So, a while back, Google started providing location services. This seemed pretty cool, but I kind of ignored it until recently when I was playing with my Android’s location API. With the GPS off, and no cell towers visible (my basement gets terrible cell service), my phone knew within about 500 feet of where it actually was. All I was connected to was my wifi.
Bottom line: it seems that Google, among other methods, is likely wardriving while photographing for Street View. They are now able to pinpoint wifi access points if they happened to see it while driving through your city.
I’m really rather astonished that no one is freaking out about this; I’m a bit unnerved. I implemented the location-of-your-wifi API quickly, so I could terrify myself further. You can do lookups via my location website too, if you want.
UPDATE: yeah, it would seem to be crowd-sourced wifi and cell tower triangulation data. I should say “Google is WarCrowding”.
© 2010, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
Oh wow, this is kind of freaky. Interesting thing though, you said wardriving while while doing the street view stuff, and that’s exactly what I thought, however, they haven’t street viewed my area dude, nor the place I am at right now. The place I am right now, I put in the MAC of her wifi, and it nailed the address everything to a T. I mean it was 100% accurate, not 90%, 80% or less, but dead on accurate. So I tried mine, which is even weirder. It not only hit dead on, but this is a gated community. Which means only vehicles with passes are allowed in here, and we sit off of the main road a bit, like about a half mile or so. There has to be another way they are getting this information, as I know the security to our subdivision voted to not allow Google in here because of the people who live back here being politicians and crimelords :D
Comment by nixternal — January 24, 2010 @ 9:00 pm
I was too playing with the geolocation API some weeks ago and came to the same conclusion as you. I think that they’re also having phones report to them cell towers & WiFi APs along with GPS coordinates so it’s not exactly a one-off wardriving but a constant stream of data, keeping their database up-to-date. FWIW, I also found it terrifying, as most of Google’s activities these days.
Comment by Faidon Liambotis — January 24, 2010 @ 9:26 pm
This is actually not the work of Google, but a company called Skyhook Wireless.
http://media.ccc.de/browse/congress/2009/26c3-3600-de-location_tracking_does_scale_up.html
Comment by sharp — January 24, 2010 @ 9:49 pm
Or they may simply be looking up your IP address when it phones home. Some of those IP lookup services (for particular areas anyways) are deadly accurate.
Comment by DarwinSurvivor — January 24, 2010 @ 10:05 pm
Streetview car has been at my place but doesn’t seem to know about my AP……
Comment by fatal — January 24, 2010 @ 10:36 pm
Didn’t work for me, u’accuracy’: 22000.0
I’m in Toronto.
Comment by Vadim P. — January 24, 2010 @ 10:38 pm
My accuracy is bad to. NZ. Must be USA only?
Comment by Matthew — January 24, 2010 @ 10:50 pm
Well there are other things as well such as your IP & sites you have accessed. You possobly have home location set in Google Maps as well. =)
To be fair I have a feeling that google is searching for something. They know what, but they can’t find it. Holly grail?
Comment by Dmitrijs Ledkovs — January 24, 2010 @ 11:06 pm
Switch off “Detect location based on WiFi/Mobile Networks” and “Allow Google to use your Location Data” on your Android Phone and atleast your Device will not be providing Data to Google anymore. They’re doing just crowd-sourcing. Nothing is better than People walking around and providing you with an accurate fix (coming from GPS), and their view on Cell-IDs and WiFi SSIDs/MACs. This fills a Database up well.
Comment by Eimann — January 24, 2010 @ 11:14 pm
They probably use something similar to Apple. Apple uses Skyhook (http://skyhookwireless.com/) for what they refer to as a “hybrid positioning system”.
Comment by Adam — January 24, 2010 @ 11:16 pm
Yeah, there are companies that provide this location service. For example, the original iPhone. They didn’t have GPS, so the iPhone triangulated cell towers to provide a rough location. It wasn’t very accurate. Then Apple announced they were using a new company’s service that could locate you more accurately, if you were near a WiFi outlet. I don’t know how they do it, but it’s much more accurate. And I assure you, Google hasn’t come down my town’s streets with Street View cam cars yet.
Comment by Charles — January 24, 2010 @ 11:26 pm
Spot on for me, street name and number.
Impressive, we have only been here a year, they must have updated their street view since then.
Comment by Ken — January 24, 2010 @ 11:26 pm
I have heard that iPhones which have GPS send back their position including the list of APs they see at the moment. So it is not necessarily google wardriving but it could also be people using their phones.
Comment by Michael — January 24, 2010 @ 11:39 pm
I’m pretty sure Google is using SkyHook’s access point database. Though likely using other sources as well.
Remember that Skyhook is not only using wardriving (if they still are), but every iPhone is uploading its nearby access points with geo location data back to Skyhook as well. And I’m sure other devices.
Comment by Wade — January 24, 2010 @ 11:42 pm
Hi,
you are aware that there are lots of phones having GPS (or GSM based coordinates) running google maps over wifi?
Iphone, Android, Nokia, Blackberry….. No need to drive around for this!
There was a report in german TV some time ago(CT magazin?) using an iphone packet dump, but I cannot remember if the SSID data was transmitted to apple or google.
have fun
Frank
Comment by Frank — January 25, 2010 @ 12:00 am
If they have access to certain ISP information, they know which DSLAM your home is connected to (for example on ?DSL), and how far it is from you.
Comment by André Oliveira — January 25, 2010 @ 1:31 am
The biggest problem with using wireless mac addresses to determine location is what happens when you unplug your router and take it somewhere else.
Comment by Chris Fleming — January 25, 2010 @ 4:06 am
Who dares freak out about Google? They know where you live, who you email, who visits your website, every search you make, any site you visit with adwords… for starters. I think most people either think that they can do no wrong because of gsoc and using (but usually not sharing) open source in their infrastructure, or… people get that they have become the largest psychological profiling and tracking experiment the world has ever seen who’s only responsibility is to the shareholders. To the second group, this latest news is no surprise at all.
If you have any love of freedom, privacy, or the right to hold your own individual beliefs and opinions I’d start helping out with the OwnCloud project immediately.
Comment by MayNotBeMyRealName — January 25, 2010 @ 8:11 am
I gave this a go. My access point is pretty new so I was quite impressed when the location came up pretty close (500m away).
I then tried your web api and it has me down as in Portland Oregon.
I’m guessing that the google magic falls back to using IP address if the MAC address is unknown.
Good stuff though.
Comment by JohnnyG — January 25, 2010 @ 5:11 pm
Pretty scary if you ask me. I plugged in our MAC address for our AP and it gave a location about 50 metres off. Wrong house number though, which is good… but still. Considering how big the world is, if someone can pinpoint your location down to 50m by using a 12 character hexadecimal code, then that is fairly scary.
My theory is that Google are just becoming an almighty power and offering all these wicked free services until one day, when we’re all dependent on Google, they’ll flick the switch and start billing you for everything… :P
I’m sure the FBI/CIA/government could use this technology to track down bad guys. If they don’t already.
Comment by Benjamin Humphrey — January 25, 2010 @ 6:13 pm
It was unable to identify the location of my AP, or my server, but it did identify the location of my laptop (the machine I primarily use).
Would it be possible that they are associating your mac with the address you entered in a form for a Google service?
Comment by Matt — January 25, 2010 @ 9:11 pm
Wow, I can’t believe some people. Apple has been offering geolocation through wifi router for a while now. When using their maps app on my iTouch this summer in Denver, it tracked where I was by pinging the networks that I passed. Eye-fi uses a similar method for geotagging. Google isn’t evil, they are code-monkeys trying to bring all of the worlds information together. Notice the all part. They don’t read private data, their code does. Its all computers and code. Google might “own” the servers, but they still do respect privacy and don’t steal information outright. I’m more worried about normal companies like airlines that tend to steal and sell personal information. Google is just doing their part to connect the world. So everyone needs to just chill.
Comment by Unbelief — January 25, 2010 @ 9:30 pm
Google knows so much about us, but so do people search engines. Public records are open to all.
Comment by Kenneth Fach — January 26, 2010 @ 9:39 pm
That’s scary
I typed in my old routers mac address (I’ve not used it in about 3 years) I typed in it’s mac address and boom my old address appeared!
Comment by Mike Lothian — January 27, 2010 @ 3:06 am
It’s a bit more accurate if you plug in the signal_strength in dB from several access points your NIC sees.
The best method to plug in full scan data would be to query NetworkManager via DBus.
It’s a bit convoluted but it doesn’t require superuser like iwlist scan or iw dev scan dump.
Comment by Tobias — April 24, 2010 @ 5:15 am