Modern Wardriving (2023)(simonroses.com)
simonroses.com
Modern Wardriving (2023)
https://simonroses.com/2023/12/modern-wardriving/
71 comments
I don't really understand from reading over this: how is this not just another proprietary database?
There's no data dump: I understand why, but it means everything is behind a pretty proprietary offering. And one which "only" appears to provide geolocation, which is fine if that's what you're interested in bit which is pretty orthogonal to the article's apparent goals where the author is interested in wireless security specifically
There's no data dump: I understand why, but it means everything is behind a pretty proprietary offering. And one which "only" appears to provide geolocation, which is fine if that's what you're interested in bit which is pretty orthogonal to the article's apparent goals where the author is interested in wireless security specifically
Thanks for the heads up! I'm going to report a few APs during my next bike ride
[deleted]
War driving with a friend, meeting his lady friend where she waited tables at Denny's, and then meeting her roommate is how I met my wife
Lovedriving
Something fun I did in 2015ish was zip tying an Intel compute stick, a small usb power brick, and an Alfa usb wifi thing to my drone and ran kismet on it in the air and SSHed in from my laptop on the ground. Could see quite a lot of APs from above without clutter on the ground.
In 1895 a young Italian studying Maxwell's equations wondered if perhaps you didn't need wires to send an electromagnetic message, and after months of tinkering beamed the first radio message which rang a bell on the other side of his parent's attic.
The first person he showed this to was his mother, who to her credit didn't accuse him of witchcraft but gave him a hug and supported him in all his future ventures.
He then went on to start a company building useful things on top of this discovery, including the first transatlantic wireless radio that saved tens of thousands of lives and is no doubt in part responsible for many of you alive reading this today.
Fast forward a century and skip the long hours and blood, sweat, and tears of millions of scientists and engineers and technicians and factory workers who have further built this technology so instead of just sending Morse code wirelessly at a few words per minute, we can send all of humanity's information to everyone on earth in seconds.
Wifi is one of the most beautiful creations and technological storylines in all of history.
Let's keep it open and free and not sully it with ads and passwords.
The first person he showed this to was his mother, who to her credit didn't accuse him of witchcraft but gave him a hug and supported him in all his future ventures.
He then went on to start a company building useful things on top of this discovery, including the first transatlantic wireless radio that saved tens of thousands of lives and is no doubt in part responsible for many of you alive reading this today.
Fast forward a century and skip the long hours and blood, sweat, and tears of millions of scientists and engineers and technicians and factory workers who have further built this technology so instead of just sending Morse code wirelessly at a few words per minute, we can send all of humanity's information to everyone on earth in seconds.
Wifi is one of the most beautiful creations and technological storylines in all of history.
Let's keep it open and free and not sully it with ads and passwords.
WiFi is wonderful magic, but I’m not giving you the password to my private network.
Why not make your community better by having your router also broadcast an open public network?
Because freeloaders and/or malicious actors will abuse my generosity
Freeloaders? Well, yeah: isn't that the whole point? We're all freeloaders, in some sense, unless you think you've earned the water you drink and the air you breathe. By giving back to the Freeloader-available Resource Pool (the commons), you're becoming less of a freeloader.
Malicious actors? That relies on there being malicious actors physically near you, which isn't necessarily a valid assumption. Set up a DMZ, try it, and see.
Malicious actors? That relies on there being malicious actors physically near you, which isn't necessarily a valid assumption. Set up a DMZ, try it, and see.
>Set up a DMZ, try it, and see
No, I don't think I will. I will continue to keep my wifi password protected so that randoms can't degrade my Internet speed by torrenting movies 24/7, send death threats to public officials from my IP address, or engage in other unsavory activities.
Not sure why you are equating a natural resource like air with a paid service like Internet connectivity, but it comes off as bizarre and naive at best.
No, I don't think I will. I will continue to keep my wifi password protected so that randoms can't degrade my Internet speed by torrenting movies 24/7, send death threats to public officials from my IP address, or engage in other unsavory activities.
Not sure why you are equating a natural resource like air with a paid service like Internet connectivity, but it comes off as bizarre and naive at best.
probably worlds colliding
some ppl view "internet service" similar as access to drinking water, which some countries have legal obligations for and the public sentiment would be very much against you if you deny it to any stranger.
some countries/ppl not so much
some ppl view "internet service" similar as access to drinking water, which some countries have legal obligations for and the public sentiment would be very much against you if you deny it to any stranger.
some countries/ppl not so much
Worse than that, some jurisdictions double-dip: regulate internet access like a utility, but treat it as a private resource (allowing regional monopolies that provide barely-usable service and set their own prices); make an internet connection legally mandatory (via a combination of employment, banking, and anti-homeless laws), but decline to fund public libraries (which provide internet access to those who otherwise don't have it).
Well, I've certainly earned the plumbing system that supplies the water to my house, I pay for it and my labour indirectly supports the building out of that system.
WiFi isn't some sort of aether, it is created.
WiFi isn't some sort of aether, it is created.
> unless you think you've earned the water you drink
Earned? WTF logic is that? I pay for the water I drink. What in the world are you on about?
Earned? WTF logic is that? I pay for the water I drink. What in the world are you on about?
Your view will change once you see your home IP address on the search warrant. And no, i am not going to invite the public to share in my vpn too.
(A) That's not how search warrants work.
(B) Having your computers spuriously seized for a police investigation is a risk shared by every computer user, but those investigations cost money. They don't tend to seize your hardware frivolously, except to intimidate (fairly common for security researchers, for some reason). If you have a public Wi-Fi network, and there's no reason to believe you're a culprit, they're more likely to ask you to keep MAC address logs, or shut down the public Wi-Fi network, than assume you dunnit and try to prosecute with insufficient evidence. You're at far more risk running a Tor exit node than a public Wi-Fi network, and most Tor exit nodes don't get raided by the police.
Your neighbours are probably not cybercriminals. It's probably okay to be nice to them.
(B) Having your computers spuriously seized for a police investigation is a risk shared by every computer user, but those investigations cost money. They don't tend to seize your hardware frivolously, except to intimidate (fairly common for security researchers, for some reason). If you have a public Wi-Fi network, and there's no reason to believe you're a culprit, they're more likely to ask you to keep MAC address logs, or shut down the public Wi-Fi network, than assume you dunnit and try to prosecute with insufficient evidence. You're at far more risk running a Tor exit node than a public Wi-Fi network, and most Tor exit nodes don't get raided by the police.
Your neighbours are probably not cybercriminals. It's probably okay to be nice to them.
>> having your computers spuriously seized for a police investigation is a risk shared by every computer user
Not where i live. We have layers of rules specifically designed to prevent random actions by police.
Not where i live. We have layers of rules specifically designed to prevent random actions by police.
It's not the street-level police who sign the warrants for seizing computer hardware.
Yes, the risk is quite low, but it's a risk shared by any occupant of an INTERPOL member state.
Yes, the risk is quite low, but it's a risk shared by any occupant of an INTERPOL member state.
I fear what they're up to... Download or broadcasting CP primarily.
who knows what freaky stuff my community gets into.
who knows what freaky stuff my community gets into.
For the same reasons I don't invite the entire neighborhood into my kitchen for dinner every night. If people want wifi, they can buy it themselves.
They might be dissidents that don't want their internet traffic associated with their physical identity, which makes it quite hard to "buy it themselves" in places where cash isn't used or ID cards are commonly registered.
In which case I don't want their activity associated with my ip.
Dissidenting safely is their problem, not mine.
Dissidenting safely is their problem, not mine.
[deleted]
someone can do some bad tnings on internet with help of your wifi?
This hits home as we just came from Marconi beach on Cape Cod where one of the antennas was. There is no antenna left, just a plaque marking the spot. In a way it's a little sad how behind this area is at this point compared to the energy of the times.
That's my favorite beach. Whenever I'm there I have to walk to the memorial.
If you ever go back, take the time to walk the hiking path behind the bathrooms. It goes into a gorgeous redwood grove. The boardwalk reminds me of the "tree" level in Myst.
If you ever go back, take the time to walk the hiking path behind the bathrooms. It goes into a gorgeous redwood grove. The boardwalk reminds me of the "tree" level in Myst.
?
I could be wrong but I've never seen redwoods in Massachusetts.
I could be wrong but I've never seen redwoods in Massachusetts.
It's Atlantic White Cedar: https://www.nps.gov/caco/planyourvisit/atlanticwhitecedar.ht...
figured it was something like that. thanks!
Could just be the local pitch pine. It's all over the cape.
I just thought of this, so separate reply. Didn’t CSIRO enforce their WiFi patents pretty thoroughly?
Marconi always gets credit, but Tesla invented it:
https://www.pbs.org/tesla/ll/ll_whoradio.html
https://www.pbs.org/tesla/ll/ll_whoradio.html
No. Your source makes clear that Marconi sent the first message (Tesla failed to send a radio message in 1895, Marconi succeeded). Read "My Father Marconi" by his daughter Degna. Fantastic book.
Other than that, a very fascinating read, the link you shared. Patent stuff is silly, but were way less silly back then, and had more positive 2nd order effects back then.
It was cool how Tesla and Marconi held each other in high regard, and built on each other's works.
Other than that, a very fascinating read, the link you shared. Patent stuff is silly, but were way less silly back then, and had more positive 2nd order effects back then.
It was cool how Tesla and Marconi held each other in high regard, and built on each other's works.
I would genuinely love to offer free use of my wifi to anyone that needs it.
1. My billing is usage based, the bills could be astronomical
2. Laws around who is at fault are the person paying the bill. My IP address doing who knows what could easily land me in jail.
Sadly, the cons outweigh the pros
1. My billing is usage based, the bills could be astronomical
2. Laws around who is at fault are the person paying the bill. My IP address doing who knows what could easily land me in jail.
Sadly, the cons outweigh the pros
Free WIFI tragically will fall into the 'tragedy of the commons'.
How much a better place the world would be if we could freely share ANYTHING without getting abused, sabotaged, taken advantage of, taken for granted, getting hate for revoking, whatever we offer?
How much a better place the world would be if we could freely share ANYTHING without getting abused, sabotaged, taken advantage of, taken for granted, getting hate for revoking, whatever we offer?
Or living in fear of a multitude of hypothetical behaviors that objectively most folks just don't engage in. I kept an open network for folks waiting for the bus near my house for close to 10 years. No sabotage, no abuse, no hassles of any kind.
A friend and I used to do this, using the USB GPS reciever from Microsoft Streets and Trips, and then an Orinoco PC Card that let us use an external antenna that we got from a Linksys home AP/router.
It was fun seeing all the networks on the map when we got home. I think the original plan was to send out flyers to these businesses offering networking/IT services but we never got that far (especially to the ones with open networks)
It was fun seeing all the networks on the map when we got home. I think the original plan was to send out flyers to these businesses offering networking/IT services but we never got that far (especially to the ones with open networks)
I had a magnetic mount antenna on my car and a marine GPS that I used with Netstumbler sometime around 2001. I used an Orinoco PC Card adapter, too. I remember the external antenna connection was very fiddly and fragile. I would run the rig anytime I had a long trip to take. It was fun to see the relatively huge number of networks around bigger cities, as compared to the sparseness of rural Ohio where I lived.
I still remember a few of the more amusing network names when I drive past their locations. I can't ever drive on I-75 south of Bowling Green, OH without thinking of "Chickenfeet".
I still remember a few of the more amusing network names when I drive past their locations. I can't ever drive on I-75 south of Bowling Green, OH without thinking of "Chickenfeet".
I had a similar setup that i used while driving cross country ~2002. I used to pull into trucker rest areas to borrow wifi. I had more than a couple ask me about the magnetic antenna.
Trucker rest stops had WiFi in 2002?
That is awesome, I doubt we got similar services in the UK until 2015 or later.
That is awesome, I doubt we got similar services in the UK until 2015 or later.
Google productionized this with their Google Maps product. It’s how they know more about where you are by utilizing WiFi signals.
Since 2024-03, at least Apple allows AP owners to opt out.
(search for "_nomap")
https://web.archive.org/web/20240328071851/https://support.a...
(search for "_nomap")
https://web.archive.org/web/20240328071851/https://support.a...
opt-out is a bandaid, not a solution
Indeed, that's how they map the inside of a shopping mall or subway stop.
I operate a combination of mobile and fixed point Pwnagotchis across NYC and Brooklyn, I push all the pcaps back to my home lab, which operates in a cluster of distributed hash crackers. They all utilize GPS for AP mapping as well. Roughly 5,000 passwords since 2020. Highly recommend the project for anyone interested in hardware, wardriving, and a tiny bit of AI.
99% of passwords a junk, lol. At this point I can probably guess them faster, but the project has its moments.
Flipper is ok. HackRF and M5 much much better.
99% of passwords a junk, lol. At this point I can probably guess them faster, but the project has its moments.
Flipper is ok. HackRF and M5 much much better.
I don't quite get the point of this. Basically any home or small buisness router is going to have a password or it's a public wifi hotspot anyway. Am I missing anything?
Back in the day it was a way to capture a lot of handshakes from a lot of different WiFi networks, then offline and back home crack the passwords and get a growing list of networks you could get into.
But all that to say that hackers don’t exactly need a reason to have a hobby.
But all that to say that hackers don’t exactly need a reason to have a hobby.
[deleted]
It's not to get into a network, it's just to list where they're at.. For points. Similar to internet points :). There's no hacking involved just nerds being nerds
What you find shows up here: https://wigle.net/
As you can see there's quite a few people who do it
What you find shows up here: https://wigle.net/
As you can see there's quite a few people who do it
The "What has this project been used for?" section in the wigle FAQ is not very compelling tbh. Now that most routers ship WPA-2 secured by default and you can find free wifi everywhere, I think the most valid use that remains is finding malicious networks. But it seems to me that by and large this is nerds doing free work for the people who use their data commercially which seems kind of anti-hacker.
I'm surprised nobody's using it for geolocation. AFAIK Google already does that, so a free competitor would be a compelling justification.
Wardriving for sex toys!
https://www.pentestpartners.com/security-blog/screwdriving-l...
https://www.pentestpartners.com/security-blog/screwdriving-l...
There are definitely ways like deauth all clients, grab hash and try to crack it; or evil twin attack.
Most business wifi passwords are so ridiculously simple they could be trivially cracked.
Passwords matter if your goal is to get free wifi. But wardriving can also scan for devices ... vulnerable/exploitable devices. It is not hard to track down specific vehicles and security systems, which are the first steps to all sorts of high end property crime.
The uuid for a tesla car's bluetooth is 0xFE96 or 0xFE97. Some targeted wardriving easily gives you the general location of every tesla in a neighbourhood, and then the phones that unlock them. Then you sniff the ssid from the phone, look it up in wigle, and you know exactly what car lives in what garage, along with where the phone is that can start said car. Wardriving isnt all about kids wanting free wifi.
The uuid for a tesla car's bluetooth is 0xFE96 or 0xFE97. Some targeted wardriving easily gives you the general location of every tesla in a neighbourhood, and then the phones that unlock them. Then you sniff the ssid from the phone, look it up in wigle, and you know exactly what car lives in what garage, along with where the phone is that can start said car. Wardriving isnt all about kids wanting free wifi.
Ah yes, memories of my laptop, an Orinoco card, and Netstumbler cruising down the highway during my day-job. Shortly after that I added an X-10 video receiver and a USB Hauppauge WinTV adapter to capture video transmitters too. I'd reach over and trigger a screen-shot whenever live video came into view. Once in a while I'd even capture myself driving through a parking lot or something on the feed.
1. Of the many problems, one critical issue with using this for anything other than security research, is accurate mapping in urban dense areas. Essentially, you are constructing a map of Wi-Fi->Lat/Long or BLE -> Lat/Long.
I believe google's solution to this is 3D modeling of buildings[1] based on research from people like Paul Groves[2].
2. I think the other issue, not with wardriving but with use of such open source infrastructure in general, is launching products that could rely on this mapping. It requires a lot of money and is a bit of a chicken & egg problem. It's also a privacy concern to collect all that Wifi/BLE data for any commercial use.
3. I was also saddened to know about Mozilla MLS shutting down due to f**ng patent trolls[3] that mean that until such competition sucking scum is taken down these technologies will remain boxed to hobby land, small scale diy-ism and security research.
[1] https://insidegnss.com/end-game-for-urban-gnss-googles-use-o... [2] https://profiles.ucl.ac.uk/6850
[3] https://discourse.mozilla.org/t/retiring-the-mozilla-locatio...
I believe google's solution to this is 3D modeling of buildings[1] based on research from people like Paul Groves[2].
2. I think the other issue, not with wardriving but with use of such open source infrastructure in general, is launching products that could rely on this mapping. It requires a lot of money and is a bit of a chicken & egg problem. It's also a privacy concern to collect all that Wifi/BLE data for any commercial use.
3. I was also saddened to know about Mozilla MLS shutting down due to f**ng patent trolls[3] that mean that until such competition sucking scum is taken down these technologies will remain boxed to hobby land, small scale diy-ism and security research.
[1] https://insidegnss.com/end-game-for-urban-gnss-googles-use-o... [2] https://profiles.ucl.ac.uk/6850
[3] https://discourse.mozilla.org/t/retiring-the-mozilla-locatio...
You can somewhat do it in Android,
In the past by installing apps which worked as plugin for MicroG UnifiedNLP location provider.
Now it's baked into MicroG GMSCore
And you can configure external loaction service provider (or rely on GPS) like Apple, Google, Mozilla(before it was retired), BeaconDB etc.
The rumor is that the Google Maps car does this.
This has been a known fact for some time
https://www.theguardian.com/technology/2010/may/15/google-ad...
https://www.theguardian.com/technology/2010/may/15/google-ad...
Netstumbler sound intensifies!
Why is it called that?
It's a play off of the war dialing phrase where you would have your computer dial every phone number within a prefix. 212-555-0001, -0002,... -9999. You would log every number that was answered by another computer for later investigation.
Classic movie scene based on the concept from War Games:
https://www.youtube.com/watch?v=zb1r_uKOew4
Classic movie scene based on the concept from War Games:
https://www.youtube.com/watch?v=zb1r_uKOew4
[1] https://beacondb.net/ [2] https://github.com/mjaakko/NeoStumbler