Google Street View Scanning & Mapping Your MAC Address?

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Why in the world would Google’s Street View cars be scanning for MAC addresses? According to the German Federal Data Protection Commissioner, Street View cars are equipped with Wi-Fi scanners that are mapping the location of wireless networks. What the?!?

The data-protection official is worried that Google is acquiring various pieces of information about WiFi networks, including their location, name and protection protocol. The worse part, Schaar says, is that all this data is linked to a physical MAC address that could then be used to link IP addresses to real locations and, by extension, to real people.
Click to expand...
 
At least the German government is acting like they actually give a crap about privacy.

Still, the boulder's already rolling down the hill. Once IPV6 replaces IPV4 you can kiss privacy goodbye. Everyone and everything that connects to the internet will have a globally unique address anyway.

Great for emergency 911 calls but bad for those afternoon getaways with your secretary.

Lock down those AP's while you can!


:D
 
there is the option not to broadcast your SSID. If people want to announce their presence, then let them. Once that info is broadcasted out, it's public info. Anyone can gather it.

This is why there is WEP, WPA 1 & 2 and PSK along with creating a list of authorized MAC addresses.
 
My problem isnt that anyone can scan and find my wireless network is that google is doing it for commercial reasons... I can't figure out why of course.

Gawd knows what kind of data mining they are doing on it tho :(
 
NeghVar said:
there is the option not to broadcast your SSID. If people want to announce their presence, then let them. Once that info is broadcasted out, it's public info. Anyone can gather it.

This is why there is WEP, WPA 1 & 2 and PSK along with creating a list of authorized MAC addresses.
Click to expand...

MAC addresses can be easily changed and sniffed. MAC filtering is not security, it is only obscurity.
 
This is how the skyhook and navizone location services work. The iPhone use cell tower location, skyhook wifi location and the built in gps. Since wifi works indoors I assume google is doing this to enhance it's own location services, possible for android.
 
The only people who see my MAC address on the internets is my ISP. They already know where I live.

More likely than not, google is scanning wifi routers and saving the ssid and the mac for rough location services (like HOCP4ME said), I'm guessing the MAC (of the access point) is more stable than the SSID, and less prone to duplication (I don't know why anyone would spoof addresses of the wireless mac address on their router, and most equipment only lets you easily spoof addresses on the WAN port) . If you're in proximity to three APs called linksys, that puts you basically anywhere with utility power.
 
If I had to guess; id say they are doing this for the geographic data. With geo location being part of HTML5, the browser makers want accurate methods for determining the users location. So, having the mac of the AP in the route will allow them determine a users location, without leveraging GPS or cell tower trilateralization.
 
1) I don't care. If Google wants to map all the publicly broadcast WIFI in the world, I can definitely think of non-malicious uses for that information

2) I don't want to advertise my WIFI network to the public... I don't broadcast my SSID. Easy peasy.
 
The article fails in that mac address that is getting broadcast is by the routers and not by the cable/dsl/fios box. So the mac address google collected cant really be used to pinpoint a user.
 
FYI, not broadcasting your SSID is no more secure than broadcasting it.

If you knew anything about security you'd know that. So those of you acting "in the know" about the SSID broadcasting need to go educate yourselves a bit more before talking again.
 
Furthermore...

WEP...not secure.

WPA1...not secure.

MAC filters...not secure.

Not broadcasting SSIDE...not secure.

If you do any of the above, you are no harder to hack than anyone else.

WPA2/AES is the ONLY current standard that is remotely secure...whether you broadcast your ssid and/or use mac filtering with it is meaningless.
 
I noticed not too long after I started using my Droid and letting it poke my wifi to upload videos that advertisements started telling me about XYZ in the town I actually live in instead of the town on record for the company that owns the IP space that I surf from. It kinda irked me at first, but I got over the whole 'wah my ballsac isn't safe on teh intartoobz' thing a very long time ago. It's all very amusing and all that, but nothing to piss your pants about.
 
hPOD said:
FYI, not broadcasting your SSID is no more secure than broadcasting it.

If you knew anything about security you'd know that. So those of you acting "in the know" about the SSID broadcasting need to go educate yourselves a bit more before talking again.
Click to expand...
Agreed. I knew nothing about wireless security when setting up my router a few years ago but was lucky enough to stumble upon articles that debunk these security myths:
According to Steve Riley, a senior security strategist in Microsoft's Trustworthy Computing Group, the claim that disabling broadcasting can enhance security is, “A myth that needs to be forcibly dragged out behind the woodshed, strangled until it wheezes its last labored breath, then shot several times for good measure"
Click to expand...
 
I'd love to be able to fire up Google Maps and find public WiFi hotspot coverage. Well worth the risk it poses to morons who don't know how to secure their crap.
 
hPOD said:
It's meaningless to white/black hats... but not to the casual user. Adding Mac filtering and not broadcasting SSID ALONG with WPA2/AES makes things more of a pain in the ass for the common white/black hat. Like with anything... if a hacker really wants to get through it, he or she will find a way.

Plus not broadcasting has other benefits as well, such as having neighbors accidentally trying to connect to your AP.
Click to expand...
 
The casual user doesn't bother trying to hack WIFI signals, including simple WEP, because they cannot do it. That includes clicking in neighbors WIFI when it says they're protected. They may try it once or twice...and fail, since they don't know much about it...and then they never bother again.

You aren't trying to defend against casual users, you see, because they're not the ones out to get you.

The ones that are out to get you, however...don't need your SSID, nor do they care if you have MAC filtering enabled.

All they care is that you're not using WPA2/AES. If you are...that neighbor you're talking about...probably isn't. He's a much easier target for us...er...for that type. ;)
 
hPOD said:
The casual user doesn't bother trying to hack WIFI signals, including simple WEP, because they cannot do it. That includes clicking in neighbors WIFI when it says they're protected. They may try it once or twice...and fail, since they don't know much about it...and then they never bother again.

You aren't trying to defend against casual users, you see, because they're not the ones out to get you.

The ones that are out to get you, however...don't need your SSID, nor do they care if you have MAC filtering enabled.

All they care is that you're not using WPA2/AES. If you are...that neighbor you're talking about...probably isn't. He's a much easier target for us...er...for that type. ;)
Click to expand...
Not to mention that you're just making it difficult for legitimate users to find your network, increasing the chances that they connect to a local open network, or worst-case, hacker honeypot.
 
I wouldn't ever suggest hiding your SSID for a business wireless network as yes that would increase the chances of your users connecting to other networks. But for your home I don't see a problem with it. Sure those that want to find it will be able to. But like said it would keep it from showing up for your neighbors. So if you live in an apartment complex you can look at it from the standpoint of doing them a favor as it would give them one less network that shows up when they go to connect to their own wireless.

And if nothing else you are making yourself less of a target for those that would try to hack the connection as I would expect that they would go after the open / less secure ones that they see broadcasting the SSID before they would start to scan for non broadcasting SSIDs.

So does it make you more secure, not really. Does it hurt anything as long as you still do all other security measures that you should, no.
 
I've used enough wireless sniffers to not need your SSID to see what you got. Not broadcasting it is about as much protection as not publishing your phone number. It's still there, just not as obvious.

:cool:
 
IRSmurf said:
1) I don't care. If Google wants to map all the publicly broadcast WIFI in the world, I can definitely think of non-malicious uses for that information

2) I don't want to advertise my WIFI network to the public... I don't broadcast my SSID. Easy peasy.
Click to expand...

i lol at the common misconception that not broadcasting your SSID somehow makes your network "secure"

some people never heard of programs like inSSIDer

I once took my laptop and went wardriving all over town, let's just say I had a nice long page full of networks I could easily connect to if I wanted, and some of them were businesses and political offices.

I never did anything with it, I was just curious what kind of networks were out there. If I was malicious, then definitely information like that in the wrong hands can be used for all kind of mischief.
 
jwalk6 said:
Still, the boulder's already rolling down the hill. Once IPV6 replaces IPV4 you can kiss privacy goodbye. Everyone and everything that connects to the internet will have a globally unique address anyway.
Click to expand...

Most people already have a globally unique IPv4 address at home, although it's usually shared (using NAT) among multiple computers in a household. Whether or not the IP address identifies your specific computer or just your connection is (most of the time) unimportant.

Note that Windows generates a unique, random IPv6 suffix every time your computer starts, so you can't track an IPv6 suffix back to the owner. However, the IPv6 prefix will be assigned by your ISP, and it will probably be tied to your account. This is not unlike the level of privacy offered by IPv4 in practice, where it's possible to identify a specific ISP subscriber but not necessarily the computer that made the connection.

And, by the way, this stuff can be obtained with a subpoena or discovery. You don't really have anonymity on the Internet, and you never really did. If you want to do something that requires anonymity (like complain about the government in a country like China), you probably want to use a public connection and change your MAC address. And don't get spotted by the security cameras.
 
If you want real security from wireless eavesdropping then use cabled connections only. If that's too inconvenient then perhaps you should examine your priorities. Which do you want more, security or convenience?

As to what Google is doing, it is not surprising.
 
00:e0:81:b0:64:53

Its not your SSN people. What do you think that checkbox does when its marked next to the text that says "Broadcast SSID" ?
 
bsoft said:
Most people already have a globally unique IPv4 address at home, although it's usually shared (using NAT) among multiple computers in a household. Whether or not the IP address identifies your specific computer or just your connection is (most of the time) unimportant.

Note that Windows generates a unique, random IPv6 suffix every time your computer starts, so you can't track an IPv6 suffix back to the owner. However, the IPv6 prefix will be assigned by your ISP, and it will probably be tied to your account. This is not unlike the level of privacy offered by IPv4 in practice, where it's possible to identify a specific ISP subscriber but not necessarily the computer that made the connection.

And, by the way, this stuff can be obtained with a subpoena or discovery. You don't really have anonymity on the Internet, and you never really did. If you want to do something that requires anonymity (like complain about the government in a country like China), you probably want to use a public connection and change your MAC address. And don't get spotted by the security cameras.
Click to expand...

All true with the exception of XP and Server 2003 turning off IPV6 by default (which is a good thing considering the DOS attack they're vulnerable to)

You're never going to identify a specific device behind a NAT router/firewall unless you have access to private side of the router's ARP and translation tables which shouldn't happen from the outside.

As for the IPV6 privacy, well the whole idea was already fleshed out before NAT was even a gleam in IETF's eye. There are private ranges but the ultimate goal is to eventually have your ISP assign you a unique range of public addresses for as many devices as you care to connect. The private range is supposed to be for testing not really for NAT'ing.

Since there's more IPV6 addresses than popcorn kernels at the Jiffy Pop factory you're going to end up in the situation I described and that is exactly how IPV6 works best and is the ultimate goal. Since IPSEC is required for connection the belief was that it was secure enough to not really need any kind of NAT or randomization. NAT was never about privacy anyway as much as it was about IPV4 address preservation. The implementation of the dynamic IPV6 addressing in XP and 2003 is a intermediate step from the looks of it. You still have the problem of a unique identifier once IPV6 is the norm.

As for the cameras and government snooping, well, I don't wear tinfoil hats, have any RFID chips stuffed up my nose or hear the Klingon's ordering me to decimate the geraniums over the communicator implant in my ear
 
I keep Wi-Fi turned off for all my devices at home. I prefer wired connections. No security worries here.
 
RS3RS said:
Who cares? I mean really, it's a MAC address.
Click to expand...

bexamous said:
00:e0:81:b0:64:53

Its not your SSN people. What do you think that checkbox does when its marked next to the text that says "Broadcast SSID" ?
Click to expand...

It will let google track you better. Now they know your physical address to tie to your MAC address. The question is why. Why do they need to record that MAC address 11:22:a3:b1:c5 belongs to access point at Mr. Smith's house at some address.
 
How do you think Apple uses "GPS" on the 1st gen iPhone? And assisted GPS?

It needs to know where cell and wireless stations are.

This is nothing new and people need to chill about it.
 
I tried connecting a wireless N Router which I bought recently to my modem so i could configure the network security to stop "broadcasting", but it wouldn't work with my new modem and I gave up on it cause I just couldn't get it working, now I don't care if someone sees my network or even connects, I donwload about 100GB's a month so I don't really care.
 
Hiding the SSID is worthless. Hell even apps like WifiTrak on iPhone can see access-points with SSID turned off!. All it does is make it mildly more difficult to setup a connection for some people.
Leave SSID on, set WPA2 and be done with it.
 
This seems like one of those things that a developer thought was nifty and easy to add-on to what they were already working on and now it's blowing up into something way bigger.

Of course, that's what Google wants you think.
 
Exavior said:
It will let google track you better. Now they know your physical address to tie to your MAC address. The question is why. Why do they need to record that MAC address 11:22:a3:b1:c5 belongs to access point at Mr. Smith's house at some address.
Click to expand...

Well likely they do not know an address, they know an area. Regardless, why should they not record it? It is information being broadcasted to the world. They are already driving around for streetview, might as well record this additional information. If they can create value out of it, good for them. If you don't want someone to know it, don't broadcast it. If you don't want someone to know your SSN, don't put it on twitter. Somehow this seems very simple to me.

This is publicly available information they are documenting.
 
You must log in or register to reply here.
Back
Top