5 ms·

Maybe someone should build a portable (FCC compliant?) device to put in your car that spoofs and rotates a bunch of 2.4/5Ghz SSIDs periodically to "trick" apps

by mcast 5y ago

Maybe someone should build a portable (FCC compliant?) device to put in your car that spoofs and rotates a bunch of 2.4/5Ghz SSIDs periodically to "trick" apps that mine wifi data with GPS location. Bonus points for bogus names like "Starbucks Wifi" or "McDonalds Free Wifi" in the middle of the highway. Even easier, just reverse engineer the API and send the SSIDs yourself.

notacoward 5y ago
> Bonus points for bogus names like "Starbucks Wifi" or "McDonalds Free Wifi" in the middle of the highway. I find no joy in saying it, but I bet that would get you some unwelcome attention - trademark infringement, defamation, tortious interference - from one of those companies. :(
- SllX 5y ago
  Out of curiosity, has anyone ever been sued over their SSID?
  - notacoward 5y ago
    Good question. I'd be surprised if those companies would go after an individual over an "infringing" SSID, but if you sold a product using them that would be a different matter. An open-source project would probably fall somewhere in between.
  - dmje 5y ago
    We had one on our street called FuckOffAndGetYourOwn which I always liked
    - Sohcahtoa82 5y ago
      I've always been partial to ones named like "NSA Monitor 3AB9D4"
      - youngbullind 5y ago
        I have my phone's hot-spot named Surveillance van no. 42, and an open guest wifi for whoever needs it called It's nice to be nice
    - nobody9999 5y ago
      >We had one on our street called FuckOffAndGetYourOwn which I always liked There was an SSID in my building called "Free Palestine." A couple years later, someone created another one called "The Shin Bet."[0] I found that to be both disturbing and amusing. After the Muslim grad students on the third floor moved back to Australia, "Free Palestine" disappeared, and when the orthodox Jews moved out of the fourth floor, "The Shin Bet" went away too. Now it's mostly boring, and while I may be doxxing myself (if you can see this SSID, reply here as we almost certainly live in the same building) but I still have the SSID GranMal (an ironic reference to this[1]). Moral: Looking at SSIDs can be fun! [0] https://en.wikipedia.org/wiki/Shin_Bet https://en.wikipedia.org/wiki/Shin_Bet [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6015645/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6015645/
      - apetresc 5y ago
        I don't understand your ironic reference :( What does "GranMal" have to do with that paper about wifi's effect on epileptic rats?
        duskwuff 5y ago
        A grand mal seizure is a particularly serious type of seizure.
      - SllX 5y ago
        Nobody ever did answer my question, but your comment makes me glad I asked. :) Thanks!
  - tqwhite 5y ago
    I have a neighbor whose SSID is itHurtsWhenIP. I've always liked that.
    - nobody9999 5y ago
      >I have a neighbor whose SSID is itHurtsWhenIP. I've always liked that. While it may not be the source of your neighbor's SSID, It's certainly possible (maybe even likely) that it's a reference to this song[0]. [0] https://www.youtube.com/watch?v=3vmPwZT-9zY https://www.youtube.com/watch?v=3vmPwZT-9zY
  - notacoward 5y ago
    Yes. https://reason.com/volokh/2018/04/29/libel-by-wifi-network-name/ https://reason.com/volokh/2018/04/29/libel-by-wifi-network-n... Sure, it was defamation rather than copyright, but it certainly puts the lie to a certain other commenter who seems to think that if he personally can't find it on Google then it must not exist.
    - SllX 5y ago
      Well that was an entertaining read. It appears the answer thus far is “yes, at least once.” Thanks!
- can16358p 5y ago
  Is there a law regarding which names you can't use for hotspots/APs? Even if there is, I doubt anyone will go after that unless the "attacker" involves some serious crime with that combined. Attacking innocent people with rogue SSIDs would be definitely wrong, but if done only to trick Google it would be a fun experiment - and they deserve it (maybe not for this particular change but as a company in general).
  - notacoward 5y ago
    It doesn't have to be a case they can win to be extremely troublesome for you (though they probably could win if their trademark is embedded in your code). Unless you can afford to make your own lawyers rich, it's a bit unwise to go "I dare you" to large US companies. Better to ship something less incriminating, and leave the spicier suggestions for anonymous comments on web forums.
    - can16358p 5y ago
      Just another idea popped. What if your code doesn't include any bitstream that contains "Starbucks" but has some ML driven mechanism of passively listening to Wifis around the city, noting them and using those names dynamically? Since Starbucks McDonalds etc would (probably) be the highest quantity of signals found your code will be mimicking those names without having a single bit in the code. What would be the legality of that (as long as the intention is not to attack the public)?
      - notacoward 5y ago
        IANAL (maybe one will weigh in) but that sounds a lot safer to me.
      - BenjiWiebe 5y ago
        And while you are at it, store the BSSID along with the SSIDs seen to make it practically indistinguishable from the real thing.
    - tetha 5y ago
- TaylorAlexander 5y ago
  Seems like so few people would a actually do this they would fly under the radar, though it’s good to be aware of potential problems.
- vgeek 5y ago
  Maybe change it up a bit? :D https://www.youtube.com/watch?v=djI_ret3S9g https://www.youtube.com/watch?v=djI_ret3S9g
- nobody9999 5y ago
  >I find no joy in saying it, but I bet that would get you some unwelcome attention - trademark infringement, defamation, tortious interference - from one of those companies. :( While that's a wonderfully dystopian view, I'd expect that wouldn't happen unless you attempted to use such SSIDs in a commercial context. for your "wager" to be successful, I should expect to be sued over saying stuff like "Old McDonald had a quarter pounder Henway" or "Starbuck made the same inferior coffee for Ahab every day." I'll await cease and desist letters from McDonald's and Starbucks. According to the U.S. Patent and Trademark Office[0]: Trademark infringement is the unauthorized use of a trademark or service mark on or in connection with goods and/or services in a manner that is likely to cause confusion, deception, or mistake about the source of the goods and/or services. Not sure how using a WiFi SSID or other statement that includes trademarked terms (especially those that have cultural roots separate from the trademarks) could be an infringement unless the source is actually selling or marketing a competing product. [0] https://www.uspto.gov/page/about-trademark-infringement https://www.uspto.gov/page/about-trademark-infringement
  - notacoward 5y ago
    What part of "likely to cause confusion, deception, or mistake about the source of the goods and/or services" isn't clear to you? McDonalds and Starbucks both provide wi-fi as an enticement for their customers not as a public service. Confusing people as to the origin of the "McDonalds WiFi" SSID pretty clearly fits within that definition. Then there's the "tortious interference" angle, and the fact that they don't have to win any kind of suit to make your life miserable. If you sell a product that uses their trademark to degrade the value of a service they provide, that's more than enough for them to get you into court. Do you like making lawyers (on both sides) rich? Or tying up courts so they can't hear cases with more merit? Because even if you win, those are the outcomes. Vexatious litigation is a real thing, and practically impossible to prosecute. It can happen to you. The real world doesn't care about your notions of abstract justice, and it's not dystopian to recognize that. If anything, it's your utopian view that's "wonderful" (i.e. appealing but unrealistic) here.
    - nobody9999 5y ago
mmh0000 5y ago
A rapsberry pi, a drop dead simple shell script[1], and airbase[0] will get you this in 15 minutes: [0] https://www.aircrack-ng.org/doku.php?id=airbase-ng https://www.aircrack-ng.org/doku.php?id=airbase-ng [1] quickliest and dirtiest: #!/bin/bash while read line; do echo "creating basestation ${line}" airbase-ng -c 9 -e "${line}" -W 1 wlan0 & done < <(echo -e "ap_name_1\nap_name_2\nyet_more_ap")
- stefan_ 5y ago
  You should also randomize the BSSID.
  - deleted 5y ago
    [deleted]
DrBoring 5y ago
> Bonus points for bogus names like "Starbucks Wifi" or "McDonalds Free Wifi" in the middle of the highway. Is the goal to make Google Maps publish a Starbucks/McDonalds in the middle of the highway? I can't imagine they would use the SSID as a source for building location.
- mcast 5y ago
  No, the SSIDs are used to assist the GPS on where the user is located. Likewise, the data is used to triangulate a user in a specific business/location without needing access to GPS (some more nefarious uses: user is connected to "Joe's Psychiatry Wifi" every Wednesday, maybe we could group the user as a depressed adult for advertisers).
  - Nextgrid 5y ago
    > user is connected to "Joe's Psychiatry Wifi" every Wednesday, maybe we could group the user as a depressed adult for advertisers If you can think of any kind of nefarious use for data, you can safely bet that Zuckerberg has already done it: https://web.archive.org/web/20160830031017/http://fusion.net/story/339018/facebook-psychiatrist-privacy-problems/ https://web.archive.org/web/20160830031017/http://fusion.net...
  - gowld 5y ago
    > No, the SSIDs are used to assist the GPS on where the user is located. and vice versa, GPS is used to assist on where the SSIDs are located.
skykooler 5y ago
I used to ride a train which had onboard wifi. Whenever I was on the train and underground, Google Maps would decide that I was at the terminal station of the train - which I assume is where it first scanned that SSID - and would try to reroute me.
- zimpenfish 5y ago
  I had this problem for a few years back in the mid-10s - any time it saw something like "Virgin WIFI", my phone would assume I was in Manchester, even if I was in London / anywhere Virgin trains go, leading to huge jumps in location[1]. [1] which annoys me - a smartphone should be able to figure out that I have not just travelled 200 miles in 2 seconds and filter that out. This is still a (smaller) problem - my current phone often thinks I've jumped 5 miles for a minute and then back.
uneekname 5y ago
If this was codified into a repo, I'd absolutely deploy one or two of my own.

by mcast 5y ago

notacoward 5y ago

> Bonus points for bogus names like "Starbucks Wifi" or "McDonalds Free Wifi" in the middle of the highway. I find no joy in saying it, but I bet that would get you some unwelcome attention - trademark infringement, defamation, tortious interference - from one of those companies. :(

SllX 5y ago
Out of curiosity, has anyone ever been sued over their SSID?
- notacoward 5y ago
  Good question. I'd be surprised if those companies would go after an individual over an "infringing" SSID, but if you sold a product using them that would be a different matter. An open-source project would probably fall somewhere in between.
- dmje 5y ago
  We had one on our street called FuckOffAndGetYourOwn which I always liked
  - Sohcahtoa82 5y ago
    I've always been partial to ones named like "NSA Monitor 3AB9D4"
    - youngbullind 5y ago
      I have my phone's hot-spot named Surveillance van no. 42, and an open guest wifi for whoever needs it called It's nice to be nice
  - nobody9999 5y ago
    >We had one on our street called FuckOffAndGetYourOwn which I always liked There was an SSID in my building called "Free Palestine." A couple years later, someone created another one called "The Shin Bet."[0] I found that to be both disturbing and amusing. After the Muslim grad students on the third floor moved back to Australia, "Free Palestine" disappeared, and when the orthodox Jews moved out of the fourth floor, "The Shin Bet" went away too. Now it's mostly boring, and while I may be doxxing myself (if you can see this SSID, reply here as we almost certainly live in the same building) but I still have the SSID GranMal (an ironic reference to this[1]). Moral: Looking at SSIDs can be fun! [0] https://en.wikipedia.org/wiki/Shin_Bet https://en.wikipedia.org/wiki/Shin_Bet [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6015645/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6015645/
    - apetresc 5y ago
      I don't understand your ironic reference :( What does "GranMal" have to do with that paper about wifi's effect on epileptic rats?
      - duskwuff 5y ago
        A grand mal seizure is a particularly serious type of seizure.
    - SllX 5y ago
      Nobody ever did answer my question, but your comment makes me glad I asked. :) Thanks!
- tqwhite 5y ago
  I have a neighbor whose SSID is itHurtsWhenIP. I've always liked that.
  - nobody9999 5y ago
    >I have a neighbor whose SSID is itHurtsWhenIP. I've always liked that. While it may not be the source of your neighbor's SSID, It's certainly possible (maybe even likely) that it's a reference to this song[0]. [0] https://www.youtube.com/watch?v=3vmPwZT-9zY https://www.youtube.com/watch?v=3vmPwZT-9zY
- notacoward 5y ago
  Yes. https://reason.com/volokh/2018/04/29/libel-by-wifi-network-name/ https://reason.com/volokh/2018/04/29/libel-by-wifi-network-n... Sure, it was defamation rather than copyright, but it certainly puts the lie to a certain other commenter who seems to think that if he personally can't find it on Google then it must not exist.
  - SllX 5y ago
    Well that was an entertaining read. It appears the answer thus far is “yes, at least once.” Thanks!
can16358p 5y ago
Is there a law regarding which names you can't use for hotspots/APs? Even if there is, I doubt anyone will go after that unless the "attacker" involves some serious crime with that combined. Attacking innocent people with rogue SSIDs would be definitely wrong, but if done only to trick Google it would be a fun experiment - and they deserve it (maybe not for this particular change but as a company in general).
- notacoward 5y ago
  It doesn't have to be a case they can win to be extremely troublesome for you (though they probably could win if their trademark is embedded in your code). Unless you can afford to make your own lawyers rich, it's a bit unwise to go "I dare you" to large US companies. Better to ship something less incriminating, and leave the spicier suggestions for anonymous comments on web forums.
  - can16358p 5y ago
    Just another idea popped. What if your code doesn't include any bitstream that contains "Starbucks" but has some ML driven mechanism of passively listening to Wifis around the city, noting them and using those names dynamically? Since Starbucks McDonalds etc would (probably) be the highest quantity of signals found your code will be mimicking those names without having a single bit in the code. What would be the legality of that (as long as the intention is not to attack the public)?
    - notacoward 5y ago
      IANAL (maybe one will weigh in) but that sounds a lot safer to me.
    - BenjiWiebe 5y ago
      And while you are at it, store the BSSID along with the SSIDs seen to make it practically indistinguishable from the real thing.
  - tetha 5y ago
TaylorAlexander 5y ago
Seems like so few people would a actually do this they would fly under the radar, though it’s good to be aware of potential problems.
vgeek 5y ago
Maybe change it up a bit? :D https://www.youtube.com/watch?v=djI_ret3S9g https://www.youtube.com/watch?v=djI_ret3S9g
nobody9999 5y ago
>I find no joy in saying it, but I bet that would get you some unwelcome attention - trademark infringement, defamation, tortious interference - from one of those companies. :( While that's a wonderfully dystopian view, I'd expect that wouldn't happen unless you attempted to use such SSIDs in a commercial context. for your "wager" to be successful, I should expect to be sued over saying stuff like "Old McDonald had a quarter pounder Henway" or "Starbuck made the same inferior coffee for Ahab every day." I'll await cease and desist letters from McDonald's and Starbucks. According to the U.S. Patent and Trademark Office[0]: Trademark infringement is the unauthorized use of a trademark or service mark on or in connection with goods and/or services in a manner that is likely to cause confusion, deception, or mistake about the source of the goods and/or services. Not sure how using a WiFi SSID or other statement that includes trademarked terms (especially those that have cultural roots separate from the trademarks) could be an infringement unless the source is actually selling or marketing a competing product. [0] https://www.uspto.gov/page/about-trademark-infringement https://www.uspto.gov/page/about-trademark-infringement
- notacoward 5y ago
  What part of "likely to cause confusion, deception, or mistake about the source of the goods and/or services" isn't clear to you? McDonalds and Starbucks both provide wi-fi as an enticement for their customers not as a public service. Confusing people as to the origin of the "McDonalds WiFi" SSID pretty clearly fits within that definition. Then there's the "tortious interference" angle, and the fact that they don't have to win any kind of suit to make your life miserable. If you sell a product that uses their trademark to degrade the value of a service they provide, that's more than enough for them to get you into court. Do you like making lawyers (on both sides) rich? Or tying up courts so they can't hear cases with more merit? Because even if you win, those are the outcomes. Vexatious litigation is a real thing, and practically impossible to prosecute. It can happen to you. The real world doesn't care about your notions of abstract justice, and it's not dystopian to recognize that. If anything, it's your utopian view that's "wonderful" (i.e. appealing but unrealistic) here.
  - nobody9999 5y ago

mmh0000 5y ago

A rapsberry pi, a drop dead simple shell script[1], and airbase[0] will get you this in 15 minutes: [0] https://www.aircrack-ng.org/doku.php?id=airbase-ng https://www.aircrack-ng.org/doku.php?id=airbase-ng [1] quickliest and dirtiest: #!/bin/bash while read line; do echo "creating basestation ${line}" airbase-ng -c 9 -e "${line}" -W 1 wlan0 & done < <(echo -e "ap_name_1\nap_name_2\nyet_more_ap")

stefan_ 5y ago
You should also randomize the BSSID.
- deleted 5y ago
  [deleted]

DrBoring 5y ago

> Bonus points for bogus names like "Starbucks Wifi" or "McDonalds Free Wifi" in the middle of the highway. Is the goal to make Google Maps publish a Starbucks/McDonalds in the middle of the highway? I can't imagine they would use the SSID as a source for building location.

mcast 5y ago
No, the SSIDs are used to assist the GPS on where the user is located. Likewise, the data is used to triangulate a user in a specific business/location without needing access to GPS (some more nefarious uses: user is connected to "Joe's Psychiatry Wifi" every Wednesday, maybe we could group the user as a depressed adult for advertisers).
- Nextgrid 5y ago
  > user is connected to "Joe's Psychiatry Wifi" every Wednesday, maybe we could group the user as a depressed adult for advertisers If you can think of any kind of nefarious use for data, you can safely bet that Zuckerberg has already done it: https://web.archive.org/web/20160830031017/http://fusion.net/story/339018/facebook-psychiatrist-privacy-problems/ https://web.archive.org/web/20160830031017/http://fusion.net...
- gowld 5y ago
  > No, the SSIDs are used to assist the GPS on where the user is located. and vice versa, GPS is used to assist on where the SSIDs are located.

skykooler 5y ago

I used to ride a train which had onboard wifi. Whenever I was on the train and underground, Google Maps would decide that I was at the terminal station of the train - which I assume is where it first scanned that SSID - and would try to reroute me.

zimpenfish 5y ago
I had this problem for a few years back in the mid-10s - any time it saw something like "Virgin WIFI", my phone would assume I was in Manchester, even if I was in London / anywhere Virgin trains go, leading to huge jumps in location[1]. [1] which annoys me - a smartphone should be able to figure out that I have not just travelled 200 miles in 2 seconds and filter that out. This is still a (smaller) problem - my current phone often thinks I've jumped 5 miles for a minute and then back.

uneekname 5y ago

If this was codified into a repo, I'd absolutely deploy one or two of my own.