Slashdot Mirror
Using XSS & Google To Find Physical Location
wiredmikey sends along a brief (and quite poorly written) report from Security Week on Samy Kamkar's talk at Black Hat last week. In the video, which is amusing, he demonstrates how to obtain location information (within 30 feet, in the example he shows) of a user who does no more than visit a malicious website. The technique involves sniffing out the local router, breaking into it to obtain its MAC address, and sending that to Google to extract the router's location from Google's Street View database.
What is a MAC accress?
ah, nevermind...
Aren't we clever, that joke is sure to woo the ladies.
What scares me the most is that to get the location they demonstrate a plausible way to access the settings on your router (if you use the default credentials.) If I was evil (or more evil) I wouldn't care about the location, I would just changed the router's DNS settings and redirect all the traffic through a server of my choice.
sheep.horse - does not contain information on sheep or horses.
The technique involves sniffing out the local router, breaking into it to obtain its MAC accress, and sending that to Google to extract the router's location from Google's Street View database.
Your hair look like poop, Bob! - Wanker.
Apple Computer Inc
1 Infinite Loop
Cupertino, CA 95014
Inputting my friend's router's MAC address on his site (here) results in a location circle about 3km wide and about 10km away from his house. Close, but not close enough.
So nobody is Anonymous on the Internet? This is know fact since ages, but now with revealing geo-location it us much easier to find people who commit crimes over the Internet. Cyberstalkers, scammers and crooks - watch out, if they can so easily locate you, so can the police. Of course revealing this information now, means the crooks will take precaution actions to hide their traces even more deeply.
Any technology that requires the local router to be easily and mechanically hackable is not a reliable one. The title on this post is thus terribly chosen.
For every problem, there is at least one solution that is simple, neat, and wrong.
Damn, so on the internet, everybody does know that you are a dog?
Excuse me, but please get off my Pennisetum Clandestinum, eh!
And people who download copyrighted content illegally.
Google has been driving around and scanning WiFi networks in order to use it as a location service (Read: cheap GPS). Thus Google now have a cross referenced list of Wireless networks ("mac addresses") with GPS location data on that network's source (based on triangulation).
We've already seen attacks that allow web-sites to break into routers when the default password isn't change, and for example change their DNS servers to servers operated by the attacker. This is an attack that is also assuming the default router password (and address) and retrieving the WiFi mac address, which is then sent back using postback.
You then create a web-site, when someone visits it, it logs into their router, sends the mac address back to the site, which the owner can then search for on Google Maps for that WiFi network giving you a rough location of that person (without about two street blocks).
It was off by only a few houses! Privacy be ignored, this here be progress! To Google! Our future overlord!
So yeah, if you have noscript installed, this is not a threat to you.
You can't be ahead of the curve, if you're stuck in a loop.
The fundamental question is: Should Google be snooping and publishing MAC locations at all?
Do I have the right to opt out of their system - albeit at the cost of not automatically getting the shortest rout to my nearest pizza place on my iPad without manually entering my address?
What happens when the first battered wife is tracked down and murdered by her husband at a woman's shelter because her hacker smart husband crafts an exploit?
"Knowing everything doesn't help..."
I mean seriously .. can we get CRAPPIER fscking audio in that clip or not? God, wtf was this thing shot with? That device that needs to be sacrificed for the good of the interwebs
Ok a standard home router has 2 interfaces, one to the WAN (the ISP) the other to the LAN. Each of these has a unique MAC address.
The WAN is known by the ISP and hopefully is not used in this example as it would mean he has no clue. (Google would not know it I hope as it should only be know if you actually connect). It could be used for location services to some extent, but the wireless angle would be a red herring
The other MAC address is for the LAN. You do not need to crack the router to get it as the local machine must have it. Just do an arp -a at a command prompt.
Unless Java script is blocked from getting this info. (I do not do Java script coding at that level in Windows)
I also thought Google tossed encrypted packet, so only people who did not care would be vulnerable.
I doubt Google happened to scan your SSID directly.
Now that they can triangulate users using the SSID they picked up with their cars, they can now also triangulate any new SSIDs reported by users by using the existing location of those users and the strength of the new SSID. After they have a few reports of the new SSID signal strength from various users (and because they know those users location), they can triangulate the new APs position and add it to their location service.
The same goes for people who move house and keep the same router SSID/MAC. Users will start to report the 'moved' SSID from the new location, and Google probably flag the SSID in their database so it's marked as 'moved' (so not used for positioning at the old location), then then later re-position it to the new location once they have enough triangulation data to accurately work out its new location.
They certainly aren't going to keep driving around the globe to update their database to account for people moving house or buying new wireless APs.
I am moving house soon so will be testing this out.
Some routers even give out their MAC address without requiring the user to log in with credentials, on an unprivileged status page. That would trivialise this exploit even further.
It's interesting, because as the man said, the router's MAC address is traditionally not thought of as a sensitive piece of information. That is, before companies started mapping MAC addresses.
Kamkar, author of an XSS worm that spread across MySpace and generated over 1mm friends for him in less than 24 hours
That's nothing! What's so great about having those really tall friends anyway?
so this is the real reason for WLAN sniffing of Google!
This is only now possible as before google did not cache all the router info , of which they are also now in hot water for....many of the states in the US are joining together to review how google seemed to overlook some sort of privacy law to cultivate this data.
If you use IPv6, the attacker may not even have to break into the access point to find your MAC address, because the IPv6 stateless autoconfiguration mechanism will helpfully embed your complete MAC address in your IPv6 address. Such is progress...
So leaving your router wide open is nothing more then visiting a website?
I propose a non-XSS version of this "no frills" attack: obtaining the location of a user who set chrome to tell everyone by default. Run for the hills.
Analogies don't equal equalities, they are merely somewhat analogous.
that you fuck sergy brin's anus while gagging on larry page's cock.
Even wireless non-router APs are listed. It's not just wireless routers.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
... this is only going to apply to people who have one of those routers that deliberately broadcast their MAC addresses over radio waves?
Or does the Google car also stop at your front door, open the letter box, feed a "snake camera" and a network jack in, hunt around, plug into a convenient socket, and then read the MAC address.
Silly Google - there's a port in the garden shed, and it's easy to lift the hinge pins!
Concerned about privacy? Don't use a wireless network. It's not rocket science.
Poor Google - foiled by evil householder who put their network sockets at waist height along with the power sockets and light switches!
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
http://iwtf.net/2010/08/04/accurate-geolocation-of-your-users/