Slashdot Mirror


WiFi Triangulation

mikegroovy writes "WiFi software tracks you down: 'Positioning technology company Ekahau has released an updated version of its software, which allows devices to be physically tracked when they are connected to an 802.11 WLAN network.' Maybe connections that are made from the street(or outside of a predefined area) could be automatically disconnected... It may spell an end to warchalking."

105 of 229 comments (clear)

  1. Finally by rice_web · · Score: 2, Insightful

    I hate the thought of other users being able to access my wireless connection. Even though I rarely have important files that I'm concerned about, it's nice to have some security.

    --
    The Political Programmer
    1. Re:Finally by LarsG · · Score: 2, Informative

      ..then enable some security on your AP! Even the cheapest APs available today support at least WEP, and it should take you about 30 seconds to enable it.

      --
      If J.K.R wrote Windows: Puteulanus fenestra mortalis!
    2. Re:Finally by Anonymous Coward · · Score: 2, Interesting
      it should take you about 30 seconds to enable it.
      And about 30 seconds to get through it too :P

      Actually, how long it takes to work through WEP depends on how much traffic you create. There are a few ways to use RC4 that really cut down on its security; WEP does most of these things.
    3. Re:Finally by mrjohnson · · Score: 3, Informative

      That's what my boss thought, too. You should be able to crack a somewhat busy network using 64 bits in about eight hours with AirSnort. It took me about sixteen to recover the password (longer because it was just one host and me running `ping -f -c 1 wifi` from my desktop).

      WEP will only deter the laziest script kiddie... Sorry. :-)

    4. Re:Finally by monthos · · Score: 2, Informative

      It takes much longer to crack it than 30 seconds. The reason it can be cracked is becouse of an insecurity of WEP encrypting a file every now and then weakly, still encrypted, but very weak, after you collect about 1000 of these packets software can determine the key from it.

      On a not very used network it can take over a day of collect the desired packets to crack it, on a heavily used network a few hours.

  2. Good God, are you Clueless? by Henry+V+.009 · · Score: 5, Insightful

    Hint: War-chalking happens because people are clueless about their networks. The problem is networks that let everyone on board by default without any encryption.

    1. Re:Good God, are you Clueless? by sys$manager · · Score: 3, Insightful

      It took me all of 30 seconds to enable 128 bit WEP and create a key on my new Linksys 802.11b router. Honestly, how hard is that for people to do?

    2. Re:Good God, are you Clueless? by Anonymous Coward · · Score: 2, Insightful

      so becuase a network isn't under the tightest security possible everyone has the right to go in it and do as they will? i know, i know: people *are* going to take advantage of those networks because they are there. but i don't think you can justify it by saying the security was lax.

    3. Re:Good God, are you Clueless? by cyberformer · · Score: 3, Insightful
      It takes me all of 30 seconds to program my VCR, but most non-techies can't do it.


      Anyway, 128-bit WEP (actually just 104 bits) isn't safe. The crack just takes twice as long.

    4. Re:Good God, are you Clueless? by reddeno · · Score: 2, Funny

      I could be wrong, but I thought the point of warchalking was to mark your _own_ wireless network so that others could use it.

      --Nicholas

    5. Re:Good God, are you Clueless? by wolfgang_spangler · · Score: 2, Informative

      Warchalking gets it's name from wardialing...where users would dial numbers until they found a computer that answered (see War Games).

      Warchalking is like walking around with a wireless devices, finding a signal, and marking that fact. Usually that is not done by the people running the network.

    6. Re:Good God, are you Clueless? by cei · · Score: 3, Interesting

      You are, in fact, wrong. Wolfgang is right in his description of the relation between warchalking and wardialing. That covers the "war" aspect. The "chalking" aspect is derived from the marks hobos would use indicating safe places to sleep, houses with guard dogs to avoid, farmer's daughters to sleep with, etc... The nomadic lifestyle leaving marks for other nomads saying "hey, there's something interesting here."

      Normally, then, the owner of the network would not be party to either the "war" or "chalk" methods.

      --
      This sig intentionally left justified.
    7. Re:Good God, are you Clueless? by WolfWithoutAClause · · Score: 3, Funny

      It takes only 45 minutes for me to airsnort the WEP password of your network. Honestly, how hard is that for us warchalking people to do?

      --

      -WolfWithoutAClause

      "Gravity is only a theory, not a fact!"
    8. Re:Good God, are you Clueless? by Gruturo · · Score: 4, Insightful

      It took me all of 30 seconds to enable 128 bit WEP and create a key on my new Linksys 802.11b router. Honestly, how hard is that for people to do?

      It will take AirSnort all of 30 minutes to crack your 128Bit WEP encryption since it is so badly flawed that I'd rather go _without_ it.

      Really, _don't_ trust WEP. Search Google or Ask Slashdot about cracking it, have a look at what You'll find.

      The only reachable IP on my 802.11 net is the IPSEC gateway.

      --

      Vacuum cleaners suck. Kings rule.
    9. Re:Good God, are you Clueless? by LarsG · · Score: 5, Insightful

      Anyway, 128-bit WEP (actually just 104 bits) isn't safe.

      We all know that. But an AP with WEP enabled is the digital equivalent of a "no trespass" sign, while an AP with no security at all is either set up by a clueless newbie or is deliberately left open to allow other people to get Internet access (which I'll do once I go wireless in my apartment).

      In order to promote public accesspoints, I'd prefer that the law doesn't consider it trespass to use an unsecured AP for Internet access.

      --
      If J.K.R wrote Windows: Puteulanus fenestra mortalis!
    10. Re:Good God, are you Clueless? by Zeinfeld · · Score: 5, Informative
      It took me all of 30 seconds to enable 128 bit WEP and create a key on my new Linksys 802.11b router. Honestly, how hard is that for people to do?

      Not hard but unfortunately not secure either. Due to a broken design the WEP mk1 scheme only gives 24 bits of security regardless of whether you have the 128 bit or 40 bit cards.

      However this has since been fixed, and the fixed cards will be available fairly soon. In addition the new cards fix the original major inanity of WEP, the single key shared by every card. The newer cards will have built in certificates to suport 802.1x authentication.

      While the triangulation scheme might be used for security purposes, it is no replacement for cryptography. In the first place the scheme appears to be working on signal strength rather than the arrival time of the signals. That is easily spoofed. Arrival time of the signals would be hidously expensive to do right (I used to do that type of thing, but not with IP routers and bridges in the way...)

      It might be useful to use triangulation to detect when people were entering an leaving cells, but that can probably be done by just choosing the strongest signal.

      I can imagine using this type of thing to track down criminal suspects, the sort of thing that the FBI have fun doing. It is not a replacement for cryptography and probably not even as secure as WEP mk1.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    11. Re:Good God, are you Clueless? by brain159 · · Score: 3, Funny

      that 45 minute figure assumes that lots of data is being thrown around across it, and that nobody's going to notice you staying in the same place near their building for that length of time, loitering and looking shifty :)

    12. Re:Good God, are you Clueless? by The+Fink · · Score: 2, Insightful
      How hard is it for people to do?

      It's not that it's hard, it's that the kinds of people who are generally setting these things up have been roped into doing so, and often don't have the first clue about security in general. Nor do they care - they're not usually frontliners who deal with security breaches on a day-by-day basis, and probably couldn't detect a security breach if/when it happened to them.

      Very few SMEs - at least in Australia - 'can afford' to hire a fulltime sysadmin with any level of security knowledge. Sad, yet true...

    13. Re:Good God, are you Clueless? by Natalie's+Hot+Grits · · Score: 2, Interesting

      Don't forget, arrival times (read: ping) can also be spoofed from the client side easilly (this might require mods to the NIC's driver). So even if arrival time based triangulation were implemented, it could also potentially be bypassed.

      This is not a replacemet nor a supplement for security. I am unaware of any type of triangulation system that cannot easilly be spoofed by a sufficiently smart person.

      This is a neat trick you can use for practical purposes (such as smart shopping carts in grocery store, cheep "GPS" in the city, etc.) but worthless for security, etc.

      If anyone thinks i'm incorect, please reply. It would be interesting to hear other people's ideas on spoofing triangulations.

      --
      Two infinite things: your stupidity and mine. But I'm not sure about the latter. If my sig offends you, I'm sorry.
    14. Re:Good God, are you Clueless? by Cyclone66 · · Score: 2

      But you would expect a VCR technician to be able to do it, so a network administrator should know how to set up their wifi network. It's a different story for home users, but a lot of the warchalking seems to be for companies.

    15. Re:Good God, are you Clueless? by WolfWithoutAClause · · Score: 2

      Hey, who are you calling shifty? ;-)

      --

      -WolfWithoutAClause

      "Gravity is only a theory, not a fact!"
    16. Re:Good God, are you Clueless? by stienman · · Score: 3, Interesting

      Last time I checked, airsnort and other wireless crackers needed on the order of millions of packets in order to determine the key for a weak key.

      Maybe you generate that many packets in 30 minutes (NOT), but the researchers said that it would take about a day to get the key from a network of active office users, and a few hours if the network is maxxed out.

      Your average home user won't generate that many packets in a week (except, perhaps, those playing quake) and only their neighbors will have the patience and opportunity to grab keys for a week without being caught.

      You should change your WEP as often as you change your passwords. Doing these things will keep freeloaders and those who are looking for an easy to break into network out. If someone is determined enough to break into your network, it won't matter what you do, they'll manage a way in. Even you know that if your life depended on getting access to someones home network, even with ssh, ipsec, etc, you could do it through other means.

      -Adam

    17. Re:Good God, are you Clueless? by iggie · · Score: 2, Insightful

      No, I'm not clueless, and I let everyone on board my wireless LAN without any encryption or password protection on purpose. Also, besides giving away bandwidth that I pay for to people I don't know for free, I have been known on occasion to do this with software that I write. No kidding! I just put it up on a web site and people I've never met download it for nothing. Amazing!

    18. Re:Good God, are you Clueless? by Idarubicin · · Score: 4, Insightful
      It takes me all of 30 seconds to program my VCR, but most non-techies can't do it.

      This may an important consideration for home wireless networks, but no excuse for corporate networks. Any business that has a "non-techie" building their network is inviting a whole lot of trouble--most of which probably won't be coming to them through their wireless AP.

      --
      ~Idarubicin
    19. Re:Good God, are you Clueless? by RollingThunder · · Score: 4, Insightful

      You underestimate the people in marketing, sales, etc who have no techie traning, but are quite happy to go and buy a WAP, and plug that in at their office, so they can one-up their co-workers.

      That practice is one reason that even clued network admins need to regularly recheck their networks for AP's. Rogue ones will forever be a pain in the ass.

    20. Re:Good God, are you Clueless? by Henry+V+.009 · · Score: 2

      I didn't attempt to justify it. But as for lax security...

      For most of these networks, a normal functioning laptop equipped with a wireless card will automatically sign on to the network with no input from the user at all, just by bringing the laptop into the general vicinity.

      No it's not lax security. I think it qualifies as no security at all.

      And if you make absolutely no attempt at privacy, if you put your computer network outside in public places (the street), then no, you don't have much right to privacy.

    21. Re:Good God, are you Clueless? by WolfWithoutAClause · · Score: 2

      Doesn't sound like really understand the technology. At the corporation I work for the standard is for WEP to be disabled, because it is garbage. According to what you say their network is insecure, but they run IPSEC on top of this, and the security should be very good indeed.

      --

      -WolfWithoutAClause

      "Gravity is only a theory, not a fact!"
    22. Re:Good God, are you Clueless? by aminorex · · Score: 3, Informative

      There's simply no way that the triangulation is
      based on ping times. They're talking about
      measurements of less than a meter, which is
      on the order of 3 nanoseconds at c. Much more
      sensible is to triangulate based on signal
      strength.

      Yes, signal strength can be spoofed *downward*,
      but for commercial cards, it can't be spoofed
      *upward*, significantly, without the spoof being
      clearly detectible. Therefore, I disagree: It
      is a very useful supplement to perimeter security.
      The ability to defeat does not invalidate a
      security measure, unless the effort and expense
      involved is below the cost/benefit threshold.

      --
      -I like my women like I like my tea: green-
    23. Re:Good God, are you Clueless? by eggboard · · Score: 2

      Does anyone know which of the newer firmware uses improved IVs? As I understand it, you can use an AP with better IVs without having to have a wireless adapter with any changes in firmware. A few companies, mostly in the enterprise space, have made announcements about their changes, but I haven't seen anything that isn't proprietary between client/AP from a single vendor.

      --
      Freelance tech journalist for the Economist, MIT Technology Review, Macworld, and others
    24. Re:Good God, are you Clueless? by JabberWokky · · Score: 2
      Yes, but it's something that I would not do, whereas I have no problem using open bandwidth. The difference? One is using something that is (intentionally or not) provided for people. Like a drinking fountain. If one sees a drinking fountain, it is presumed that it is available to everybody. Now, you can hang around a food place in a mall, wait until they are not looking, and grab soda from their soda fountains - heck, even swipe food from them. But that's theft. You *know* you're not allowed, even if their security is 'easy to get past'.

      The difference between what is wrong versus what can be done seems to be something some people cannot grasp. Bike locks are easy to break. Are you out stealing bikes while warchalking?

      --
      Evan

      --
      "$30 for the One True Ring. $10 each additional ring!" -- JRR "Bob" Tolkien
    25. Re:Good God, are you Clueless? by aminorex · · Score: 2

      That's why I qualified my statement with the words
      "clearly detectible". For raw triangulation, in
      which no more than 3 points are used, a directional
      antenna does create a new degree of freedom in the
      solution space, but that degree can be eliminated
      with just one more sample point.

      --
      -I like my women like I like my tea: green-
    26. Re:Good God, are you Clueless? by LarsG · · Score: 2

      You have to looks at the ISPs side, which is that many people can be using one DSL or Cable internet connection, when normally each would have their own connection, that would at least be dial up.

      It is neither my nor your responsibility to protect the business model of others.

      If an ISP thinks it is a problem that their customers run public APs they should put something about it in the service contract or AUP.

      --
      If J.K.R wrote Windows: Puteulanus fenestra mortalis!
    27. Re:Good God, are you Clueless? by FuegoFuerte · · Score: 2, Informative

      All the Orinoco hardware eliminates the weak IVs. Not sure what other manufacturers do this. It's completely seperate from things like 802.1x EAP. What you're talking about (proprietary things) sound like Cisco LEAP (proprietary version of EAP, which has now bean licensed to most major WiFi makers and is showing up in the latest firmware revisions). A different IV is used for every packet sent either direction, so to completely rid yourself of weak IVs both the client adapters (all of them using the same WEP key) and the AP must avoid them. If even one client adapter is using weak IVs still, there is the potential for gathering enough to figure out the WEP key. However, with each additional client that eliminates weak IVs, the amount of time it takes to crack the WEP key grows.

      An example: client and AP are both avoiding weak IVs: Airsnort and similar are completely ineffective (to the best of my knowledge).

      AP avoids weak IVs while cheap client adapter with old firmware does not: Airsnort, etc. now can crack the key, but it takes many hours (we'll say 12 hours just to throw out a number).

      Neither client adapter nor AP are avoiding weak IVs: Airsnort, etc. now take about half the time (we'll say 6 hours) to gain the WEP key, because there are proportionally twice as many packets with weak IVs being thrown across the network.

      I'm kinda tired, so hopefully that makes sense.

    28. Re:Good God, are you Clueless? by eggboard · · Score: 2

      This makes perfect sense. If you had 20 clients on an AP with full bandwidth saturation (bad network designer, bad!), and 15 of them had good IVs as did the AP, and 5 had bad, then the amount of traffic it takes is now proportionally higher based on how many packets have good IVs attached. if I understood your explanation correctly.

      Thanks, much!

      --
      Freelance tech journalist for the Economist, MIT Technology Review, Macworld, and others
    29. Re:Good God, are you Clueless? by FuegoFuerte · · Score: 2

      Yup... you understood correctly. :).

  3. heh by wolfgang_spangler · · Score: 5, Funny

    "Ekahau reckons there is a market for networks used primarily for location-based purposes as opposed to carrying other data. "

    Can't remember the last time I saw the word, "reckons" in a major publication. I reckon it was some time ago.

    1. Re:heh by Alien+Being · · Score: 2

      His use of the word "reckon" is either serendipitous or clever because it is also a part of naval and aeronautical navigation jargon. To some people, it connotes trigonometry.

      "Dead reckoning" is triangulation of your location based on your previous location and the speed, direction and duration of your travel.

      I suspect it got its name from a bunch of hippies trying to find a Jerry Garcia concert ;-)

  4. cornell by Anonymous Coward · · Score: 2, Informative

    there was a article in wired about students use triangulation in 802.11b networks for all kinds of crap. since they only have a wireless lan there, professors and students write software for it because everyone uses it on their laptops and pdas

    1. Re:cornell by FlowerPotAdmin · · Score: 2, Informative

      since they only have a wireless lan there,

      That's quite amusing, as I appear to be writing this comment from *on-campus* over a *land line*. But our operating systems course does feature an ad hoc routing assignment which uses handhelds w/ wireless ethernet cards.

      --
      -Justin
      That's enough posting for now lads, there're trolls afoot.
  5. some additional info by t0rnt0pieces · · Score: 4, Informative

    For some more info check out the company's website. Here's the page on EPE. Looks like pretty neat technology. Easy to set up and accurate to within 1 meter. I doubt warchalkers will be deterred though. :)

    --
    Karma: Excellent (In Soviet Russia, karma pimps YOU)
    1. Re:some additional info by ++good-duckspeak · · Score: 2, Insightful
      Not really clear on how much cooperation is needed from the "tracked device". The fact that the ekahu site lists requirements for such devices is a bit confusing.

      And yeah, yeah, triangulation and signal strength and stuff, but does this software do it the hard way or depend on the truthful clients?

      --
      Why is Triangle Man so MEAN?
  6. end to warchalking? by cosyne · · Score: 5, Insightful

    Not likely. The systems that get picked up by war____ers are generally the ones that someone took out of the box and plugged into the wall. Anyone who bothers to set up a triangulation system would probably already be using MAC restriction or other security measures. (Technically, you can still see a secured network and mark its location, but you could do that with a triangulation-restricted network too).

    1. Re:end to warchalking? by jtree · · Score: 3, Informative

      This technology cannot currently triangulate a war{driv,chalk,walk}er.

      I'm a researcher at Carnegie Mellon University who has been implementing this same system for the last two years.

      This type of system relies on the client (pda/laptop) to gather the raw information for triangulation and send it to the server.

      No accesspoint (that I'm aware of) is capable of gathering the information needed for triangulation.

      Details:
      An accesspoint only knows the signal strength between itself and its connected users.
      Triangulation requires the signal strength between the client (pda/laptop) and at least three nearby accesspoints for 2d triangulation.
      Current accesspoints do not record or calculate information for clients that are not currently connected to themselves.

      It would be possible after modifying the firmware on the accesspoints. The manufactures have been extremely reluctant to give this information out (even under NDA.)

      The most accurate information that could be gathered about war{driv,chalk,walk}ers is which accesspoint they are connected to.

      Joshua Tree

    2. Re:end to warchalking? by cosyne · · Score: 2

      This technology cannot currently triangulate a war{driv,chalk,walk}er.

      Well, I dunno. The implication is that the APs can triangulate, but i don't see anything in the article saying it's not the client doing the triangulation. Or maybe they have a deal with some manufactuer to get more info from the AP, or maybe you have to set up a comptuer with a PC card. Ooooor, you could just set up some simple 2.4GHz receivers which give you signal strengths and/or delays for tringulation (although that's pretty clearly not what these guys are doing).

      PS- you forgot warflyers.

  7. What is warchalking about? by gad_zuki! · · Score: 3, Informative

    >It may spell an end to warchalking.

    I thought that warchalking existed more for those who are offering wireless access to alert others than revealing the open status of another's network. Any warchalkers want to chime in? Are you guys mostly ID'ing your own WAPs or the WAPs of others?

    1. Re:What is warchalking about? by NDeans · · Score: 4, Interesting

      Because they use chalk to make a )( symbol to designate an open AP.

      As a sidenote, Schlotsky's restaraunts put up little plaques near the entrances to their stores with the open AP symbol. Such a nice thing to see, rather than the money hungry Starbucks shops charging by the minute for access.

  8. range? by bogusbrainbonus · · Score: 3, Interesting
    So they can triangulate on you and determine the position up to one meter, but from what range?

    The 802.11b network at my school fails after 50 feet.

    Don't throw away that chalk just yet!

    1. Re:range? by Gruturo · · Score: 2

      So they can triangulate on you and determine the position up to one meter, but from what range?
      The 802.11b network at my school fails after 50 feet.


      ?? If you are within range, you can connect, but you can be tracked (and thus expelled if intruding).
      If you are outside range, you can't be tracked, but you CAN'T CONNECT EITHER.

      So the idea holds true regardless of the range!

      --

      Vacuum cleaners suck. Kings rule.
    2. Re:range? by NDeans · · Score: 2, Informative

      The reason your school network fails at such a low range is because of sub-standard installation. They are most likely using the "rubber duck" antennas that came with the APs and, probably placed them in an area that is behind rows of steel lockers on more than one side. A couple of omnidirectional dome antennas installed in the ceilings in strategic points throught the school, and you'll get an awesome signal form anywhere. As far as the supermarkets having range issues, I seriously doubt they'll have any problems. The next time you go to a supermarket look around. What do you see? OPEN SPACE! The only walls in there are the 7½' aisles. With 12' and higher ceilings, all they will need are three moderately high db gain 120 antennas and they'll have the whole store getting signal strength like you were sitting next to your AP at home. And who says that they'll go for 11b when most won't be implementing this type of service for at _least_ 2-3 years (In the US anyway).

  9. oh, the irony... by jaredcoleman · · Score: 5, Funny

    There are a lot of benefits to having this ability. At work, I can now equip our parking officers with wireless PDA's and soon I will be able to make sure that they are not sleeping in the lobby of some building instead of writing parking tickets. Maybe they will actually be out to ticket people parked illegally while attempting to warchalk from their vehicle! Now that's irony!

  10. Not so new... by BrunoC · · Score: 5, Informative

    You should take a look at this article. Students at Dartmouth College have been using / developing wi-fi tracking systems for a while now. A nice way to track down your buddies at the campus.

  11. 802.11b Tracking by Wrexen · · Score: 5, Informative

    One way to get around a measure like this is to obtain a surface which can reflect EM radiation at 2.4ghz, such as AMQ coated polycarbonates or crystalline-structured metallics. By using a small set of these "mirrors" at strategic locations, you could fool the software into thinking you're actually receiving from inside the CEO's office.

    Since most modern triangulation techniques, including Ekahau's, depend on standard mathematical models of radius delta-reduction, it's trivial to set up your reflectors in such a way that the tracking mechanism can't deduce a logical place for your signal to originate from. Hopefully as location-spoofing becomes more commonplace, the government won't enact any laws restricting the use or registration of EM reflective surfaces.

    1. Re:802.11b Tracking by egarrido16 · · Score: 2, Funny


      Right, because you know, everyone who is anyone has AMD jacketed polycarbonation.

      (joke)

      --
      "Brevity is the soul of wit." -Polonius, Hamlet.
  12. Constantly diminishing signals are rare in RL by addikt10 · · Score: 5, Interesting

    Triangulation of EM is based on the assumption that the strength of a signal will diminish with the square of the distance from the source, or some other constant function with other signals.

    When was the last time you were using wireless (especially through a wall) that had the same range from the access point in any direction?

    I can't picture it working in a supermarket, with the metal shelving, compressors for the cold storage, etc. Sure, in a lab it'll work great, but with any kind of range or non-uniform building structures, not a chance.

    1. Re:Constantly diminishing signals are rare in RL by GigsVT · · Score: 2, Insightful

      Triangulation only needs to know the angle to the signal from two seperated points that are a known distance from each other. You know, like a triangle.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
  13. Silly, silly controls... by coupland · · Score: 3, Insightful

    Since a huge proportion of us who have publicly-accessible Wi-Fi networks do so by choice you have to wonder what the value of tracking users is. If people use my hub I'm okay with it as long as they're not abusing it, more power (or bandwidth) to them. I don't need to track people using my hub, if I didn't want them I would spend a few minutes reading about security and prevent people from using my hub. The only people who would need to track users would be corporations but their security departments are so damn paranoid they're barely ready to admit Ethernet may be secure, let alone cool shit like Wi-Fi.

  14. Don't be too sure. by Jucius+Maximus · · Score: 2

    The technology to fool technology tends to always be slightly ahead. Expect WiFi location spoofing to follow.

  15. Bah! by NeoPotato · · Score: 5, Funny

    I used to find people by pinging their computers! I'd ping a friend's laptop (using their Windows computer name), look at their IP, then go find them on campus. I think I scared a few people when I'd say "Stay right where you are" and walk over to the study room where they were hiding.

    Although I guess using triangulation accurate to a meter would let me say "You're on my spot on on the couch. When I get back from class, you gotta move."

    1. Re:Bah! by mindstrm · · Score: 2, Funny

      Yeah

      OR when you get on irc and notice someone is online from the university computer lab.... so you find someone else online from the same lab, and start asking them to describe said person.

      Then you pretend you are psychic by explaining to the first person what they are wearing, what they are doing, etcterea.

      Is that creepy or what?

    2. Re:Bah! by NeoPotato · · Score: 2, Funny

      Then you pretend you are psychic by explaining to the first person what they are wearing, what they are doing, etcterea.

      Is that creepy or what?


      Or you can type "INCOMING" and chuck a pen their way. Nothing like a virtual warning before getting tagged in the head with a flying object.

  16. Re:Where will it end? by LarsG · · Score: 2, Insightful

    My god, don't these people realize that everything is supposed to be free? (That's "free" as in I-should-be-free-to-take-whatever-I-want-without- paying-for-it", of course).

    That's not what warchalking is about. It is about marking open access points, not about breaking into networks.

    It should be legal to plug an AP into my DSL line, put a chalk mark on the side of the building and allow people nearby to use my connection for checking mail or the occational browsing.

    Is it shoplifting or trespass if your neighbour put a radio in the window and you listen to it while relaxing in your yard?

    Securing an AP is fairly trivial, and people who don't want the occational stranger to access their network should take the 30 seconds needed to enable WEP or password/MAC security.

    --
    If J.K.R wrote Windows: Puteulanus fenestra mortalis!
  17. No Triangulation , Just bump the power for War by notestein · · Score: 4, Interesting
    After digging through their site, it seems that they locate you by the following:

    Calibrate the positioning model - Move around the area while clicking the map to record sample points containing received signal strength intensity (RSSI) samples. No information about the access point locations is required

    And it implies that triangulation is not involved:

    Ekahau technology offers more comprehensive feature set than any competing technology on the market. The calibration-based approach is radically different from other commercial techniques, which mostly rely on signal propagation and triangulation for solving the location.

    So perhaps if you bump the power of your signal from the outside they will think you are inside.
  18. Uh oh by dr_dank · · Score: 5, Funny

    I found a new open network near my girlfriends apartment,opened up my browser to /. and saw this as the lead story.

    Perhaps I'd better log off now....

    --
    Where does the school board find them and why do they keep sending them to ME?
    1. Re:Uh oh by Dr.Luke · · Score: 5, Funny

      Mod up! This slashdotter has a girlfriend. That's much bigger news than WiFi triangulation!

    2. Re:Uh oh by Fnkmaster · · Score: 5, Interesting
      Funny thing happened the other day. My friend was over, opened up his laptop in the living room of my apartment, and started browsing. We had been making some DNS changes to a site we own, and he was checking them out, and told me they had propagated. I checked on box, and couldn't see them yet. This had us stymied for about 20 minutes until he checked his current IP address and hostname, which showed clearly that he was on Verizon DSL, whereas my apartment has ATT BB Cable - he was using the default Linksys SSID and his 802.11b card had picked up the neighbor's wireless access point accidentally. Whereupon we also discovered that we were easily able to use the default Linksys password to get onto the neighbor's router. Oh, and we found that our neighbor had three Windows boxes with open shares on them (nothing interesting in the shares though).


      For a brief moment, I questioned why I am paying for a landline feed and not just piggybacking bandwidth off of my hapless neighbors.

    3. Re:Uh oh by Gabrill · · Score: 2, Funny

      Good for you for not taking the easy piracy. They say most theives are opportunists, and this was a prime opportunity to put gay porn in their windows shares. HAHAHAHAHA.

      --
      Always going forward, 'cause we can't find reverse.
    4. Re:Uh oh by isorox · · Score: 2

      near my girlfriends apartment
      This slashdotter has a girlfriend


      Are you sure that she's not a girl he's stalking and pretending she's his girlfriend? Sounds more likely. Uh-oh, gotta go!

  19. No this isn't possible by RedWolves2 · · Score: 2, Funny

    I am walking down the street right now hijacking a wireless connection and nothing is happen to...[End of Transmission]

  20. How does it work? by Omega+Hacker · · Score: 5, Interesting

    I can think of several ways it might work, but all of them present significant challengs. Relying on relative signal level would be ludicrous, because signal level changes dramatically with card orientation, reflections, and whatever's in the middle. Heck, I get significant variance in signal level on the fixed links between the antenna on my roof and neighbor's sites.

    Using a GPS-like timing comparison might do the trick, but it's set up backwards. With GPS you have a bunch of atomic clocks in orbit, and one device correlates the relative signal phase between them. With APs, you have to have extremely accurate timing across all the APs, which is a very hard problem (I've researched it...). Once you have that, you can compare reception times of a packet from the device being tracked, and triangulate. Problem is 1 meter accuracy represents some scary clock accuracy numbers across several APs with just an Ethernet between them.

    If anyone can think of any other way to pull this off (WITHOUT modifying the client, and ideally without any special hardware, i.e. implementable in the HostAP driver), post them here.

    --
    GStreamer - The only way to stream!
    1. Re:How does it work? by Omega+Hacker · · Score: 2

      > Dunno if it can be done w/o special hardware though.

      It can't. To get meter resolution, you need a 300MHz clock (1 meter per tick) with reasonably low jitter on each AP, all locked to each other with less than one tick difference across all APs receiving a given packet. That's an effective impossibility on its own (like I said, I've done a lot of research into that problem for a semi-related project).

      Even if the chip rate of 802.11b is 11MHz (I'm not so sure, I'm pretty sure there are multiple bits transmitted at the same time), that only gives you a resolution of 30 meters, or about 100 feet.

      However, from looking at their website it appears they are indeed using signal-strength calculations. I suspect their 1-meter number is resolution, not accuracy. There's not the *slightest* chance that they can accurately pull the position of someone to within a meter, when moving your laptop a few centimeters can *wildly* change the signal level on the various APs. I know, I've done it.

      I saw a graph once, I wish I knew where, that showed the *measured* signal strength in a small cubicle room with a single door and simple desk. The interference patterns caused by reflections caused differences of 10's of decibels in repeating centimeter-sized patterns. Move a tiny bit and you could lose signal entirely. Use those numbers to try to correlate anything and you're smoking some serious crack.

      --
      GStreamer - The only way to stream!
  21. What about this by iamdrscience · · Score: 5, Interesting

    Triangulation works great in two dimensions, but when you use a third you have to do quadrangulation (is that even a word? I'll bet it is) like say you work for a company in a five story office building, when you triangulate where a person is in relation to you distance wise and in which general direction, but you don't really know where he is, maybe he's 15 meters in front of you and maybe he's 5 meters in front of you, but three floors down. They could both register as the same with triangulation. I will start the quadrangulating WiFi revolution.

    1. Re:What about this by prockcore · · Score: 2

      Actually that's not true at all. Triangulation does work in 3 dimensions. Both the standard direction based triangulation, as well as distance based triangulation.

      This deals with distance based triangulation, so I'll just touch on that.

      This works by calculating the distance you are from each point in the triangle. (based on signal strength). Imagine you're in an elevator, in the dead center of the triangle. You're now on the same floor as each point.

      Hypothetically, you are exactly 10meters away from each point. Now you hit down.. after a floor, you're exactly 20 meters away from each point. It is physically impossible for you to be on the same floor as the triangle and be exactly 20 meters away from each point, since 10 meters is dead center.

      Now.. there's only one instance where distance-based triangulation doesn't work. If you can go above as well as below the triangle. If you're 20 meters away from each point, you've got to be in the exact middle, and down one floor.. However you can also be up one floor. So that breaks it. The only way to fix it is to move the triangle so that you can only be either above it or below it.

      So put your APs on the ground floor and yes, indeed, triangulation works in 3 dimensions just fine.

      (Directional triangulation doesn't have the negative-z limitation)

  22. Re:Triangulation with one receiver? by Nerull · · Score: 2, Informative

    Actually, from my understanding, you draw a line from each reciver that goes off forever in the direction the signal came from. Where these lines cross, is the location where the signal was sent from. At least, this is how they use triangulation to find the source of radio transmissions when they want to find lost ships at sea (find where their last radio transmission came from, and start searching from there), or other such uses.

  23. Re:Where will it end? by Anonymous+DWord · · Score: 4, Insightful

    the current guesstimate is that sales will drop about 20% due to online copyright infringement.

    Anybody who comes up with any kind of estimate is an idiot, and is obviously being "funded" by some interested party. CD sales went up when Napster was in its prime. What does that mean? Nothing. Maybe the fact that we're in a major recession and people don't have as much money to blow on stuff, or that the crap they're pushing for sale... naah, that couldn't be it. It must be those Music Pirates! Arrr!

    --
    "If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
  24. Re:Triangulation with one receiver? by grishnav · · Score: 4, Informative

    One way to do it is to determine the direction the signal is coming from using two known points. This is quite easy, and can be done with even basic direction finders. Imagine that point A and point B are directly east/west of each other. Now, draw a ray from point A outward at, say, 45 degrees. Draw another ray starting at point B at, say, 275 degrees. Where they meet is the location. This form requires only two points.

    The other way requires three sites. You use a timing method to determine how far away they are. Imagine points A, B, and C (the location of the points is basically arbitrary, so long as they aren't too far apart). Draw a circle with a radis of one inch from point A (indicating the signal, determined by timing is, we'll say one mile away), and another with a two inche radis from point B. In most (but not all) circumstances, the circles will meet at two points. Thus, in most (but not all) circumstances, two will not be enough. Now draw a circle around C (I can't give you a radis length as I am unwilling to do the math in my head) to intersect with one of the other two intersections. If you've done it right, no matter how hard you try, assuming you've drawn perferct circles, the circle around point C will only meet with one of the two A/B circle intersections. This make any sense???

  25. Re:big brother? by pwarf · · Score: 2, Interesting

    You could set the laptop up to turn off the wireless card when not in use. They only know where you are if you use their network. And it shouldn't be too hard to block pop-ups on you own laptop/handheld that weren't associated with a webpage request on you end.

    However, while this won't add much to the most secure systems, it would allow companies to reduce the hassle associated with maintaining a reasonably secure wireless system. For example, a company like Starbucks might want to offer internet access to customers inside the store, but keep people from using it in the unaffiliated bookstore next door. Or, a company might want to offer internet access to visiting consultants, customers, etc. without dealing with setting up each device. (Full disclosure: I have never used a wireless LAN, so I don't know how much trouble it is to connect to one that is properly secured. I would imagine it could become at least an annoyance.) If a company was willing to assume that the building was secure, they could allow access from any point withing the building. If you were paranoid, you could limit this to business hours.

  26. This is similar to whiteboard capturing by Dr.Luke · · Score: 4, Informative

    Whiteboard capturing devices use a similar principle. Two microphones are at opposite ends of the whiteboard and an ulrasound emitter is attached to the pen. When you move the pen the CPU unit attached to the mikes triangulates the postion of the pen and renders the digital image of the whiteboard. I always thought it was a simple and elegant solution compared to the touch sensitive whiteboards that cost much more. Another company now has a mini version of this technology for iPaq which attaches to a normal writing pad and allows you save anything you write on your iPaq.

  27. Another Excuse by Gabrill · · Score: 2, Funny

    To buy more Wi-Fi repeaters! My wife is gonna kill me when the bills come due!

    --
    Always going forward, 'cause we can't find reverse.
  28. New toy for the BOFH... by sigsegv_11 · · Score: 2, Funny

    I can see it now.. the BOFH getting out of a weekend at the helldesk because the Boss spent forty-five minutes in the bathroom the day before downloading pictures from nymphoasianlesbians.com. Bring on the blackmail and the lawsuits!

  29. Heh. Not so quick guys. by jeremyacole · · Score: 2, Insightful
    I wouldn't say this will be the end of warchalking, more like a cool toy with some very practical (and very scary) applications.
    Even the very term "triangulation" implies that you'll need 3 access points to do it.
    • With 1 access point, all you can tell is a VERY rough "how far away are they". A lot of other factors affect signal strength and timing (reflections make a big difference), so this is not at all reliable.
    • With 2 access points, you can get a bit more accurate about where they are, but not *that* much because of all of the other factors.
    • With 3 access points, you can generally locate a signal rather well, because they can see more points, and in particular if the 3 APs are located in a triangular fashion, with the user in the middle, youcan quite accurately track them.
    The accuracy of the system will be almost entirely dependent on the number of access points that a user can see at a given moment, the more APs, the more accurate. Just like GPS.
  30. Re:Heh. Not so quick guys. by Da_Monk · · Score: 2

    not really, triangulation means two detectors, one working on the x axis, saying left or right is stronger, one working on the y axis saying up or down is stronger. the third point in this trangulation is the transmitter you are hunting. your explanation is correct for 3d space. where you would need a z-axis detector.

  31. Re:Assimetric aerial (and a new hobby) by driehuis · · Score: 5, Interesting

    Yes, it will confuse it.

    Their method will probably even fail if you switch WiFi cards. I've got a Compaq WL110 which has a range of about 10 feet. My Lucent card on the other hand sees the access point from 100 feet, without line-of-sight (I assume the radio waves bounce off the ceiling through the window; no other way to explain _that_ range).

    My access point has antennas that can be moved into different polarisations, and in an off-colour configuration, access without line-of-sight becomes really spotty: it works in one place, and a few feet to the side it stops.

    But it seems to me the point of the seller is not to track abusers, but rather to track known-good devices in a known area. That alone is a cool concept, if you see what contortions people go through now when designing warehouse positioning systems. I've seen the results of an automated fork lift running through the wall of a warehouse because the reflective pad that marked the end of the aisle was covered in grime.

    Hmmmm, I can envision the next hobby: sit outside a warehouse with a 2.4GHz klystron, wait until you hear the fork lift come down the aisle, then switch on the jammer and watch the fireworks :-)

    --

    Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.

  32. How Microsoft did something like this by ntk · · Score: 4, Informative

    Microsoft Research did some work on this a couple of years ago - they called it RADAR.

    The equations they use are pretty simple, and they seem to be getting very optimistic results. They, too, use signal-strength triangulation, together with a model of the local area (so you feed in how many walls are between you and the AP, for instance), and some processing based on recent history. That's to say, four out of the five latest samples have you outside on the pavement, and one of them has a 50 yards away in the eastern wing, you're probably still on the pavement.

    Venkata N. Padmanabhan has some more papers on this on his homepage. Victor Bahl has a demonstration here but I guess it only works on IE.

  33. much easier solution by g4dget · · Score: 2

    Just use a slightly directional antenna--anything that relies on signal strength to triangulate you will end up being way off. If you set it up carefully, you can even choose your "virtual" location. And, no, the government can't really outlaw directional antennas.

  34. parent post is complete nonsense by g4dget · · Score: 3, Interesting

    TCP/IP has nothing at all to do with this, nor Zipf's law, nor any inverse square law, nor any kind of physical model. The system simply builds an empirical numerical model relating received power at the access points to location. As long as received power varies reproducibly with distance (not even necessarily monotonically) and you get enough independent measurements, that is possible.

  35. not required--no "triangulation" involved by g4dget · · Score: 2

    If the system used triangulation, you would be right. But it doesn't. All that is required is that relative signal strengths are reasonably reproducible for each location and that you have enough measurements to distinguish all locations you are interested in. The system internally produces a map of which combinations of signal strengths correspond to which locations. To reduce the number of calibration points you need, you can try use interpolation between nearby measurements, which will usually work reasonably well/

  36. Don't forget the "Tri" in "Triangulate"! by SlimFastForYou · · Score: 3, Insightful

    Not the best option if you want security... Triangulation requires 3 WAPs in distinctly different spots. Most home users don't have a WAP in their kitchen, bedroom, and bathroom. It may be argued that universities have WAPs all over the campus. That may be so, but is a wardriver usually in the range of 3? I am no expert on campus WAP placement, but the only places I immagine could be triangulated would be roughly the center of the campus. So while multiple gradebooks are being accessed by a host with an unknown MAC address, the triangulation software will say "Not enough base stations to determine location".

  37. Re:Heh. Not so quick guys. by eyegor · · Score: 2

    That also depends on your beam shape. If one uses an antenna that receives a very narrow beam but has a lobe at 180 degrees in addition to one at 0 degrees (and is steerable), you'll be able to trianglulate easily on the signal unless the signal originates at or near a point between the two antennas. The error elipse would be rather elongated at that point. If the source was at 45 degrees relative to both antennas, your error elipse would be small and you'd have an accurate fix on their location.

    When calculating position on range alone, two antenna sites will indeed result in two intersection points, but that's not really trianulation anyway.

    --

    Don't anthropomorphize computers, they don't like it.
  38. Re:Triangulation with one receiver? by DMBoyd · · Score: 2, Informative

    actually u need three.

    go test it out.

    get a compass and two points 4 inches apart. if u know a user is 3 inches from one point and 2.5 inches from another point there would be two possible locations the user could be.
    you need three points.
    u only have signal strength(which is prop to distance) not angles. so you need three points to clarify any point in two dimensions. And four or more to more acurately place a point in 3 dimensions.

    its like gps'es
    http://www.howstuffworks.com/gps1.htm

  39. Free Wi-Fi Tracking Software by mtodd78 · · Score: 3, Informative

    The research group I work in used many of the same techquies that this software company uses to create Nibble which also can do positioning using Wifi; http://mmsl.cs.ucla.edu/nibble/. Free. GPL'd source is available too.

    Things to note, however, about any 802.11 tracking software it that its accuracy is poor > 5 meters, unless you are using 5 or 6 *simultaneously* accessible access points (it even states this in the Ekahau manual). Tracking software can be thrown off by even seemingly minor enviornmental changes like crowds of people etc. Also some calibration is also required.

    Don't worry about this shutting down free access points as it is way harder to do location tracking than it is to set up an encryption system (even really good VPN style encrytion) or a simple MAC address filter.

    Mike

  40. How this works (not triangulation) by kazad · · Score: 3, Informative
    Hi all, this is my first /. post. I did a research project last semester and implemented a system like this, and got about 1 meter accuracy on average.

    Rather than using signal strength for triangulation, you use it to record a "radio map", and compare your current position to the map. The basic steps are:

    1) Walk around a room, recording the signal strength to each AP (so you get a file such as "Access Point #1, Avg signal: 96 AP#2, Avg signal: 74 ..." ). Netstumbler or other software can help you make this file.

    Create a "profile" like this for every location you wish to map (roughly, one every square foot or meter). The number of profiles determines the granularity of the system, but too many profiles can cause "collisions" in the sense that different locations have similar profiles, for some reason or another. There are ways to combat this, one of which is to make an educated guess on the new location based on the last one. (i.e., the user could not have walked over 10m in one interval)

    2) When a user connects, they can compare their current signal strength info ( such as AP#1, signal: 34 AP#2, signal: 74) to the map: the closest point is probably their location.

    I did a simple euclidean distance calculation (taking each profile as a vector in some large space [cool how the pythagorean thm. generalizes, eh?]. There are many better ways, which I am researching this semester, but euclidean distance is fine for now.

    I'm pretty sure this is why they must spend an hour per 10,000 square feet to "calibrate" the system. I had to do the same, but it was a *lot* slower; I need to make a tool to do this automagically.

    This semester I am also looking to get my system working with an ipaq robot running familiar. It's the combination of the palm pilot robot kit and this positioning system. Hopefully, the little robot should know (roughly) where it is, and be able to be controlled via the internet.

    Check out my webpage if you are interested in more details.

  41. one problem with triangulation by v1 · · Score: 2, Informative

    Odds are about 100% that if you are setting up multiple wifi base stations, you are placing them for optimal coverage of your own intended users. Wifi triangulation works best when the user is somewhere within the perimiter of the base stations, and works most poorly when the strongest received signal is a station on the perimiter.

    So to accurately determine if someone is outside the intended coverage area, wouldn't you really need to deploy additional base stations? For instance, if you have three stations at your business, one near the front, and two in the rear corners of your building, and someone is wifi'ing in from the bus stop bench outside, he's going to hit the front station and not do much for the two in back. It's very hard to tell this user apart from someone just inside the building and very near the front base station. To settle this, you'd need a base station like across the street or something.

    I don't see wifi triangulation as a practical way of identifying users outside the perimiter for this reason.

    It's also worth noting that it would be a poor choice to place the base station right at the front of the building, because you'd be wasting 50% of the station's coverage area. But to pull the stations in toward the building's center would further degrade your triangulation abilities because relative signal strength differences would lower your triangulation precision.

    Just tossing ideas out, I'd propose the best way to keep warchalkers out if that is your intention, is to deploy your base stations in such a way as to not provide (effective) coverage to areas outside your premisis. If your business is already too small to keep coverage just inside your building, then obviously buying several base stations to try for triangulation is patently absurd.

    Of course, my final suggestion would be to openly allow public access, and use it as a P.R. booster. Free advertisement is handy, and in most cases, this would almost be free.

    For the entrepeneur: I haven't seen anyone selling warchalking plaques yet. I bet there are some businesses out there (cafe's etc) that would buy a custom made brass or bronze wall plaque they could affix to the outside of their buildings to attract more customers.

    --
    I work for the Department of Redundancy Department.
  42. No, he's right. You need 4 by pclminion · · Score: 2
    The first station pinpoints your position on the surface of a sphere in 3D space. The second station pinpoints you on a different sphere. The intersection of these two spheres will be a circle in space. Now, a third station pinpoints you on yet another sphere. The intersection of this sphere with the circle will be a set of two points. In order to tell which point, you need a fourth station.

    Unless someone can point out a flaw in my logic.

  43. Wave dispersion? by pclminion · · Score: 2
    In theory, you could tell how far the signal travelled through air by examining the dispersion of the wave at the receiver. Different frequencies travel at slightly different speeds through a medium (but not through vacuum), causing the different frequencies to spread in time. In theory you can use this to tell how far the wave travelled.

    The effect may be far too small to use in practice, though.

  44. Right answer, wrong reasons. by wirelessbuzzers · · Score: 2

    You're right, you need four, but this isn't why, and the math is ugly. You can't tell how far away a signal is from a given point, unless it's broadcasting with known constant strength or sending a time signal or something like that. What you can tell (sometimes) is how far away the signal is from router A, compared to router B. You might have a ratio of distances, or a difference of distances, either of which pinpoints location on a hyperboloid. This surface is two-dimensional, and for every reference you add, you strip off one dimension, so you need two more references. After that, the solution will be unique with high probability, as long as your references are not coplanar. The math, requiring simultaneous quadratics, is not pretty.

    If you could tell the exact distance to the signal from each access point, you could probably place 3 of them cleverly to give you a good location. For example, if the access points were on the top floor, you take the solution below them, unless you believe the person accessing your network to be warskydriving.

    --
    I hereby place the above post in the public domain.
  45. Re: re-checking for access points? by King_TJ · · Score: 2

    I'm not sure this "party line" of "check your network often for rogue APs" is all that sensible of a solution.

    I'm not saying there's anything wrong with doing it, if you so choose. I just feel like it's playing "whack a mole" with a technology that network admins would be better off dealing with "head-on".

    If a given environment requires a high level of security from people outside the building gaining network access, they should make efforts to block the radiation of the wi-fi signal beyond their perimeter. A farraday cage of sorts could be constructed to shield the signals from getting out. This might make a lot of sense in the construction of new bank buildings, for example. (Just place wire mesh behind the drywall that goes up against outer walls.)

    For those unwilling to go this far to solve the problem, it still seems like good network practices should "save the day". Let's say, for example, war-driver X does find your sale guy's new, unsecured access point, and gets on your corporate LAN. How is he/she any different from a visitor who decided to plug his laptop into an available network port when he sits down in one of your company's conference rooms for a meeting?

    In both cases, you'd assume the person wouldn't be able to do much more than get issued a valid IP address and be able to "ping" stuff. He/she doesn't have a username or password, so therefore, no security granted to modify or open any resources. (Or is your network lacking security on important files and/or directories, so all users get default access? If so, *there* is your primary issue!)

    Even if your only concern is that war-driver X not be able to bum free Internet access off of you - that's solvable too. If you set up a front-end that requires authentication before using the web (or ftp), you can stop that. Of course, your employees might resist the inconvenience of having to "log in again" to use the net each time.... but hey, you should really be logging what sites they're visiting anyway if you're concerned about security and legal liability.

  46. Re:not really the end... by kylegordon · · Score: 2, Insightful

    "Warchalking means exposing unsecure Networks. "

    Bollocks it does! I'm fed up hearing this negative view of warchalking coming from people who don't have a clue. I have a warchalk symbol outside my house to denote that I give free net access, not that I have 'an insecure network.' Warchalking is about telling others what is available, and it doesn't imply that the network is insecure or illegal in any way.

    No wonder warchalking is getting so much bad press these days. Next I'll be having the Police at my door, arresting me for being a hacker on my own network and telling others about the free net access I've found.

    Bloody idiots.

  47. Re:not really the end... by Gordonjcp · · Score: 2

    /me dials...

  48. Re: re-checking for access points? by RollingThunder · · Score: 2

    You raise some good points, but Joe Salesman plugging in an AP - even if it's already strictly against policy - will usually be a big problem.

    If conference rooms are set up to allow outsiders, then if you're sane (and you were able to get your bosses to cough up the money, admittedly), it's set up in a DMZ of it's own, unlike the internal networks.

    Now, I set up my DHCP in a paranoid fashion - if I don't know the MAC, it doesn't get an address... but that's often not workable for bigger places, and if the WAP-adder has enough technical savvy, he may realize he needs to make his WAP pretend to be his old box by MAC, and get on that way. If the WAP is handing out it's own addresses to those that connect by it, now you can't MAC filter anymore.

    And once the person's on the inside LAN, a little bit of arpflooding (which, admittedly, your IDS should be picking up, but folks often don't have them internally because of the false alarms all the time) will make the switches failover and start acting like hubs - and he can sniff away at traffic to get passwords.

    In essence, I view it not as re-checking for AP's specifically, but just another part of the constant check and recheck of your setups that you need to do to see if something has been changed in a way to break access controls that exist. HIDS, NIDS, tripwire, etc all factor in to this, making sure you haven't opened up a new vulnerability is just part of the big picture. It won't make you safe in and of itself, but neither should it be ignored based on trust that the rest is all "strong enough".

  49. There's a much more interesting use for this... by ecloud · · Score: 2
    ...than security.

    Remember this? They used an ultrasonic echo-location system to build a spatial "mouse" which could be used to turn posters on walls into "smart posters" (click here to turn the lights on and off, etc.) and also to track users within their lab, so that your phone calls are forwarded to the phone nearest you, etc. At the time, I thought, how redundant... they need ultrasound for tracking and an RF system of some sort to transmit "clicks". Why not just use a wireless network and come up with a triangulation method to find the location of the WiFi device using its own emissions. Well now it's been done. So it should be possible to use a PDA with a WiFi card as that magic 3D mouse thing. Imagine having location-relevant UIs for things: as you walk down a hall you get light-switch controls on your screen for nearby rooms, a map, the meeting schedule for the nearby conference room, reminders about stuff you need to do while you are in this area of the building, instant-messaging informs your colleagues that you are nearby, etc.

    Of course for smart-poster purposes, the resolution ought to be better (1 meter isn't good enough) but perhaps that could be improved.

    I think in the future location tracking will usually have 2 tiers: outside you use GPS, and inside buildings you use radio-triangulation of some kind. It will be a sort of standard eventually. Because you need higher resolution indoors, for various reasons. And since buildings don't move, the building triangulation system can tell you precisely where the building's "origin" is in lat/long space, so you would still be using GPS-style coordinates, just with greater accuracy in indoor situations. Instead of being deprived due to the fact that GPS signals don't penetrate well enough, you actually get better quality.

    Anybody else tired of security always being in the limelight? Yes we need that kind of geek very much, but fundamentally their job is a lot more boring than what's going on in the research labs... And these security "mine's bigger than yours" wars are getting almost as annoying as the MS hate-fest, or the Apple hate-fest of a decade ago.

  50. RF Monitor Mode by Andy+Dodd · · Score: 2

    http://www.kismetwireless.net/
    While it wouldn't be implemented on the AP itself, 3-4 cheapo PCs with WLAN cards could easily be set up as packet sniffers that would show signal strength of all clients in the area.

    http://www.instant802.com/ (I think) - AP with open firmware.

    --
    retrorocket.o not found, launch anyway?
  51. Bah... by Andy+Dodd · · Score: 2

    Well, I see you've already been modded down.

    Good.

    Except for the smallest of businesses, more than 1 AP is needed.

    My building has at least 4. (Using Cisco LEAP - Our admins aren't stupid.) I believe one in each end (north/south) on each floor. I would classify ourselve as medium/small. (2-floor building, not that large. There are MANY office buildings in this area that are MUCH larger)

    --
    retrorocket.o not found, launch anyway?
  52. Power Glove by Andy+Dodd · · Score: 2

    The Mattel Power Glove also worked this way

    --
    retrorocket.o not found, launch anyway?
  53. Antenna by Andy+Dodd · · Score: 2

    Big problem with your system - The Pringles antenna

    Using an antenna like this will make your position fix dependent on not only the client's position but on its orientation too.

    I suggest trying an omnidirectional antenna of some sort. (http://www.aerialix.com/ has cheap kits based on the Guerrilla.net designes)

    --
    retrorocket.o not found, launch anyway?
  54. Re:Assimetric aerial (and a new hobby) by driehuis · · Score: 2

    Cards can be calibrated as well.

    Uh-huh. I agree. But I think I pointed out that if you control the client PC cards, you have an entirely different situation than the big brotherish scenarios where unwilling users were to be traced, that started this whole thread.

    I recently made a tour of a mountain side, and according to my GPS wound up 100 meters higher than the top. To my recollection, I had at least one foot in solid contact with the mountain at any time. I checked the GPS's reported EPE and the difference between its datum and MSL, but neither could explain that difference. Signal reflection could.

    My IEEE 802.11b card has an external aerial that I can orient for maximum interference (and of course, I've been toying with that to explore the interactions with my adjustable base station antenna, weren't you warned that /. is a geek site?).

    --

    Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.