7 ms·

You Are a Rogue Device (2013)

136 points by jamesbritt 12y ago

klinquist 12y ago
If your wifi is on, cities are not the only people tracking your location. It's a huge industry - Euclid Analytics, Cisco, and others are providing stores with a customer's path, dwell times, etc. Connecting your MAC to your person is trivial with more than one visit to a store in which you pay with a credit card. It should be noted that iOS 8 randomizes the MAC address during wifi probes, so with iOS 8 you will not be trackable unless you install the store's app.
- dandv 12y ago
  You can massively fuck with stores trying to track people, and infect their databases with fake MAC addresses, using Pry-Fi - https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p...
  - wavefunction 12y ago
    Now this sort of post is why I came to HN in the frist place.
  - finnn 12y ago
    "infect" doesnt quite seem to fit, but yeah +1 for Pry-Fi. I just wish it would let me set a specific MAC for a specific SSID. ie xfinitywifi will let you on if your mac is 00:11:22:33:44:55
  - mahyarm 12y ago
    Using pry-fi on my Z1 made my wifi connections unstable to a point where I might as well of not had wifi.
- jlees 12y ago
  A single visit or even a walk-by can reveal a lot too. As I understand it, SSID probing basically reveals all the networks your device knows about to any AP [1]. This can give away a lot of information too. [1] http://blog.rootshell.be/2012/01/12/show-me-your-ssids-ill-tell-who-you-are/ http://blog.rootshell.be/2012/01/12/show-me-your-ssids-ill-t...
ronnier 12y ago
This system was disabled. http://www.komonews.com/news/local/Police-deactivating-controversial-WiFi-network-in-Seattle-231692161.html http://www.komonews.com/news/local/Police-deactivating-contr... http://seattletimes.com/html/latestnews/2022269628_spdwirelessxml.html http://seattletimes.com/html/latestnews/2022269628_spdwirele...
- sleepybrett 12y ago
  Except they are still broadcasting SSIDs... so not so disabled.
GabrielF00 12y ago
Isn't it much more likely that they're building this network for their own internal needs? Police cars have computers, fire department personnel sometimes need to download building plans on site, etc.
- cwh 12y ago
  you are clearly not a [paranoid] american.
  - GabrielF00 12y ago
    I currently live in Seattle and, in the past, I worked on mesh networks for another city. In that other city, the motivating factor for their public safety people was entirely ensuring connectivity for their personnel (making sure that in the event of a disaster, when cell systems might be inoperable, the first responders can still use their devices). Nobody talked about surveillance.
    - nitrogen 12y ago
      Talking about public safety is the easiest way to get something done. The other uses come later, quietly.
    - walshemj 12y ago
      you didn't have the ability to selectively shutdown the mobile network to allow only those emergency and Telco employees with with dual sim'd phones to access in an emergency?
- flatline 12y ago
  I'm sure that is part of what they are building it for. But given all the data from Aruba about the system's tracking capabilities, and the department's dodgy answers about its intended use, I think it would honestly be a stretch at this point to think that's all they are building it for.
  - 12y ago
bcl 12y ago
The title needs to be updated to reflect the article date.
- dang 12y ago
  Ah yes. Thanks.
panarky 12y ago
Good reporting, though I wish the author wouldn't bury the most important paragraph at the end of a longish piece. This is not a purely local issue. It's a coordinated Federal surveillance program masquerading as a local initiative. If federally funded, locally built surveillance systems with little to no oversight can dump their information in a fusion center—think of it as a gun show for surveillance, where agencies freely swap information with little restriction or oversight—that could allow federal agencies such as the FBI and the NSA to do an end-run around any limitations set by Congress or the FISA court.
- honksillet 12y ago
  How would one go about FOI requesting the location of all these devices?
  - mutagen 12y ago
    Federal government will say it's a local issue, talk to SPD. SPD will eventually cite confidentiality agreements with Aruba Networks. When pressed, one of them will provide outdated and/or incomplete data citing jurisdictional boundaries and pleading lack of technical resources to adequately address the request. They've already repeated the drone playbook, public apologies and assertions that only certain capabilities will be used.
    - droopyEyelids 12y ago
      Your answer sounds suspiciously like "give up before trying". I say the correct answer is try, and if you're thwarted, think about it and try some more. If anyone is interested in getting involved, you can call or email the EFF. [1] They've done stuff like this before, and they'll help you get started. If you want someone else to get involved, donate to the EFF. [2] Or even the ACLU [3], because they'll eventually be the ones to defend some victim of the system. [1] https://www.eff.org/about/contact https://www.eff.org/about/contact [2] https://supporters.eff.org/donate https://supporters.eff.org/donate [3] https://www.aclu.org/donate/join-renew-give https://www.aclu.org/donate/join-renew-give
    - 12y ago
nostromo 12y ago
Google should follow Apple's lead and spoof the phone's mac address while wifi scanning to prevent this kind of tracking. http://www.tomsguide.com/us/ios-8-mac-address-randomization,news-18937.html http://www.tomsguide.com/us/ios-8-mac-address-randomization,...
- voltagex_ 12y ago
  It's very very possible, although may need some changes to wpa_supplicant to happen. Anyone know if Apple patented this?
  - ChrisClark 12y ago
    There is an Android app that will do this for you, if you have root. https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p...
    - voltagex_ 12y ago
      Aha! What would we do without Chainfire? This is really something that needs to be baked-in at OS level though. I hope Google catches up. Edit: Star this issue - http://code.google.com/p/android/issues/detail?id=71084 http://code.google.com/p/android/issues/detail?id=71084
  - lstamour 12y ago
    If they did... This is one patent that should be openly, freely licensed in the public interest. This feature alone would be enough for me to switch full-time to an iPhone 6 from my Nexus 5.
    - zilian 12y ago
      If you think you'll have more privacy with iPhones... you'll be disappointed.
      - 12y ago
dperny 12y ago
Reminds me of ctOS from Watch_Dogs. In the game, the fictional Blume Industries sets up a massive, city-wide network, connecting almost everything to the central ctOS supercomputer. One of the ways they build public support for this system is by first providing free wifi to the public in and around Chicago. I know this isn't perfectly analogous, but wifi networks popping up for ostensibly benevolent purposes and then being used to track people seems close enough to warrant a mention.
- jugfjfkugl 12y ago
  How old are you?
  - recursive 12y ago
    I'm not sure if this helps you out, but I'm 33, and it also reminds me of ctOS.
neutronman 12y ago
Ruckus Wireless can do this as well and works a bit better IMO than Aruba.
cortesoft 12y ago
A MAC address is NOT a 'fingerprint'. Anyone could broadcast any MAC address, so I can't imagine it holding up in court as evidence.
- w4 12y ago
  True, but that assumes a degree of technical fluency, which American courts have repeatedly failed to demonstrate.
- zorbo 12y ago
  I think it'll "hold up in court", for certain definitions of "hold up" Judges are not stupid. No single piece of evidence is 100% reliable and enough to get a conviction. A MAC address will just be another piece of the puzzle. Judges will familiarize themselves with what they are and that they can be spoofed, and will take that into account when evaluating the evidence.
honksillet 12y ago
This is Detective Monty Moss. http://i.ytimg.com/vi/MIg3We8iXbw/0.jpg http://i.ytimg.com/vi/MIg3We8iXbw/0.jpg If you see him at a restaurant or shopping or out with the family, politely approach him and politely let him know that you don't appreciate his efforts.
mmaunder 12y ago
From the documentation for Analytics and Location Engine 1.2.1 (ALE): Location API This API retrieves Retrieves historical location objects for a specific MAC client. The last 1000 historical locations are stored for each MAC address. This API also publishes a location event if ALE receives an RSSI reading from a single AP for a station.... The API appears to return an X/Y coord pair which is associated with a campus, building or floor map. It also returns an accuracy value for the XY pair. I dug into this because I was curious if it was getting actual GPS coords but it looks like it's using access point data and floor maps and (now I'm guessing) it may be using multiple RF antennas per AP which lets it separate an area into pie slices. That and signal strength will give you not-too-bad location data. From: http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Default.aspx?EntryId=13705 http://support.arubanetworks.com/Documentation/tabid/77/DMXM...
- xanderstrike 12y ago
  Meraki APs have a similar system. The school I work IT for has used it to correctly identify vandals and thieves on several occasions, and recover stolen wireless devices. It's more than possible, it's already put into practice on many large wifi networks.
- fennecfoxen 12y ago
  Yeah, things like location engines aren't for an outdoor citywide deployment, they're really more for trilaterating your position within a controlled area so you can localize someone's device to one corner of the office. It also helps if you have information on the floor plan so you can adjust the signal strength for attenuation from walls -- that's the kind of precision you're looking at. On a citywide level, though, you don't need that to get an idea of where people have been bringing their phones, just the detection by the access point in question is a major piece of information, readily placing you within a block or so of most APs. Of course, besides the wifi angle, the cell phone companies have something a lot like this too, and sometimes sell it or give it to law enforcement anyway.
ZoFreX 12y ago
> How well can this mesh network see you? How accurately can it geo-locate and track the movements of your phone, laptop, or any other wireless device by its MAC address? Can the network send that information to a database, allowing the SPD to reconstruct who was where at any given time, on any given day, without a warrant? Can the network see you now? I feel like Betteridge's law applies here. Yes, it could. Maybe it does. Do you have any evidence of these claims? Nope. > Note that he didn't say the mesh network couldn't be used for the surveillance functions we asked about, only that it wouldn't. Yes, that literally every enterprise access point in existence could be used for that type of surveillance, so of course he didn't say it couldn't be used for that. That would be lying. So what more assurance could we possibly have than "it wouldn't"?
- msandford 12y ago
  I think there's a big difference between a large enterprise's access points and those that cover a city. First off if your employer is spying on you, you at least have a chance to quit and get another job. Further that new job might not require that you move to avoid surveillance. Also many/most employers don't care enough about specifically where all their employees are to do such a thing. Finally a lot of the employers who do care enough have implemented ID badges. ID badges don't necessarily give you a happy feeling inside since they make it obvious that management doesn't trust everyone equally. But at least the tracking that they do is explicit: you know you're getting logged every time you badge through a door. Imagine the outcry if a city implemented a badge ID system that you needed just to travel anywhere. That literally conjures images of "Papers, please" and the like. The problem is that they have -- without any real, widespread public knowledge or approval -- implemented a small portion of a fairly draconian we-track-you-everywhere kind of system.

136 points by jamesbritt 12y ago

If your wifi is on, cities are not the only people tracking your location. It's a huge industry - Euclid Analytics, Cisco, and others are providing stores with a customer's path, dwell times, etc. Connecting your MAC to your person is trivial with more than one visit to a store in which you pay with a credit card. It should be noted that iOS 8 randomizes the MAC address during wifi probes, so with iOS 8 you will not be trackable unless you install the store's app.

dandv 12y ago
You can massively fuck with stores trying to track people, and infect their databases with fake MAC addresses, using Pry-Fi - https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p...
- wavefunction 12y ago
  Now this sort of post is why I came to HN in the frist place.
- finnn 12y ago
  "infect" doesnt quite seem to fit, but yeah +1 for Pry-Fi. I just wish it would let me set a specific MAC for a specific SSID. ie xfinitywifi will let you on if your mac is 00:11:22:33:44:55
- mahyarm 12y ago
  Using pry-fi on my Z1 made my wifi connections unstable to a point where I might as well of not had wifi.
jlees 12y ago
A single visit or even a walk-by can reveal a lot too. As I understand it, SSID probing basically reveals all the networks your device knows about to any AP [1]. This can give away a lot of information too. [1] http://blog.rootshell.be/2012/01/12/show-me-your-ssids-ill-tell-who-you-are/ http://blog.rootshell.be/2012/01/12/show-me-your-ssids-ill-t...

ronnier 12y ago

This system was disabled. http://www.komonews.com/news/local/Police-deactivating-controversial-WiFi-network-in-Seattle-231692161.html http://www.komonews.com/news/local/Police-deactivating-contr... http://seattletimes.com/html/latestnews/2022269628_spdwirelessxml.html http://seattletimes.com/html/latestnews/2022269628_spdwirele...

sleepybrett 12y ago
Except they are still broadcasting SSIDs... so not so disabled.

GabrielF00 12y ago

Isn't it much more likely that they're building this network for their own internal needs? Police cars have computers, fire department personnel sometimes need to download building plans on site, etc.

cwh 12y ago
you are clearly not a [paranoid] american.
- GabrielF00 12y ago
  I currently live in Seattle and, in the past, I worked on mesh networks for another city. In that other city, the motivating factor for their public safety people was entirely ensuring connectivity for their personnel (making sure that in the event of a disaster, when cell systems might be inoperable, the first responders can still use their devices). Nobody talked about surveillance.
  - nitrogen 12y ago
    Talking about public safety is the easiest way to get something done. The other uses come later, quietly.
  - walshemj 12y ago
    you didn't have the ability to selectively shutdown the mobile network to allow only those emergency and Telco employees with with dual sim'd phones to access in an emergency?
flatline 12y ago
I'm sure that is part of what they are building it for. But given all the data from Aruba about the system's tracking capabilities, and the department's dodgy answers about its intended use, I think it would honestly be a stretch at this point to think that's all they are building it for.
- 12y ago

bcl 12y ago

The title needs to be updated to reflect the article date.

dang 12y ago
Ah yes. Thanks.

panarky 12y ago

Good reporting, though I wish the author wouldn't bury the most important paragraph at the end of a longish piece. This is not a purely local issue. It's a coordinated Federal surveillance program masquerading as a local initiative. If federally funded, locally built surveillance systems with little to no oversight can dump their information in a fusion center—think of it as a gun show for surveillance, where agencies freely swap information with little restriction or oversight—that could allow federal agencies such as the FBI and the NSA to do an end-run around any limitations set by Congress or the FISA court.

honksillet 12y ago
How would one go about FOI requesting the location of all these devices?
- mutagen 12y ago
  Federal government will say it's a local issue, talk to SPD. SPD will eventually cite confidentiality agreements with Aruba Networks. When pressed, one of them will provide outdated and/or incomplete data citing jurisdictional boundaries and pleading lack of technical resources to adequately address the request. They've already repeated the drone playbook, public apologies and assertions that only certain capabilities will be used.
  - droopyEyelids 12y ago
    Your answer sounds suspiciously like "give up before trying". I say the correct answer is try, and if you're thwarted, think about it and try some more. If anyone is interested in getting involved, you can call or email the EFF. [1] They've done stuff like this before, and they'll help you get started. If you want someone else to get involved, donate to the EFF. [2] Or even the ACLU [3], because they'll eventually be the ones to defend some victim of the system. [1] https://www.eff.org/about/contact https://www.eff.org/about/contact [2] https://supporters.eff.org/donate https://supporters.eff.org/donate [3] https://www.aclu.org/donate/join-renew-give https://www.aclu.org/donate/join-renew-give
  - 12y ago

nostromo 12y ago

Google should follow Apple's lead and spoof the phone's mac address while wifi scanning to prevent this kind of tracking. http://www.tomsguide.com/us/ios-8-mac-address-randomization,news-18937.html http://www.tomsguide.com/us/ios-8-mac-address-randomization,...

voltagex_ 12y ago
It's very very possible, although may need some changes to wpa_supplicant to happen. Anyone know if Apple patented this?
- ChrisClark 12y ago
  There is an Android app that will do this for you, if you have root. https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p...
  - voltagex_ 12y ago
    Aha! What would we do without Chainfire? This is really something that needs to be baked-in at OS level though. I hope Google catches up. Edit: Star this issue - http://code.google.com/p/android/issues/detail?id=71084 http://code.google.com/p/android/issues/detail?id=71084
- lstamour 12y ago
  If they did... This is one patent that should be openly, freely licensed in the public interest. This feature alone would be enough for me to switch full-time to an iPhone 6 from my Nexus 5.
  - zilian 12y ago
    If you think you'll have more privacy with iPhones... you'll be disappointed.
    - 12y ago

dperny 12y ago

Reminds me of ctOS from Watch_Dogs. In the game, the fictional Blume Industries sets up a massive, city-wide network, connecting almost everything to the central ctOS supercomputer. One of the ways they build public support for this system is by first providing free wifi to the public in and around Chicago. I know this isn't perfectly analogous, but wifi networks popping up for ostensibly benevolent purposes and then being used to track people seems close enough to warrant a mention.

jugfjfkugl 12y ago
How old are you?
- recursive 12y ago
  I'm not sure if this helps you out, but I'm 33, and it also reminds me of ctOS.

neutronman 12y ago

Ruckus Wireless can do this as well and works a bit better IMO than Aruba.

cortesoft 12y ago

A MAC address is NOT a 'fingerprint'. Anyone could broadcast any MAC address, so I can't imagine it holding up in court as evidence.

w4 12y ago
True, but that assumes a degree of technical fluency, which American courts have repeatedly failed to demonstrate.
zorbo 12y ago
I think it'll "hold up in court", for certain definitions of "hold up" Judges are not stupid. No single piece of evidence is 100% reliable and enough to get a conviction. A MAC address will just be another piece of the puzzle. Judges will familiarize themselves with what they are and that they can be spoofed, and will take that into account when evaluating the evidence.

honksillet 12y ago

This is Detective Monty Moss. http://i.ytimg.com/vi/MIg3We8iXbw/0.jpg http://i.ytimg.com/vi/MIg3We8iXbw/0.jpg If you see him at a restaurant or shopping or out with the family, politely approach him and politely let him know that you don't appreciate his efforts.

mmaunder 12y ago

From the documentation for Analytics and Location Engine 1.2.1 (ALE): Location API This API retrieves Retrieves historical location objects for a specific MAC client. The last 1000 historical locations are stored for each MAC address. This API also publishes a location event if ALE receives an RSSI reading from a single AP for a station.... The API appears to return an X/Y coord pair which is associated with a campus, building or floor map. It also returns an accuracy value for the XY pair. I dug into this because I was curious if it was getting actual GPS coords but it looks like it's using access point data and floor maps and (now I'm guessing) it may be using multiple RF antennas per AP which lets it separate an area into pie slices. That and signal strength will give you not-too-bad location data. From: http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Default.aspx?EntryId=13705 http://support.arubanetworks.com/Documentation/tabid/77/DMXM...

xanderstrike 12y ago
Meraki APs have a similar system. The school I work IT for has used it to correctly identify vandals and thieves on several occasions, and recover stolen wireless devices. It's more than possible, it's already put into practice on many large wifi networks.
fennecfoxen 12y ago
Yeah, things like location engines aren't for an outdoor citywide deployment, they're really more for trilaterating your position within a controlled area so you can localize someone's device to one corner of the office. It also helps if you have information on the floor plan so you can adjust the signal strength for attenuation from walls -- that's the kind of precision you're looking at. On a citywide level, though, you don't need that to get an idea of where people have been bringing their phones, just the detection by the access point in question is a major piece of information, readily placing you within a block or so of most APs. Of course, besides the wifi angle, the cell phone companies have something a lot like this too, and sometimes sell it or give it to law enforcement anyway.

ZoFreX 12y ago

> How well can this mesh network see you? How accurately can it geo-locate and track the movements of your phone, laptop, or any other wireless device by its MAC address? Can the network send that information to a database, allowing the SPD to reconstruct who was where at any given time, on any given day, without a warrant? Can the network see you now? I feel like Betteridge's law applies here. Yes, it could. Maybe it does. Do you have any evidence of these claims? Nope. > Note that he didn't say the mesh network couldn't be used for the surveillance functions we asked about, only that it wouldn't. Yes, that literally every enterprise access point in existence could be used for that type of surveillance, so of course he didn't say it couldn't be used for that. That would be lying. So what more assurance could we possibly have than "it wouldn't"?

msandford 12y ago
I think there's a big difference between a large enterprise's access points and those that cover a city. First off if your employer is spying on you, you at least have a chance to quit and get another job. Further that new job might not require that you move to avoid surveillance. Also many/most employers don't care enough about specifically where all their employees are to do such a thing. Finally a lot of the employers who do care enough have implemented ID badges. ID badges don't necessarily give you a happy feeling inside since they make it obvious that management doesn't trust everyone equally. But at least the tracking that they do is explicit: you know you're getting logged every time you badge through a door. Imagine the outcry if a city implemented a badge ID system that you needed just to travel anywhere. That literally conjures images of "Papers, please" and the like. The problem is that they have -- without any real, widespread public knowledge or approval -- implemented a small portion of a fairly draconian we-track-you-everywhere kind of system.