Slashdot Mirror
MiFi Attack Exploits GPS To Reveal User's Location
An anonymous reader writes "Security researcher Adam Baldwin has identified that the Sprint and Verizon MiFi devices are vulnerable to a multitude of attacks. Combining these attacks together, an attacker can gain the GPS location of the MiFi device without the user becoming immediately aware. The attack can be successfully executed without authentication and even if the GPS has been disabled by the administrator." There's a video, but a handy text summary, too. Upshot: "Any MiFi user that visits a specially crafted page will give up their GPS location to the attacker."
I think the main question is why would a glorified router have a GPS built-in? I can see no real reason for a GPS being in a router. Phones? Perhaps. Router? No.
Taxation is legalized theft, no more, no less.
So that's what he's been doing since Firefly.
... let's be good guys."
"Shiny
Cell tower triangulation is not GPS in any way shape or form.
Good-bye
Here's one from the conspiracy theory file:
Since the MiFi is such a novel concept, people might not think it includes anything not related to data connections. By making this mistake and it landing on Slashdot and such, it's advertising the GPS... plus giving notice so nobody can sue them and claim they didn't know they were carrying a device that would reveal their location.
MILF Finder?? Where do I get one?? I need to locate a willing MILF real bad, I feel horny, horny!
This isn't using cell tower strengths, it's a GPS chip being planted in the device despite the fact some people would rather not have it.
WTF is a MiFi??
Let me Google that for you.
Should we combine these attacks together, or should we just combine these attacks?
Who knew his good samaritan ways ran so deep and pure? Looks like The Ballad of Jayne Cobb deserves a new verse.
Anybody want a peanut?
Well, then the attack enables it. Duh. It's a cross-site request forgery, i.e. an attack where the web browser "reflects" a request so that it appears to originate on the inside, where the configuration interface is available. Combine this with the lack of an authentication requirement, the attacker can simply enable the GPS and get the coordinates.
Here's the relevant text from the unavailable web page:
1. Authentication not required.
The MiFi does not require a valid session to commit changes to configuration settings. This makes exploiting the below issues a lot easier when you don't have to require that the victim have a valid session.
2. Enable GPS without the users knowledge.
The GPS on a MiFi can be enabled by visiting the following URL. Depending on the situation the victim may get a alert that says "Login Required" but if they are like the typical user they will simply click on it and forget it ever happened.
3. Cross-Site Request Forgery (CSRF)
The web interface does not validate referrer or use any magical tokens to protect against CSRF. This means that we can have a victim visit our malicious website and do evil things like change the wireless settings of the MiFi.
4. Output Encoding
In multiple locations of the MiFi web interface user input is not properly encoded when output back to the user. One interesting location is the key field for the wifi settings. I'm wondering why the hell somebody thought it was a good idea to print the wifi key in clear text back to the user, and in this case it's not properly encoded either giving us a nice 63 character persistent injection point for script.
> The MiFi does not require a valid session to commit changes to configuration
> settings.
That sounds like there may be all sorts of "interesting" possibilities.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.