4 cheapo PCs with WLAN cards could easily be set up as packet sniffers that would show signal strength of all clients in the area.
http://www.instant802.com/ (I think) - AP with open firmware.
retrorocket.o not found, launch anyway?
Well, I see you've already been modded down.
Good.
Except for the smallest of businesses, more than 1 AP is needed.
My building has at least 4. (Using Cisco LEAP - Our admins aren't stupid.) I believe one in each end (north/south) on each floor. I would classify ourselve as medium/small. (2-floor building, not that large. There are MANY office buildings in this area that are MUCH larger)
retrorocket.o not found, launch anyway?
The Mattel Power Glove also worked this way
retrorocket.o not found, launch anyway?
Big problem with your system - The Pringles antenna
Using an antenna like this will make your position fix dependent on not only the client's position but on its orientation too.
I suggest trying an omnidirectional antenna of some sort. (http://www.aerialix.com/ has cheap kits based on the Guerrilla.net designes)
retrorocket.o not found, launch anyway?
Cards can be calibrated as well.
/. is a geek site?).
Uh-huh. I agree. But I think I pointed out that if you control the client PC cards, you have an entirely different situation than the big brotherish scenarios where unwilling users were to be traced, that started this whole thread.
I recently made a tour of a mountain side, and according to my GPS wound up 100 meters higher than the top. To my recollection, I had at least one foot in solid contact with the mountain at any time. I checked the GPS's reported EPE and the difference between its datum and MSL, but neither could explain that difference. Signal reflection could.
My IEEE 802.11b card has an external aerial that I can orient for maximum interference (and of course, I've been toying with that to explore the interactions with my adjustable base station antenna, weren't you warned that
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
I have a hobby. I have the world's largest collection of sea shells. I keep
it scattered on beaches all over the world. Maybe you've seen some of it.
-- Steven Wright
- this post brought to you by the Automated Last Post Generator...