Web Attack Knows Where You Live

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Oh no! Hackers are going to know where you live! Hide the Cheetos and Mountain Dew.

One visit to a booby-trapped website could direct attackers to a person's home, a security expert has shown. The attack, thought up by hacker Samy Kamkar, exploits shortcomings in many routers to find out a key identification number.
Click to expand...
 
On any given night depending how much I drink "I" need to know where I live forget the hackers!:eek:
 
This is news? I've got a tool on a few of my sites that not only tell me where the person lives, but their ISP, web browser, operating system and email addresses that match up with the IP.


What's next? Google being able to give you panoramic views of your neighborhood? Better yet...: Indoor Plumbing.
 
Headcase said:
This is news? I've got a tool on a few of my sites that not only tell me where the person lives, but their ISP, web browser, operating system and email addresses that match up with the IP.
Click to expand...

I assume that by "where the person lives", you mean using IP geo-location to determine what town/city they are in.

This looks like more then just IP geo-location. This is being able to have somebody visit your web page and you determine the street address and GPS coordinates of where they were connected to the internet (assuming it was a wired connection like cable/DSL/fiber).

This allows for much more personalized attacks. Instead of:

"Gas main explodes in (your city here - determined by IP geo-location)!!!, click here to watch video"

you get:

"Serial Rapist/Terrorist/Bin Laden/etc. Arrested on (your street) in (your town), click here for the video ***and to install our codec***"
 
Thanks Google, you are such a wonderful company...fucking retards. Why is the hacker able to even access this database and why was it gathered in the first place? I don't see why google would need to snoop peoples Mac addresses to make photos for streetview. I know they said it was done by accident but if it was done by accident then why was the database not wiped after it was found out? Accident, my ass. Google are ++++s.
 
"This is geo-location gone terrible," said Mr Kamkar during his presentation. "Privacy is dead, people. I'm sorry."
Click to expand...

and the award for funniest over-dramatization goes to?
 
Cheetos and Mountain Dew
Click to expand...

Steve is now afraid that some hackers will steal his breakfast!! :p

6a010536e3fd46970c01156f77d540970c-pi.jpg
 
This combined with RealID from blizzard can give the disgruntle gamers your front door.. scary. Makes me not wanna beat the hell outa someone in in SC2..
 
yeah good luck finding my house bastards.. theres only 700 apartments here..
 
mortonP said:
Thanks Google, you are such a wonderful company...fucking retards. Why is the hacker able to even access this database and why was it gathered in the first place? I don't see why google would need to snoop peoples Mac addresses to make photos for streetview. I know they said it was done by accident but if it was done by accident then why was the database not wiped after it was found out? Accident, my ass. Google are ++++s.
Click to expand...


you do realize google isnt the only company that does this right? they are just the largest company that happened to do it.. theres sites all over the place that show open/public wifi connections in most major cities.. yay lets blame google...
 
Yeah like most hacker nerds are gonna then bother walking over to your home and rick getting into a physical confrontation with somebody...
 
Some people told me that Google getting the MAC addresses of wireless networks would be useless to hackers and other bad folks. I really hate being right about this stuff.

GetFunk01 said:
This combined with RealID from blizzard can give the disgruntle gamers your front door.. scary. Makes me not wanna beat the hell outa someone in in SC2..
Click to expand...

That's what shotguns are for.
 
It's so easy to spoof your MAC address, anyone downloading from rapidshare type sites regularly will probably be safe from this attack. :p

Of course the hired goons may show up at some innocent person's house instead.
 
If the hackers want to come to my door, then fine. If they try anything stupid, they'll be greeted by a hail of 9mm and 357 Magnum rounds.
 
What are the hackers going to do, come over and laugh at the lack of tech the people have?
 
Hmm...

So he hacks into the router to remotely get the mac address.

Then he compares the mac address to mac addresses google collected from scanning wirlessrouters during their street view project.

Pretty cool actually.


Is this mac-address database the same database that pre-GPS iPhones use to determine their location based on wifi access points?
 
this is scary!! everyoned privacy should be untrace, ISP should really blocked our DNS name and IP. Or else how do you surf the web annonymously without slowing your internet connection, that means without using a proxy server?
 
zomby said:
this is scary!! everyoned privacy should be untrace, ISP should really blocked our DNS name and IP. Or else how do you surf the web annonymously without slowing your internet connection, that means without using a proxy server?
Click to expand...

Why is that the ISPs responsibility? How are you then going to connect to certain applications and services if your IP is being hidden (ie through NAT)? That still won't stop experienced hackers and it doesn't help you any at all.
 
NoOther said:
Why is that the ISPs responsibility? How are you then going to connect to certain applications and services if your IP is being hidden (ie through NAT)? That still won't stop experienced hackers and it doesn't help you any at all.
Click to expand...

Yep, this particular exploit has nothing to do with the ISP (other than th efact that you have to be connected to the ISP for someone to access your router)
 
enhance

*tap tap tap tap*

enhance

*tap tap tap tap*

enhance

*tap tap tap tap*

enhance

*tap tap tap tap*

Just print the damn thing!
 
sirmonkey1985 said:
you do realize google isnt the only company that does this right? they are just the largest company that happened to do it.. theres sites all over the place that show open/public wifi connections in most major cities.. yay lets blame google...
Click to expand...

It wasn't about open public connections, it was about snooping the Mac address of all wifi signals they found when doing google streetview. Still don't know why they needed to snoop people's Mac wifi address's to do that. Can you explain why?

But you go ahead and pretend it is no big deal and let our privacy be eroded more and more. This issue doesn't even affect me, yet, but I still speak out against it because I actually give a fuck.
 
Big D. said:
Yeah like most hacker nerds are gonna then bother walking over to your home and rick getting into a physical confrontation with somebody...
Click to expand...

There are a lot of hackers that work for criminal organizations and thinking they are all harmless nerds is naive.
 
You won't be making jokes if/when this exploit is actually used to find and stalk/murder someone. And the blood will be on googles hands too. HongKong actually made google wipe the wifi records but google has not wiped all the other records they claim they "accidentally" gathered. Why?
 
mortonP said:
You won't be making jokes if/when this exploit is actually used to find and stalk/murder someone. And the blood will be on googles hands too. HongKong actually made google wipe the wifi records but google has not wiped all the other records they claim they "accidentally" gathered. Why?
Click to expand...

Because of the "destruction of evidence". They don't want to get in legal trouble for destroying something that would mean worsening their legal position. Though still it does sound slightly weird they "acidentally" gathered it.
 
OK, but how is that hacker able to access the google wifi records even? I think google needs to be "investigated" deeper on this matter and hope it doesn't just slip through the cracks.
 
Yuke, Cheetos! How can you guys eat that stuff and use your keyboards. Give me a bowl of Mac&Cheese with Spam (oh the irony) any day of the week. Spoon over cheese fingers thank you!

Bring water to boil, stir Mac in for about 7 min, strain, flame on low and put noodles back in until waters all evaporated, add a tea spoon (small, small amount) of Greek yogurt, 2 splashes of milk, the cheese powder, stir and cook down the milk a bit until desired consistency. Add fried spam cut to cubes and serve (alittle oil, tiny, tiny amount, cut spam to cubes and fry while noodles boil, let sit while preparing cheese goodness).

And on the side to drink a GUS (Grown Up Soda) Dry Cola, a really good cola nut based drink that is a bit on the bitter and not so sweet side (real sugar and not so much of it). That is power food behind a keyboard!
 
mortonP said:
OK, but how is that hacker able to access the google wifi records even? I think google needs to be "investigated" deeper on this matter and hope it doesn't just slip through the cracks.
Click to expand...

If I am not mistaken they are intentionally public. I believe (but have not been able to confirm yet) this is the same database that smartphones without GPS use to determine their location.

You know, they scan the airwaves, grab a few of the closest wifi mac addresses, compare these with their exact locations in googles database and then triangulate their position based on the signal strengths as an indication of distance to the wifi routers.

An unintended side effect of this must be that peoples external mac addresses of their wifi routers are in a public location based database. If you make this database private, then all of a sudden these smartphones are no longer location aware, which I'm sure would piss a lot of users off.


RangerXML said:
Yuke, Cheetos! How can you guys eat that stuff and use your keyboards. Give me a bowl of Mac&Cheese with Spam (oh the irony) any day of the week. Spoon over cheese fingers thank you!

Bring water to boil, stir Mac in for about 7 min, strain, flame on low and put noodles back in until waters all evaporated, add a tea spoon (small, small amount) of Greek yogurt, 2 splashes of milk, the cheese powder, stir and cook down the milk a bit until desired consistency. Add fried spam cut to cubes and serve (alittle oil, tiny, tiny amount, cut spam to cubes and fry while noodles boil, let sit while preparing cheese goodness).

And on the side to drink a GUS (Grown Up Soda) Dry Cola, a really good cola nut based drink that is a bit on the bitter and not so sweet side (real sugar and not so much of it). That is power food behind a keyboard!
Click to expand...

What does your junk food have to do with web attacks that display the location of users? :p
 
Zarathustra[H];1036035665 said:
What does your junk food have to do with web attacks that display the location of users? :p
Click to expand...

I might as well share some good junk food if I get some visitors and Cheetos are just bad form and if they are going to use one of my computers they better wash their hands.
 
Zarathustra[H];1036019371 said:
Yep, this particular exploit has nothing to do with the ISP (other than th efact that you have to be connected to the ISP for someone to access your router)
Click to expand...

Again, how is this the ISPs responsibility? What are people expecting them to do about it?
 
You must log in or register to reply here.
Back
Top