In a talk titled “How I Met Your Girlfriend,” at the Black Hat conference last week, hacker Samy Kamkar demoed the technique, which he cleverly dubbed an XXXSS. Here's how it works:
- Kamkar plugs the pilfered MAC address into Google Location Services. Within seconds, he has a map showing the victim's location within a few hundred feet.
“Their web browser is compelling this exploit for you,” Kamkar told the audience, which was attending the Black Hat security conference in Las Vegas. “Pretty cool.”
Over the past few years, Kamkar has used XSS, or cross-site scripting, exploits to achieve a variety of hacks. As the author of the Samy Worm, he served a brief stint in jail for unleashing a self-replicating exploit in 2005 that added more than 1 million friends to his MySpace account and in the process knocked the site out of commission. More recently, he's used XSS to burrow into firewalls and home routers.
Of course, a few things have to happen for the attack to work. First, the router needs to be set to use the default administrative password, or it needs to be a model that doesn't require credentials to access its system information page.
And the router's MAC address must already have been recorded by Google's ubiquitous fleet of Street View cars, which roam the earth snapping pictures and sniffing select Wi-Fi data.
“This is geo location gone terrible,” Kamkar said. “Privacy is dead, people.” His presentation slides are here. ®