Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo

 

Unsupported browser: Your browser does not meet modern web standards. See how it scores »

It’s well-known that Google amasses large amounts of data about the people who uses its services. Though the company says it’s careful to anonymize that data, and to safeguard what it collects, a talk given this week at Defcon, an underground hacker conference in Las Vegas, illustrated how information can leak out of Google’s repositories regardless of the company’s intentions.

In a talk titled “How I Met Your Girlfriend,” security researcher Samy Kamkar (best known as the author of a worm that struck MySpace two years ago) described a series of attacks that could be used to find a person’s physical location. The beginning of the talk focused on making contact with the target in order to convince him or her to visit a website of the attacker’s choosing. Once the victim clicks the attacker’s link, Kamkar showed how to manipulate Google into revealing his or her location.

As part of Google’s StreetView effort, the company sends cars to drive through neighborhoods, taking photos and collecting data, including on WiFi networks in an area. The company has come under fire for some of the WiFi-related data it collects, but Kamkar says that hasn’t included much concern over the MAC addresses Google collects–these are identifiers that are unique to devices using a given network.

Through triangulation, Google determines and stores the longitude and latitudes associated with these MAC addresses. This information can then be used to power Web services that make use of a person’s location, including location services built into the Firefox browser. Kamkar says he was able to fool Google into revealing a target’s location information after the target visited his website. He did this by tricking the victims browser into revealing data that then allowed him to impersonate that person when requesting the information from Google.

Leaving aside the technical details of Kamkar’s attack, his narrative underlines a key concern with the personal information that modern Web companies store. Regardless of how a company intends to treat that data, providing it’s accessible in some way it may be possible for an attacker to gain unauthorized access to it.

Hear more from Google at EmTech 2014.

Register today

2 comments. Share your thoughts »

Tagged: Web, Google, privacy, hackers, DEFCON, location-aware

Reprints and Permissions | Send feedback to the editor

From the Archives

Close

Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me
×

A Place of Inspiration

Understand the technologies that are changing business and driving the new global economy.

September 23-25, 2014
Register »