Main Nav

Posted by bhelman on March 29, 2012

I'm not one to resend articles, but I'm going to make an exception here.  I was listening to yesterday's episode of Security Now and Steve Gibson mentioned this article.  A lot of times, these things are serious, but not really something I'd worry about in the short-term.  This one has some serious potential though.  I just thought I'd pass it along to this (and the security) list:

 

"An Ars[technical] story from earlier this month reported that iPhones expose the unique identifiers of recently accessed wireless routers, which generated no shortage of reader outrage. What possible justification does Apple have for building this leakage capability into its entire line of wireless products when smartphones, laptops, and tablets from competitors don't? And how is it that Google, Wigle.net, and others get away with publishing the MAC addresses of millions of wireless access devices and their precise geographic location?"

 

Here's the link: http://arstechnica.com/apple/news/2012/03/anatomy-of-an-iphone-leak.ars

 

Because of AT$T’s new policy to screw over customers with UNLIMITED data plans, I’ve been leaving the wifi enabled on my iPhone.  I’ll have to reconsider that now.

 

Cross-posted to the security list as well.

 

-Brian

 

Comments

I think I need to elaborate on why I thought this merited posting.  While I don’t think this is an issue that will impact our networks, I do think it’s a personal security issue.  Think about it.  You go into Starbucks and your iPhone/iPad/Macbook broadcasts your home SSID.  Someone sitting there grabs that information using FireSheep and cross-references against Google (remember, as part of their StreetView recording, they grabbed WiFi information) or WiGLE.net .  Now they know your home address.  And they know you’re not there.

 

-Brian

 

 

Posted by: bhelman on March 29, 2012
Hi- The article you sent indicates that there is uncertainty whether Mac computers broadcast a previously connected SSID. But this post http://seclists.org/dailydave/2012/q1/65 from Wuegler says it does but has not publicly released a demonstration of this. Macs do send a unicast packet to the MAC address of the 3 most recently connected routers or APs (probably due to apple dhcp autoconfig) , thus exposing the mac address of those devices. And I'm not so sure "linksys" will be unique enough to find a home address :) Actually one thing I'm curious about. - Does anyone know whether Google actually provides an api to allow searches of the data it uses for location services - I know it used to provide a geolocation lookup service(address to geo-coordinates), and there are generalized ip to geocode services out there, but I don't see how just anyone can get access to the MAC and SSID info Google appears to be collecting from android handsets? http://support.google.com/maps/bin/answer.py?hl=en&answer=1725632 I found this which says no longer available http://code.google.com/apis/gears/api_geolocation.html - I would be curious to actually look at that db. -- Shanna Leonard ssl@email.arizona.edu ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
Posted by: ssl@email.arizo... on March 29, 2012
WiGLE.net does allow searches. We all were amused to see our neighbor's SSID's on there. Based on changes to our wireless environment here at SSU that are reflected on that site, it's accurate to inside of a year. The guys over on the Security list pretty much scoffed at this as an issue. I won't editorialize, but my personal opinion is, if the flaw is easy to exploit, then we should be concerned. I hide my SSID ;) -Brian
Posted by: bhelman on March 30, 2012
Post a Comment

Research and Publications

Conferences and Events

Career Development

Focus Areas and Initiatives

Connect and Contribute

About EDUCAUSE

Close


Current Issue
May/June 2013
EDUCAUSE Review

Publications

Research

Close


Annual Conference
October 15–18, 2013
Register now!

Events for all Levels and Interests

Whether you're looking for a conference to attend face-to-face to connect with peers, or for an online event for team professional development, see what's upcoming.

See All Events

Close

EDUCAUSE Institute
Leadership/Management Programs
Explore More

Career Center

Find or Post a Job

Leadership and Management Programs

EDUCAUSE Institute
Advanced Programs
Project Management

 

Fellowships and Awards

Fellowships
Awards Programs

Getting Involved

Mentoring
Volunteer
Speak at an Event

 

 

Jump Start Your Career Growth

Explore EDUCAUSE professional development opportunities that match your career aspirations and desired level of time investment through our interactive online guide.

Advance Your Career

 

Close

Latest Topics

EDUCAUSE organizes its efforts around three IT Focus Areas

 

Enterprise and Infrastructure

Enterprise and
Infrastructure

Policy and Security

Policy and
Security

Teaching and Learning

Teaching and
Learning

 

Join These Programs If Your Focus Is

Close

From the Blogs
The Role of Campus Leadership in Ensuring IT Accessibility
by
Diana Oblinger

Find Others

Share Ideas

Get on the Higher Ed IT Map

Employees of EDUCAUSE member institutions and organizations are invited to create individual profiles.
 

Create Your Profile

 

Close

2013 Strategic Priorities

  • Connected Learning
  • Enterprise IT
  • Foundations


Learn More >

Uncommon Thinking for the Common Good™

EDUCAUSE is the foremost community of higher education IT leaders and professionals.
 

Discover Membership