How to Locate a Web User with a Few Clicks

It’s well-known that Google amasses large amounts of data about the people who uses its services. Though the company says it’s careful to anonymize that data, and to safeguard what it collects, a talk given this week at Defcon, an underground hacker conference in Las Vegas, illustrated how information can leak out of Google’s repositories regardless of the company’s intentions.

In a talk titled “How I Met Your Girlfriend,” security researcher Samy Kamkar (best known as the author of a worm that struck MySpace two years ago) described a series of attacks that could be used to find a person’s physical location. The beginning of the talk focused on making contact with the target in order to convince him or her to visit a website of the attacker’s choosing. Once the victim clicks the attacker’s link, Kamkar showed how to manipulate Google into revealing his or her location.

As part of Google’s StreetView effort, the company sends cars to drive through neighborhoods, taking photos and collecting data, including on WiFi networks in an area. The company has come under fire for some of the WiFi-related data it collects, but Kamkar says that hasn’t included much concern over the MAC addresses Google collects–these are identifiers that are unique to devices using a given network.

Through triangulation, Google determines and stores the longitude and latitudes associated with these MAC addresses. This information can then be used to power Web services that make use of a person’s location, including location services built into the Firefox browser. Kamkar says he was able to fool Google into revealing a target’s location information after the target visited his website. He did this by tricking the victims browser into revealing data that then allowed him to impersonate that person when requesting the information from Google.

Leaving aside the technical details of Kamkar’s attack, his narrative underlines a key concern with the personal information that modern Web companies store. Regardless of how a company intends to treat that data, providing it’s accessible in some way it may be possible for an attacker to gain unauthorized access to it.