How to Locate a Web User with a Few Clicks
It’s well-known that Google amasses large amounts of data about the people who uses its services. Though the company says it’s careful to anonymize that data, and to safeguard what it collects, a talk given this week at Defcon, an underground hacker conference in Las Vegas, illustrated how information can leak out of Google’s repositories regardless of the company’s intentions.
In a talk titled “How I Met Your Girlfriend,” security researcher Samy Kamkar (best known as the author of a worm that struck MySpace two years ago) described a series of attacks that could be used to find a person’s physical location. The beginning of the talk focused on making contact with the target in order to convince him or her to visit a website of the attacker’s choosing. Once the victim clicks the attacker’s link, Kamkar showed how to manipulate Google into revealing his or her location.
As part of Google’s StreetView effort, the company sends cars to drive through neighborhoods, taking photos and collecting data, including on WiFi networks in an area. The company has come under fire for some of the WiFi-related data it collects, but Kamkar says that hasn’t included much concern over the MAC addresses Google collects–these are identifiers that are unique to devices using a given network.
Through triangulation, Google determines and stores the longitude and latitudes associated with these MAC addresses. This information can then be used to power Web services that make use of a person’s location, including location services built into the Firefox browser. Kamkar says he was able to fool Google into revealing a target’s location information after the target visited his website. He did this by tricking the victims browser into revealing data that then allowed him to impersonate that person when requesting the information from Google.
Leaving aside the technical details of Kamkar’s attack, his narrative underlines a key concern with the personal information that modern Web companies store. Regardless of how a company intends to treat that data, providing it’s accessible in some way it may be possible for an attacker to gain unauthorized access to it.
Keep Reading
Most Popular
The inside story of how ChatGPT was built from the people who made it
Exclusive conversations that take us behind the scenes of a cultural phenomenon.
How Rust went from a side project to the world’s most-loved programming language
For decades, coders wrote critical systems in C and C++. Now they turn to Rust.
Design thinking was supposed to fix the world. Where did it go wrong?
An approach that promised to democratize design may have done the opposite.
Sam Altman invested $180 million into a company trying to delay death
Can anti-aging breakthroughs add 10 healthy years to the human life span? The CEO of OpenAI is paying to find out.
Stay connected
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.