Hacker Uses XSS and Google Street View Data to Determine Physical Location

http://www.securityweek.com/hacker-uses-xss-and-google-streetview-data-determine-physical-location

by alecco • 16 years ago

53 30 16 years ago

joecode• 16 years ago

Lesson: Put a password on your router.

Or even better, change the default IP address for the admin login. This attack relies on a bunch of hidden iframes loading IPs that are common default addresses of the admin login page.

nkassis4• 16 years ago

Let's assume the users is on 192.168.50.0/24 can his attack figure that out?

marcinw• 16 years ago

How's that better? That's like changing the port SSH listens on to 2222 even though root's password is "root".

sounddust• 16 years ago

That doesn't necessarily solve the problem. The attack needs to login to some routers to extract the MAC address, but others provide it willingly without login (I believe DD-WRT does this on the default logged-out status page, for example, although I can't check at the moment).

Batsu• 16 years ago

Not to downplay a rather interesting vulnerability, but why does it matter if someone figures out where you are?

As much as I love my own real (not internet) privacy, I don't depend on people not knowing where I am. The success of sites such as Foursquare lead me to believe a large amount of people feel the same way.

tlrobinson3• 16 years ago

Furthermore, if you've got control of the router (and thus DNS server settings...) the user has much bigger problems: http://www.schneier.com/blog/archives/2007/02/driveby_pharmi...

nkassis4• 16 years ago

I don't think that he obtained control of the router, the article only states that he managed to get the router's mac address and the crossed referenced this with Google's wifi database(I assume). He can't modify the router just get a routing table from the compute somehow. At least that's what I understand from this extremely sparse in detail article.

js4all• 16 years ago

Yes, when the attacker has control of the router, the user is a helpless victim. The next step will probably be a man in the middle attack for online banking.

Maybe, even if the user changed the default password, he probably stored the new credentials in the browser.

thibaut_barrere• 16 years ago

> why does it matter if someone figures out where you are?

If this allow to know here you are not (eg: you're not at home), this can be useful to a couple of people.

oldgregg• 16 years ago

Very clever. What if you used the same attack to modify the router's iptables and open a port to the outside world. Upload some patched firmware and you now have the worlds largest botnet.

cschneid• 16 years ago

At the point you can make modifications to the user's local router, it's a much better malicious hack to just change the DNS of every bank's website to go to your data capture, man in the middle version.

davidu2• 16 years ago

Samy is smart. Been friends with him for about 15 years. One of the smartest hackers I know. Built most of Fonality's backend, too. Also won "Caesars Challenge" in Vegas when he was like 14 years old.

andrewbadera• 16 years ago

Relevance? Are you the same guy telling people "I went to high school with that chick" when looking at porn with comment features?

davidu2• 16 years ago

We're a small community here on HN. I'm sure others know him too. I don't need to toot my own horn.

bl4k• 16 years ago

Who remembers the Intel processor ID debacle of ~10 years ago?

http://www.schneier.com/essay-187.html

There were similar privacy concerns when it was found that Microsoft were able to generate unique identifying fingerprints of PC's, which they used for license tracking.

This just proves that the debate then was moot since MAC addresses would become universal unique identifiers. Now everything from phones, routers, computers and laptops all have unique IDs.

To make the situation worse and unlike the Intel debate, the growth of WiFi means that these unique ID's are actually being broadcast for anybody to pick up and read.

RFID will only make this situation worse. There was so much of a fuss about the Intel ID's back in 99 that I can only think that people care less about their privacy today.

budwin• 16 years ago

Maybe I missed something, but is this really how Firefox's location services work? By phoning google with the MAC address? I understood google was logging them, but didn't know they were _using_ them...

what• 16 years ago

The location services are pretty creepy actually. I gave a site access and it knew my exact address. I will not be giving another site access, until I can specify that it should only provide my city.

newman314• 16 years ago

Firefox about:config

Set geo.enabled to false.

Not clear how to do the equivalent in Chrome yet. What's alarming is, in my brief search, there does not seem to be an easy way to retroactively go back and delete permissions formerly/accidentally granted.

Same thing with html5 storage (offtopic but related). There is likewise no way I know of to browse what exactly is stored in html5 storage via the browser (preferences or otherwise).

Hacker Uses XSS and Google Street View Data to Determine Physical Location

Related Stories