Wardriving

Last updated

A free public Wi-Fi access point Seattle - Columbia City WiFi.jpg
A free public Wi-Fi access point

Wardriving is the act of searching for Wi-Fi wireless networks as well as cell towers, usually from a moving vehicle, using a laptop or smartphone. Software for wardriving is freely available on the internet.

Contents

Warbiking, warcycling, warwalking and similar use the same approach but with other modes of transportation.

Etymology

War driving originated from wardialing, a method popularized by a character played by Matthew Broderick in the film WarGames , and named after that film. War dialing consists of dialing every phone number in a specific sequence in search of modems. [1]

Variants

Warbiking or warcycling is similar to wardriving, but is done from a moving bicycle or motorcycle. This practice is sometimes facilitated by mounting a Wi-Fi enabled device on the vehicle.

Warwalking, or warjogging, is similar to wardriving, but is done on foot rather than from a moving vehicle. The disadvantages of this method are a slower speed of travel (leading to the discovery of more infrequently discovered networks) and the absence of a convenient computing environment. Consequently, handheld devices such as pocket computers, which can perform such tasks while users are walking or standing, have dominated this practice. Technology advances and developments in the early 2000s expanded the extent of this practice. Advances include computers with integrated Wi-Fi, rather than CompactFlash (CF) or PC Card (PCMCIA) add-in cards in computers such as Dell Axim, Compaq iPAQ and Toshiba pocket computers starting in 2002. Later, the active Nintendo DS and Sony PSP enthusiast communities gained Wi-Fi abilities on these devices. Further, nearly all modern smartphones integrate Wi-Fi and Global Positioning System (GPS).

Warrailing, or Wartraining, is similar to wardriving, but is done on a train or tram rather than from a slower more controllable vehicle. The disadvantages of this method are higher speed of travel (resulting in less discovery of more infrequently discovered networks) and often limited to major roads with higher traffic.

Warkitting is a combination of wardriving and rootkitting. [2] In a warkitting attack, a hacker replaces the firmware of an attacked router. This allows them to control all traffic for the victim, and could even permit them to disable TLS by replacing HTML content as it is being downloaded. [3] Warkitting was identified by Tsow, Jakobsson, Yang, and Wetzel.

Warflying is a variant utilizing aircraft flying around and locating nodes. It was first performed in Perth with a Grumman Tiger in August 2002, [4] and a week later in San Diego in August 2002 in a Cessna 182. [5] [6]

Mapping

A map of Seattle's Wi-Fi nodes, generated from information logged by wardriving students in 2004 Seattle Wi-Fi map UW-300-letter-3.png
A map of Seattle's Wi-Fi nodes, generated from information logged by wardriving students in 2004
A map of Wi-Fi nodes in the United States and parts of Canada tracked by the WiGLE project WiGLE map United States.png
A map of Wi-Fi nodes in the United States and parts of Canada tracked by the WiGLE project

Wardrivers use a Wi-Fi-equipped device together with a GPS device to record the location of wireless networks. The results can then be uploaded to websites like WiGLE, openBmap or Geomena where the data is processed to form maps of the network neighborhood. There are also clients available for smartphones running Android that can upload data directly. For better range and sensitivity, antennas are built or bought, and vary from omnidirectional to highly directional.

The maps of known network IDs can then be used as a geolocation system—an alternative to GPS—by triangulating the current position from the signal strengths of known network IDs. Examples include Place Lab by Intel, Skyhook, Navizon [7] by Cyril Houri, SeekerLocate from Seeker Wireless, openBmap and Geomena. Navizon and openBmap combines information from Wi-Fi and cell phone tower maps contributed by users from Wi-Fi-equipped cell phones. [8] [9] In addition to location finding, this provides navigation information, and allows for the tracking of the position of friends, and geotagging.

In December 2004, a class of 100 undergraduates worked to map the city of Seattle, Washington over several weeks. They found 5,225 access points; 44% were secured with WEP encryption, 52% were open, and 3% were pay-for-access. They noticed trends in the frequency and security of the networks depending on location. Many of the open networks were clearly intended to be used by the general public, with network names like "Open to share, no porn please" or "Free access, be nice." The information was collected into high-resolution maps, which were published online. [10] [11] Previous efforts had mapped cities such as Dublin. [12]

Some portray wardriving as a questionable practice (typically from its association with piggybacking), though, from a technical viewpoint, everything is working as designed: many access points broadcast identifying data accessible to anyone with a suitable receiver. It could be compared to making a map of a neighborhood's house numbers and mail box labels. [13]

While some may claim that wardriving is illegal, there are no laws that specifically prohibit or allow wardriving, though many localities have laws forbidding unauthorized access of computer networks and protecting personal privacy. Google created a privacy storm in some countries after it eventually admitted systematically but surreptitiously gathering Wi-Fi data while capturing video footage and mapping data for its Street View service. [14] It has since been using Android-based mobile devices to gather this data. [15]

Passive, listen-only wardriving (with programs like Kismet or KisMAC) does not communicate at all with the networks, merely logging broadcast addresses. This can be likened to listening to a radio station that happens to be broadcasting in the area or with other forms of DXing.

With other types of software, such as NetStumbler, the wardriver actively sends probe messages, and the access point responds per design. The legality of active wardriving is less certain, since the wardriver temporarily becomes "associated" with the network, even though no data is transferred. Most access points, when using default "out of the box" security settings, are intended to provide wireless access to all who request it. The war driver's liability may be reduced by setting the computer to a static IP, instead of using DHCP, preventing the network from granting the computer an IP address or logging the connection. [16]

In the United States, the case that is usually referenced in determining whether a network has been "accessed" is State v. Allen . In this case, Allen had been wardialing in an attempt to get free long-distance calling through Southwestern Bell's computer systems. When presented with a password protection screen, however, he did not attempt to bypass it. The court ruled that although he had "contacted" or "approached" the computer system, this did not constitute "access" of the company's network. [17] [18] [19] [20] [21]

Software

There are also homebrew wardriving applications for handheld game consoles that support Wi-Fi, such as sniff jazzbox/wardive for the Nintendo DS/Android, Road Dog for the Sony PSP, WiFi-Where for the iPhone, G-MoN, Wardrive, [24] Wigle Wifi for Android, and WlanPollution [25] for Symbian NokiaS60 devices. There also exists a mode within Metal Gear Solid: Portable Ops for the Sony PSP (wherein the player is able to find new comrades by searching for wireless access points) which can be used to wardrive. Treasure World for the DS is a commercial game in which gameplay wholly revolves around wardriving.

See also

Related Research Articles

<span class="mw-page-title-main">Wireless network</span> Computer network not fully connected by cables

A wireless network is a computer network that uses wireless data connections between network nodes. Wireless networking allows homes, telecommunications networks and business installations to avoid the costly process of introducing cables into a building, or as a connection between various equipment locations. Admin telecommunications networks are generally implemented and administered using radio communication. This implementation takes place at the physical level (layer) of the OSI model network structure.

<span class="mw-page-title-main">Warchalking</span> Graffiti indicating open Wi-Fi

Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi network. Inspired by hobo symbols, the warchalking marks were conceived by a group of friends in June 2002 and publicised by Matt Jones who designed the set of icons and produced a downloadable document containing them. Within days of Jones publishing a blog entry about warchalking, articles appeared in dozens of publications and stories appeared on several major television news programs around the world.

<span class="mw-page-title-main">Wi-Fi</span> Wireless local area network

Wi-Fi is a family of wireless network protocols based on the IEEE 802.11 family of standards, which are commonly used for local area networking of devices and Internet access, allowing nearby digital devices to exchange data by radio waves. These are the most widely used computer networks, used globally in home and small office networks to link devices and to provide Internet access with wireless routers and wireless access points in public places such as coffee shops, hotels, libraries, and airports to provide visitors.

Wardialing is a technique to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for modems, computers, bulletin board systems and fax machines. Hackers use the resulting lists for various purposes: hobbyists for exploration, and crackers—malicious hackers who specialize in breaching computer security—for guessing user accounts, or locating modems that might provide an entry-point into computer or other electronic systems. It may also be used by security personnel, for example, to detect unauthorized devices, such as modems or faxes, on a company's telephone network.

<span class="mw-page-title-main">Wi-Fi hotspot</span> Wi-Fi access point

A hotspot is a physical location where people can obtain Internet access, typically using Wi-Fi technology, via a wireless local-area network (WLAN) using a router connected to an Internet service provider.

Sony's LocationFree is the marketing name for a group of products and technologies for timeshifting and placeshifting streaming video. The LocationFree Player is an Internet-based multifunctional device used to stream live television broadcasts, DVDs and DVR content over a home network or the Internet. It is in essence a remote video streaming server product. It was first announced by Sony in Q1 2004 and launched early in Q4 2004 alongside a co-branded wireless tablet TV. The last LocationFree product was the LF-V30 released in 2007.

<span class="mw-page-title-main">Tethering</span> Sharing of a mobile devices Internet connection with other connected computers

Tethering or phone-as-modem (PAM) is the sharing of a mobile device's Internet connection with other connected computers. Connection of a mobile device with other devices can be done over wireless LAN (Wi-Fi), over Bluetooth or by physical connection using a cable, for example through USB.

Wi-Fi calling refers to mobile phone voice calls and data that are made over IP networks using Wi-Fi, instead of the cell towers provided by cellular networks. Using this feature, compatible handsets are able to route regular cellular calls through a wireless LAN (Wi-Fi) network with broadband Internet, while seamlessly change connections between the two where necessary. This feature makes use of the Generic Access Network (GAN) protocol, also known as Unlicensed Mobile Access (UMA).

Piggybacking on Internet access is the practice of establishing a wireless Internet connection by using another subscriber's wireless Internet access service without the subscriber's explicit permission or knowledge. It is a legally and ethically controversial practice, with laws that vary by jurisdiction around the world. While completely outlawed or regulated in some places, it is permitted in others.

Skyhook is a location technology company based in Boston, Massachusetts, specializing in location positioning, context, and intelligence. Founded in 2003, Skyhook originally began by geolocating Wi-Fi access points. Since then, Skyhook has been focusing on hybrid positioning technology, incorporating with Wi-Fi, GPS, cell towers, IP address, and device sensors to improve device location.

Real-time geotagging refers to the automatic technique of acquiring media, associating a specific location with the media, transferring the media to an online map and publishing the media in real time. It is thus an extension of an automatic geotagging process, requiring an in-built or attached location acquisition device, but also requires communication with a wireless data transfer device. Most modern smartphones and several digital cameras already integrate camera, aGPS, and wireless data transfer into one device, thus directly producing a geotagged photograph. Real-time geotagging is sometimes referred to as "mobile geotagging" or "autogeotagging", but this does not imply the real-time publishing step.

Wi-Fi Direct is a Wi-Fi standard for peer-to-peer wireless connections that allows two devices to establish a direct Wi-Fi connection without an intermediary wireless access point, router, or Internet connection. Wi-Fi Direct is single-hop communication, rather than multi-hop communication like wireless ad hoc networks.

WiFi-Where was a tool that facilitated Wardriving and detection of wireless LANs using the 802.11b, 802.11a and 802.11g WLAN standards. Versions existed for the operating systems iOS and Palm OS. Originally created in June 2004 for the Palm OS by Jonathan Hays of Hazelware Software, the IP for WiFi-Where was licensed to 3Jacks Software in 2009. An iPhone version of the application was released in January 2010, but was pulled from the App Store by Apple in March 2010. The app was frequently listed as a common tool to facilitate Wardriving As of 2010, it is still available in the Jailbroken Cydia store.

A GSM Cell ID (CID) is a generally unique number used to identify each base transceiver station (BTS) or sector of a BTS within a location area code (LAC) if not within a GSM network.

<span class="mw-page-title-main">WiGLE</span> Worldwide hotspot information collection website

WiGLE is a website for collecting information about the different wireless hotspots around the world. Users can register on the website and upload hotspot data like GPS coordinates, SSID, MAC address and the encryption type used on the hotspots discovered. In addition, cell tower data is uploaded and displayed.

Mobile security, or mobile device security, is the protection of smartphones, tablets, and laptops from threats associated with wireless computing. It has become increasingly important in mobile computing. The security of personal and business information now stored on smartphones is of particular concern.

Republic Wireless was an American mobile virtual network operator (MVNO). Republic sold low cost mobile phone service on partner networks. Republic started as a unique company that provided customers with VOIP numbers which relied on WiFi first with cell as a backup.

Smartphone ad hoc networks are wireless ad hoc networks that use smartphones. Once embedded with ad hoc networking technology, a group of smartphones in close proximity can together create an ad hoc network. Smart phone ad hoc networks use the existing hardware in commercially available smartphones to create peer-to-peer networks without relying on cellular carrier networks, wireless access points, or traditional network infrastructure. Wi-Fi SPANs use the mechanism behind Wi-Fi ad-hoc mode, which allows phones to talk directly among each other, through a transparent neighbor and route discovery mechanism. SPANs differ from traditional hub and spoke networks, such as Wi-Fi Direct, in that they support multi-hop routing and relays and there is no notion of a group leader, so peers can join and leave at will without destroying the network.

Mozilla Location Service (MLS) is an open geolocation service which allows devices to find their position by processing their received signals of publicly observable radio transmitters: cellular network antennae, Wi-Fi access points, and Bluetooth beacons. The service is provided by Mozilla since 2013. The service uses Mozilla's open source software project called Ichnaea.

Google Fi Wireless, formerly Project Fi and Google Fi, is an American MVNO telecommunications service by Google that provides telephone calls, SMS, and mobile broadband using cellular networks and Wi-Fi. Google Fi uses the T-Mobile network. Google Fi is a service for US residents only, as of late 2023.

References

  1. "War Driving Attack".
  2. Tsow, Alex. "Warkitting: the Drive-by Subversion of Wireless Home Routers" (PDF).
  3. Myers, Steven. "Practice and Prevention of Home-Router Mid-Stream Injection Attacks".
  4. "War driving takes to the air over Perth". The Sydney Morning Herald. 27 August 2002. Retrieved 20 March 2023.
  5. Stevenson, David (4 September 2002). "Warflying for Wi-Fi". G4TV. Archived from the original on 29 September 2007. Retrieved 20 March 2023.
  6. "Ars Technica: War Flying - Page 1 - (8/2002)". arstechnica.com. 28 August 2002. Retrieved 3 September 2002.
  7. "WiFi and Cell-ID location database with Global coverage".
  8. Rose, Frank (June 2006). "Lost and Found in Manhattan". Wired . Vol. 14, no. 6. Retrieved 1 September 2007.
  9. Blackwell, Gerry (19 December 2005). "Using Wi-Fi/Cellular in P2P Positioning". Wi-Fi Planet. Retrieved 1 September 2007.
  10. Marwick, Alice (15 February 2005). "Seattle WiFi Map Project". Students of COM300, Fall 2004 – Basic Concepts of New Media. Retrieved 1 September 2007.
  11. Heim, Kristi (18 February 2005). "Seattle's packed with Wi-Fi spots". The Seattle Times. Retrieved 1 September 2007.
  12. Murphy, Niall; Malone, David; Duffy, Ken (25 September 2002). "802.11 Wireless Networking Deployment Survey for Dublin, Ireland" (PDF). Enigma Consulting Technical Report. Retrieved 2 October 2002.
  13. "Worldwide WarDrive Aftermath – Slashdot".
  14. "Google-Debatte: Datenschützer kritisieren W-Lan-Kartografie – SPIEGEL ONLINE". Der Spiegel. Retrieved 8 November 2012.
  15. "mapping MAC addresses – samy kamkar". Samy.pl. Retrieved 8 November 2012.
  16. Wei-Meng Lee (27 May 2004). "Wireless Surveying on the Pocket PC". O'Reilly Network. Archived from the original on 19 June 2009. Retrieved 1 September 2007.
  17. Brenner, Susan (12 February 2006). "Access". CYB3RCRIM3. Retrieved 2 September 2007.
  18. Bierlein, Matthew (2006). "Policing the Wireless World: Access Liability in the Open Wi-Fi Era" (PDF). Ohio State Law Journal. 67 (5). Retrieved 1 September 2007.
  19. Ryan, Patrick S. (2004). "War, Peace, or Stalemate: Wargames, Wardialing, Wardriving, and the Emerging Market for Hacker Ethics". Virginia Journal of Law & Technology. 9 (7). SSRN   585867. – Article on the ethics and legality of wardriving
  20. Kern, Benjamin D. (December 2005). "Whacking, Joyriding and War-Driving: Roaming Use of Wi-Fi and the Law". CIPerati. 2 (4). Retrieved 1 September 2007.
  21. Alternate PDF – Law review article on the legality of wardriving, piggybacking and accidental use of open networks
  22. "NetSpot: WiFi Site Survey Software for MAC OS X & Windows".
  23. "Apple widens App Store bans, Wi-Fi scanners on the chopping block". DVICE. Retrieved 8 November 2012.
  24. @WardriveOrg. "Wardrive.Org".
  25. "Web hosting, domain names, VPS - 000webhost.com".