Slashdot Mirror

← Back to Stories (view on slashdot.org)

Locate Any WiFi Router By Its MAC Address

Posted by kdawson on from the reverse-lookup dept.

coderrr writes "SkyHook Wireless has been wardriving the US for years creating a huge database mapping wireless routers' MAC addresses to their physical locations. They provide an minimally documented API (docs here) which allows anyone to query the database directly for any MAC address. This could potentially allow some malicious individual to find out exactly where you live. Of course for them to get the MAC of your router in most cases will require either being infected with malware or some sort of social engineering attack... Imagine if you got a phishing email that included your home address."

13 of 204 comments (clear)

  1. Security by Anonymous Coward · · Score: 5, Funny

    This is exactly why it's a *good* idea to steal internet access from the neighbors.

    1. Re:Security by cant_get_a_good_nick · · Score: 5, Insightful

      My niece asked me this, should she jump on someone elses WiFi, but this happened right after the big kerfuffle about the DNS hack.

      You realize that you're giving all your data and control over to a machine that you don't control. You hope that it's open because the person is either an idiot or a good guy, but you have no evidence of either at that point. Even something as simple as checking your mail might give people access to your inbox, and all the 'password reset' notices you get.

  2. Quick! by Anonymous Coward · · Score: 5, Funny

    Someone tell San Francisco!

  3. Legality of this by ilovesymbian · · Score: 4, Insightful

    Er, isn't it illegal to wardrive in some states [Florida] in the first place?

    And then putting out the MAC address publicly, like finding someone's SSN and posting it publicly. Oh, I guess its the owner's fault for not securing it.

    --
    slashdot rocks
    1. Re:Legality of this by creepynut · · Score: 4, Insightful

      Unless I am mistaken, securing a wireless router does not stop anyone from seeing its MAC address.

    2. Re:Legality of this by grayn0de · · Score: 4, Informative

      Only when the person is too much of a poser to not find the hidden SSID. Not everyone knows how, though it is incredibly simple. That is the reason why we have security through obscurity, to begin with. Also, to comment on the topic, it does not take social engineering to find the MAC address for a router. Almost every stumbler does that, by default, out of the box. Many will show that there is a hidden SSID, but they may still show the MAC address. Even if they don't, the SSID can be found and the router cracked.

    3. Re:Legality of this by Sethb · · Score: 5, Informative

      Yep, there's even a company called Navizon that's building a competing service to Skyhook, yet they pay individuals to collect the MAC addresses (as well as Cell tower IDs) with their GPS-equipped devices, so that those without GPS can still obtain their location. It integrates with the new Fire Eagle software/service from Yahoo too.

      Here's a link (with my referral code inserted): Navizon

      Skyhook has zero data in the city I live in, though I did eventually figure out how you could submit a MAC and coordinates to their system, and fed mine in, so at least my iPhone-owning friends will know where they are when they're at my house...

      --
      When in danger or in doubt, run in circles, scream and shout. --Robert A. Heinlein
    4. Re:Legality of this by ElectricTurtle · · Score: 5, Interesting

      That, and MACs aren't a serial number per se (granted blocks of them are assigned to specific manufacturers, but there's a reason that network hardware devices always have S/Ns in addition to MACs), they are ADDRESSES. They are SUPPOSED TO BE KNOWN. It makes no sense that people would freak out about somebody knowing the MAC address of their wireless but not the street address on their mailbox. Oh noes! Somebody might use their 31337 h4x0ring skillz to send me spam and phishing attacks to my interweb mail! Like they don't already? Somebody could send a pipe bomb to your physical mailbox too. Better hide that address, oh wait, you can't.

      Stop scaring the sheeple. I know it's kind of fun, but it's bad in the long term. That's how we get stupid legislation like banning wardriving or public access points/mandatory encryption.

      --
      I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
  4. Perfect for scaring people by QuickFox · · Score: 4, Informative

    This is perfect for when IPv6 takes off, with its built-in MAC address. Then my website can scare people shitless by greeting them with a note saying exactly where they live.

    --
    Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
    1. Re:Perfect for scaring people by blair1q · · Score: 4, Interesting

      You mean as though you looked up their name in the phone book?

      Duh.

      One of the points of IPv6 is to get rid of the kind of Internet invisibility that allows spamming and phishing to flourish. Being on the Internet will be like being in public. Privacy will be opt-in. Any community you join will have to agree to allow you to hide yourself. You will be able to hide your identity from other users on a content provider (like here on /.) but you won't be able to hide from the content provider as you DOS his account-creation system or scan his ports.

      Will this create tracking-privacy issues? Sure. But we can deal with those by exercising our right to control the agencies that would use that data. It will prevent much more pervasive problems involving people we don't have legal control of until we catch them.

      You will have the same freedoms you now have - maybe more as you won't have to alter your personality to duck from the trolls or hide your email address from spammers; your security will be increased; and your in-box will have your email in it instead of a flaming bag of crap every morning.

  5. Screw you guys, I liked the movie. by Anonymous Coward · · Score: 4, Funny

    Of course for them to get the MAC of your router in most cases will require either being infected with malware or some sort of social engineering attack.

    NORM : Security, uh Norm, Norm speaking.

    DADE: Norman? This is Mr. Eddie Vedder, from Accounting. I just had a power surge here at home that wiped out a file I was working on.Listen, I'm in big trouble, do you know anything about computers?

    NORM: Uhhmmm... uh gee, uh...

    DADE: Right, well my BLT drive on my computer just went AWOL, and I've got this big project due tomorrow for Mr. Kawasaki, and if I don't get it in, he's gonna ask me to commit Hari Kari...

    NORM: Uhhh.. ahahaha...

    DADE: Yeah, well, you know these Japanese management techniques.... Could you, uh, read me the number on the modem?

    NORM: Uhhhmm...

    DADE: It's a little boxy thing, Norm, with switches on it... lets my computer talk to the one there...

    NORM: 212-555-4240.

  6. Wrong by Ancient_Hacker · · Score: 4, Insightful

    You don't need malware or anything else to get a router's MAC address, it's in every packet the router sends out.

    And you can't easily get an exact street address from wardriving. All you know is somewhere along the antenna's main lobe there is a router. Could be 10 feet away, could be 500.

    And knowing the MAC address is of no earthly use. Well, in the old days you could map it to a ethernet chip manufacturer, but now most routers have changeable MAC addresses.

    You can't map MAC address to email addresses either, as the summary claims. Sheesh.

  7. Re:Maybe. by bhtooefr · · Score: 4, Interesting

    At driving speeds it's harder to find out, but at walking speed (if you actually are on foot, it's warstumbling,) you can easily see the signal strength go up as you walk by the house that the router is in.