Forgot your password?
typodupeerror
Security Google Your Rights Online

Using XSS & Google To Find Physical Location 77

Posted by kdawson
from the how-i-met-your-girlfriend dept.
wiredmikey sends along a brief (and quite poorly written) report from Security Week on Samy Kamkar's talk at Black Hat last week. In the video, which is amusing, he demonstrates how to obtain location information (within 30 feet, in the example he shows) of a user who does no more than visit a malicious website. The technique involves sniffing out the local router, breaking into it to obtain its MAC address, and sending that to Google to extract the router's location from Google's Street View database.
This discussion has been archived. No new comments can be posted.

Using XSS & Google To Find Physical Location

Comments Filter:
  • by AndrewStephens (815287) on Tuesday August 03, 2010 @02:39AM (#33120280) Homepage

    What scares me the most is that to get the location they demonstrate a plausible way to access the settings on your router (if you use the default credentials.) If I was evil (or more evil) I wouldn't care about the location, I would just changed the router's DNS settings and redirect all the traffic through a server of my choice.

  • The technique involves sniffing out the local router, breaking into it to obtain its MAC accress, and sending that to Google to extract the router's location from Google's Street View database.

    • wiredmikey sends along a brief (and quite poorly written)... ...breaking into it to obtain its MAC accress

      Don't be a hypocrite now :P

  • by Netshroud (1856624) on Tuesday August 03, 2010 @02:40AM (#33120290)
    Inputting my friend's router's MAC address on his site (here [samy.pl]) results in a location circle about 3km wide and about 10km away from his house. Close, but not close enough.
    • by darkpixel2k (623900) <aaron@heyaaron.com> on Tuesday August 03, 2010 @02:48AM (#33120320) Homepage

      Inputting my friend's router's MAC address on his site (here [samy.pl]) results in a location circle about 3km wide and about 10km away from his house. Close, but not close enough.

      Should I be worried that Google knows the correct location for a new WAP which I just turned on about a month ago in a small po-dunk town in the middle of nowhere?

      I mean seriously--the town has a population of approximately 10,000. It's hardly Austin or New York. Maybe I just timed it correctly.

      • by cybereal (621599)

        I suspect that the location information for many routers is not found via wardriving by google but instead by unwitting submission of the address from the computer by some software (perhaps one of the various google products, or maybe Flash or something) with the permission of the user. Of course, the user probably never read the EULA because nobody ever does.

        There may be other ways, perhaps involving GPS-enabled cell devices using various third party software products, or even first party depending on the

        • by AndrewStephens (815287) on Tuesday August 03, 2010 @03:25AM (#33120466) Homepage

          I am pretty sure it is cell phones - I believe [citation needed] that the iPhone (for one) does this as part of the anonymized data sent back to Apple. Google's database is probably kept up to date in a similar fashion.

        • Re: (Score:3, Informative)

          by amorsen (7485)

          There may be other ways, perhaps involving GPS-enabled cell devices using various third party software products, or even first party depending on the party.

          Google Maps on cell phones does that, AFAIK.

      • Re: (Score:2, Troll)

        by Hi_2k (567317)
        Holy crap. I just gave it the mac of my parent's router, on a private road in the forests ~30 minutes outside Seattle, and it gave back the correct street address. Then again, what use does this have? Maybe a disoriented traveller could use it to find his way, but other than that I see no reason anyone would be able to abuse mapping MAC address to location. It's a new form of phone book; nothing more.
        • How about when they post "I'm going on vacation" on Facebook?
          • by AndrewNeo (979708)

            How on Earth are you going to get their IP address from a Facebook post?

            • You don't do it after the fact, you do it via an XSS attack on Facebook (or similar site) users and then watch for those kinds of updates. The point is that people use their PCs to send notifications to friends that they won't be home, which is very valuable information when combined with your address
      • by adolf (21054) <flodadolf@gmail.com> on Tuesday August 03, 2010 @05:21AM (#33120946) Journal

        Worried? Why would you worry about that?

        It's public spectrum.

        If you want to use it, you gotta play by the rules [gpoaccess.gov], just like everyone else -- including Google*.

        If you don't want to, then don't. Nobody's holding a gun to your head and telling you that you must make WiFi available to yourself.

        Just turn it off.

        Alternatively, take the tinfoil hat off and get over it. This data is useful to folks, and it's all fair game.

        For years, now, my first-gen iPod Touch has done a great job of finding where I am using nothing but Wifi signals, even in my own podunk town -- which was useful when I carried it everywhere to complement my (then) lousy cell phone. But by the time I visited Chicago a few months ago, my GPS-capable Droid did a fine job of figuring out where I was with startling accuracy, within a downtown hotel and without a GPS fix.

        Meanwhile, I myself have uploaded a few tens-of-thousands of APs with GPS coordinates to Wigle [slashdot.org] during my daily wardriving escapades. I have no idea what gets done with that data, but I do enjoy collecting it, and I like looking at the maps it produces.

        But, again. If you don't like the game, then don't play it. The price of copper is down right now, so Cat5e is cheap. So just cable your gear up, and nobody will be able to drive by and map it.

        *: IIRC, Google got themselves in trouble recently for accidentally recording Wifi traffic when they thought they were only recording location data. Nobody accused them of this; they admitted it all on their own in a very altruist fashion. You've got far more devious organizations than Google to worry about, if you're still insistent on wearing that stupid tin foil hat.

        • by adolf (21054)

          Ugh. It seems that I missed a /i in there someplace. Please moderate accordingly.

      • by Woy (606550)

        Well my router was located to within about 10 meters. On the country where I lived until around May 2009. I'm impressed.

      • by RichiH (749257)

        Google Latitude (or Skyhook).

        The MAC for my neighbor is still half of Germany away, but then, Latitude is almost non-existant in Germany.

    • by Barny (103770)

      Wow, I let my browser share my details to him, and it was accurate to within 500kM of my current location, scary stuff.

      Although it took a good guess as to which of the 7 areas of mainland Australia I was on, it only narrowed it down to 3.

  • So nobody is Anonymous on the Internet? This is know fact since ages, but now with revealing geo-location it us much easier to find people who commit crimes over the Internet. Cyberstalkers, scammers and crooks - watch out, if they can so easily locate you, so can the police. Of course revealing this information now, means the crooks will take precaution actions to hide their traces even more deeply.
    • by amorsen (7485)

      The police just send a warrant to the ISP and get the last 6+ months of activity as well as billing information. No need to bother with breaking into any routers.

      Or more likely, the police just files the report of the crime and never investigates.

    • Solution : Don't use WiFi ... There will be a physical connection to your router, use it and turn off WiFi

      There is a huge amount of people using WiFi on their home router to a fixed PC 2 feet away ...and it's those that get hacked, hijacked, and complain about the connection failing ...

      Get a cable plug it in and you are invisible to Google's WiFi snooping ...the nearest they can usually get then is your ISP (Mine is 100 miles away from me)

      • by drHirudo (1830056)
        I use only physical connection to my desktop computer (micro AmigaOne). But in the other room my wife is with her laptop and she was very annoyed with the long cable, so we installed the WiFi router. Now she is happy, I am still physically connected, but I am happy as well. We also have printer and another laptop physically connected to the network and the live happily on the network. If I did not have router, only one machine is allowed for connection by the ISP.
  • Not reliable (Score:3, Insightful)

    by Improv (2467) <pgunn@dachte.org> on Tuesday August 03, 2010 @02:51AM (#33120332) Homepage Journal

    Any technology that requires the local router to be easily and mechanically hackable is not a reliable one. The title on this post is thus terribly chosen.

  • Damn, so on the internet, everybody does know that you are a dog?
  • Better Explanation (Score:5, Informative)

    by Manip (656104) on Tuesday August 03, 2010 @03:06AM (#33120398)
    Google has been driving around and scanning WiFi networks in order to use it as a location service (Read: cheap GPS). Thus Google now have a cross referenced list of Wireless networks ("mac addresses") with GPS location data on that network's source (based on triangulation).

    We've already seen attacks that allow web-sites to break into routers when the default password isn't change, and for example change their DNS servers to servers operated by the attacker. This is an attack that is also assuming the default router password (and address) and retrieving the WiFi mac address, which is then sent back using postback.

    You then create a web-site, when someone visits it, it logs into their router, sends the mac address back to the site, which the owner can then search for on Google Maps for that WiFi network giving you a rough location of that person (without about two street blocks).
    • by bgt421 (1006945)
      How often do the scans come through a given place? Would a cron job that changes my MAC addresses to a random value every $AMOUNT_OF_TIME make this ineffective and effectively protect my privacy?
  • Awesome! (Score:1, Funny)

    by Anonymous Coward
    It was off by only a few houses! Privacy be ignored, this here be progress! To Google! Our future overlord!
  • Kamkar, by getting a user to visit his malicious Web site, used remote JavaScript and AJAX to acquire a routers MAC address. When the unsuspecting user visits the malicious Web site, JavaScript remotely scans for the type of router used, accesses the routers MAC address and sends it directly to the attacker.

    So yeah, if you have noscript installed, this is not a threat to you.

  • Don't be evil? (Score:4, Insightful)

    by Invisible Now (525401) on Tuesday August 03, 2010 @03:52AM (#33120572)

    The fundamental question is: Should Google be snooping and publishing MAC locations at all?

    Do I have the right to opt out of their system - albeit at the cost of not automatically getting the shortest rout to my nearest pizza place on my iPad without manually entering my address?

    What happens when the first battered wife is tracked down and murdered by her husband at a woman's shelter because her hacker smart husband crafts an exploit?

    • Re: (Score:3, Informative)

      by pslam (97660)

      The fundamental question is: Should Google be snooping and publishing MAC locations at all?

      Did you know there's at least a dozen companies that do this? Did you know Skyhook did this for years before Google?

      But I think you're biasing the question by starting out calling it 'snooping'.

    • by Xarius (691264)

      Can't you just stop your router broadcasting its SSID?

      That would prevent Google from picking your router up at all.

  • by maxwells_deamon (221474) on Tuesday August 03, 2010 @04:59AM (#33120856) Homepage

    Ok a standard home router has 2 interfaces, one to the WAN (the ISP) the other to the LAN. Each of these has a unique MAC address.

    The WAN is known by the ISP and hopefully is not used in this example as it would mean he has no clue. (Google would not know it I hope as it should only be know if you actually connect). It could be used for location services to some extent, but the wireless angle would be a red herring

    The other MAC address is for the LAN. You do not need to crack the router to get it as the local machine must have it. Just do an arp -a at a command prompt.

    Unless Java script is blocked from getting this info. (I do not do Java script coding at that level in Windows)

    I also thought Google tossed encrypted packet, so only people who did not care would be vulnerable.

  • by kubitus (927806) on Tuesday August 03, 2010 @07:18AM (#33121410)
    bye bye freedome!

    so this is the real reason for WLAN sniffing of Google!

  • This is only now possible as before google did not cache all the router info , of which they are also now in hot water for....many of the states in the US are joining together to review how google seemed to overlook some sort of privacy law to cultivate this data.

  • If you use IPv6, the attacker may not even have to break into the access point to find your MAC address, because the IPv6 stateless autoconfiguration mechanism will helpfully embed your complete MAC address in your IPv6 address. Such is progress...

  • So leaving your router wide open is nothing more then visiting a website?

    I propose a non-XSS version of this "no frills" attack: obtaining the location of a user who set chrome to tell everyone by default. Run for the hills.

  • Even wireless non-router APs are listed. It's not just wireless routers.

  • ... this is only going to apply to people who have one of those routers that deliberately broadcast their MAC addresses over radio waves?

    Or does the Google car also stop at your front door, open the letter box, feed a "snake camera" and a network jack in, hunt around, plug into a convenient socket, and then read the MAC address.
    Silly Google - there's a port in the garden shed, and it's easy to lift the hinge pins!

    Concerned about privacy? Don't use a wireless network. It's not rocket science.

    Poor Google - fo

The biggest mistake you can make is to believe that you are working for someone else.

Working...