Slashdot Mirror
Locate Any WiFi Router By Its MAC Address
coderrr writes "SkyHook Wireless has been wardriving the US for years creating a huge database mapping wireless routers' MAC addresses to their physical locations. They provide an minimally documented API (docs here) which allows anyone to query the database directly for any MAC address. This could potentially allow some malicious individual to find out exactly where you live. Of course for them to get the MAC of your router in most cases will require either being infected with malware or some sort of social engineering attack... Imagine if you got a phishing email that included your home address."
This is exactly why it's a *good* idea to steal internet access from the neighbors.
Someone tell San Francisco!
Er, isn't it illegal to wardrive in some states [Florida] in the first place?
And then putting out the MAC address publicly, like finding someone's SSN and posting it publicly. Oh, I guess its the owner's fault for not securing it.
slashdot rocks
This is perfect for when IPv6 takes off, with its built-in MAC address. Then my website can scare people shitless by greeting them with a note saying exactly where they live.
Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
That's the only reason I can think of for this story suddenly coming up right now--this is what the iTouch uses for its location-detection (and I suppose the iPhone uses it, too, in conjunction with its cell-tower/GPS thing). I never knew about it until I had reason to look it up and find out how my iTouch knew where I was.
I thought it was a little creepy the first time I realized my iTouch knew more-or-less my exact location--but on the other hand, it's also kinda neat. Too bad it only works in urban areas.
Editor Emeritus and Senior Writer, TeleRead.org
So all I have to do to be "safe" is to change the Mac address the router spits out? Ok. Not that there was any real risk to begin with. As the summary says there would have to be some malware present that had access to my internal network to send the mac to then look it up. Plus, I don't have the same router I did a year ago. Plus, they'd have to figure out which house I live in. Plus, I think spam with my address wouldn't phase me.
Well.. maybe. Or Maybe not. But Definitely not sort of.
Of course for them to get the MAC of your router in most cases will require either being infected with malware or some sort of social engineering attack.
NORM : Security, uh Norm, Norm speaking.
DADE: Norman? This is Mr. Eddie Vedder, from Accounting. I just had a power surge here at home that wiped out a file I was working on.Listen, I'm in big trouble, do you know anything about computers?
NORM: Uhhmmm... uh gee, uh...
DADE: Right, well my BLT drive on my computer just went AWOL, and I've got this big project due tomorrow for Mr. Kawasaki, and if I don't get it in, he's gonna ask me to commit Hari Kari...
NORM: Uhhh.. ahahaha...
DADE: Yeah, well, you know these Japanese management techniques.... Could you, uh, read me the number on the modem?
NORM: Uhhhmm...
DADE: It's a little boxy thing, Norm, with switches on it... lets my computer talk to the one there...
NORM: 212-555-4240.
If someone has some sort of malware running on my computer, they don't need my router's MAC address to find out where I live. And in that case, them knowing where I live is the least of my problems.
Most routers these days let you assign or clone a MAC address. If you find your MAC address on the list, change it.
You don't need malware or anything else to get a router's MAC address, it's in every packet the router sends out.
And you can't easily get an exact street address from wardriving. All you know is somewhere along the antenna's main lobe there is a router. Could be 10 feet away, could be 500.
And knowing the MAC address is of no earthly use. Well, in the old days you could map it to a ethernet chip manufacturer, but now most routers have changeable MAC addresses.
You can't map MAC address to email addresses either, as the summary claims. Sheesh.
I've always used amusing phrases and repeated words on any AP or NIC that lets you change the MAC (tons of linksys models for example)
Its pretty funny what you can come up with only 0-9 and ABCDEF :)
Someone should show this to those clueless municipal IT folks out in San Francisco
I believe Skyhook uses the Wireless Antenna's MAC Address, not the WAN Port MAC Address. So, you'd have to be within proximity of the WAP in order to get that information anyway, which means you know about where the WAP is in the first place.
Buttons aren't toys.
A lot of different theft-recovery packages report the WiFi router and MAC address back, so this could theoretically be used to recover a stolen laptop that went back online.
The doom predictors have been wrong the last several hundred million times in a row. So are you. Welcome to the world's longest conga line, friend!
Wigle has been doing this for years and years. They're also almost completely open and cross platform. Besides, if anybody wants to know where somebody is, there are a lot easier ways than trying to link a an address from the media access control layer to some coordinate on a map.
I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
I put together a quick and dirty web implementation if anyone wants to try this out: http://puddleboy.com/MACLocate.asp
Does he verify / update the data from time to time? Given the atrocious life expectancy of your typical Chinese wall-wart power supply that comes with the standard Best Buy / Circuit City-bought router and Americans' propensity to simply buy a new router when their old one appears to die (when 90% of the time it's just a dead power supply), I'd think this data would get stale pretty quickly.
This could have been brought to my attention YESTERDAY!!!
Well, there's spam egg sausage and spam, that's not got much spam in it.
This was exactly what I had in mind when I bought my 12 gauge.
"The actual query is done inside of their compiled code, so itâ(TM)s a secret and no one will ever figure it out."
This is the most retarded statement I've read today. He even goes on to say that he 'reverse-engineered' their XML... a format designed to be entirely human readable. Will he try cracking HTML next?
Really this whole story is a bunch of sensationalistic nonsense.. you've had similar reverse lookups for ip addresses for years and unlike MAC addresses those are publicly broadcasted on the internet.
Imagine if I got a phishing email that included my home address? What difference does it make what information it contains? It's still obviously a phishing email and I'm still just going to forward a copy on to abuse @ whatever domain they're impersonating and then dump it in the spam folder.
I still don't understand how phishing actually works on anyone... once you understand a basic concept - never follow links from emails that are soliciting information - you'll be fine. I guess people are just hopelessly uneducated about it.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
First: I use Comcast. Over the past 3 years, I've replaced wireless routers 2 times (in 2 different homes). The only thing I needed to do to set up a new router was to power-cycle the cable modem; I did not need to change the router's MAC address.
Second: in any case, even if you use some ghetto ISP that tracks router MAC addresses, the external MAC (what the cable modem sees) and the internal wireless MAC (what the wardrivers see) are different and completely independent. You can easily change one without changing the other.
I thought that SkyHook was a project developed by some military to extract insurgents from hot zones using tethered light-up balloons!
Only when the person is too much of a poser to not find the hidden SSID.
Plenty of devices with an 802.11b radio, especially handheld devices, cannot connect to networks with hidden SSIDs. (A lot of them can't do WPA either.) If you use one of those devices, you have to reconfigure networks that you administer not to hide the SSID.
This thing has the potential of turning your laptops wifi card in a poor man's GPS.
Just check what wifi networks you see, check for them in the db and find your position using signal strength to weight the AP positions.
It would work quite well in densely populated areas.
I have been thinking for long about doing something similar with your cell phone. Just check the visible towers, ask google their coordinates and geolocate yourself (if only the symbian API gave you info on other cells apart from the one you are connected to).
Thank goodness my router has MAC address clone, like virtually everybody's. I think I'll set mine on some kind of rotation.
Isn't this exactly what Google's location api does? Only without the cell tower and GPS functionality?
http://code.google.com/p/gears/wiki/GeolocationAPI?redir=1
I would imagine it would be hard to compete by wardriving when Google has an army of mobile phones querying where they are reinforcing the database.
Great article in 2600 about a similar topic. You can add the MAC address of someones phone to the network instead of the MAC of a wireless router. Whenever their MAC address is picked up on the net it updates the physical location of that MAC address. You can basically track where a person is at all times. If they have an IPhone or something similar you just need to be near the target person with a access point, the iphone will try to acquire a connection automatically and oh was that your mac address your phone just gave to me. Thanks.
I have a Verizon FiOS Wifi / ethernet router. I poked around the settings for the router but I couldn't find its WiFi MAC address listed anywhere.
Anyone know how I can found that address? (On my client I'm running Ubuntu 8.04)
The iPhone already uses this service for AGPS and A-cell-tower-triangulation. It was added in a 1.x update well before the 3G was released.
My Program Vistumbler does this also...I wouldn't thing the idea is new in any way
Vistumbler has an option to export data to a wireless database. So anyone could share their scan data. Right now the WifiDB is still in alpha stages though.
http://www.vistumbler.net
I live in Canada and moved over a year ago.
When looking up my mac it gives location for my old address.
But, it had the location pretty much bang on. And this was in a townhouse of over 100 small houses.
Wonder if the data in the US is newer.
Wifi OTOH using radio allows anyone in range to find out its address. Thats the problem.
So what? There is nothing anyone can do with my MAC address unless they are within range of my router (on the same cable for hard-wired networks). I just don't see how this database would be of any use to someone a number of hops away from me.
Assuming no hacked hardware between us, my MAC address isn't available for a remote site to look up based upon an IP connection.
Have gnu, will travel.
and change your MAC every second
yes | awk '{system(sprintf("ifconfig eth0 hw ether %02x:%02x:%02x:%02x:%02x:%02x; sleep 1", int(255 * rand()), int(255 * rand()), int(255 * rand()), int(255 * rand()), int(255 * rand()), int(255 * rand())))}'
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
IPv6 does have a mode where it autoconfigures devices using a munged version of the MAC address as the lower 64 bits of the address. (It's an ugly munge, not simply a 16-bit subnet plus 48-bit MAC, but in some sense it still gives you Netware-like autoconfig.) It's not clear how many people are going to use that mode, as opposed to a DHCP-replacement mode.
But that's not going to leak information about the wireless, because typically nobody outside your building is going to talk to the IP address of the wireless side of your router. Either they're going to talk to the IPv6 address of one of your computers, so they might see the MAC address of your laptop, or they might see the MAC address of the Ethernet side of your firewall, but that's different from the MAC address of the wireless side.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
So some kids wardriving with a gps found a WAP. Big freakin deal... The stumbling software records the cordinates (usually) for the strongest signal point, that doesn't mean there will be pin-point locations to where the WAP is. Congradulations, you found their neighborhood but are still quite a ways away from finding their actual address unless you feel like stalking them. I highly doubt nigerians will spend their hard earned money to come to Arkansas to find a wireless network called 'guess what i did to my sister'.
~ Area-51
http://www.radioactiverussian.com/
"an minimally documented API"? Is that like being "an hero"?
let yOUR conscious be yOUR NECROTIC DOG PENIS.
Isn't the wireless AP's MAC address (what you'd see when wardriving) usually different from the WAN port's MAC address (where all external traffic comes from) anyway?
In IPv6 autoconfiguration, a node forms its address by concatenating a prefix broadcasted by the router and a suffix based on its own MAC address. The leaked MAC addresses would be those of the computers behind the router, not of the router itself. The prefix used would likely be provided by the ISP or tunnel broker, in much the same way that the ISP hands out IPv4 addresses today.
This would be a great DB to have for my custom lojack that reports back to my server the AP SSID and MAC address that any of my laptops are talking to. I'd be able to go to the location myself and verify the AP MAC address is still there, triangulate where the source is, and then notify the police so they could get a search warrant and recover my laptop.
One big flaw in this system - as I understand it, MAC addresses are not globally unique as IP addresses are. It's a 48-bit address, but the first 24 are the vendor's ID, leaving only 24 bits for a unique device ID (and these do get recycled). This is good enough in the scope of a local LAN, but Skyhook's system seems to depend on these being globally unique, which isn't the case.
Anyone know how they deal with this?
A-GPS uses Cellular network cell IDs, *not* router MAC addresses. See the wiki for an explanation of A-GPS.
Well done mods for pushing this mis-information up.
wow...that was hard to overcome.
ap01(config)#int Dot11Radio 0
ap01(config-if)#mac-address 0019.a9cd.c141
ap01(config-if)#int Dot11Radio 1
ap01(config-if)#mac-address 0019.a9ce.c142
Just changed both my radios.
what a waste of gas and time to have driven around for something that can be changed so trivially.
Maybe mac addresses should contain hourly water usage so hackers can tell how many times you take a dump.
You know... Those people in them action movies about hackers have been able to do this for years.
On a serious note, this is a bit... unsettling.
I am not devoid of humor.