Paranoia or Prudence? Don’t Give Google the Keys to Your Wireless Network

Solutionary Blog and Bloggers

Solutionary is an information security company. What does that mean? Simply put, we help businesses protect their assets, remain fully secure and safe online, and maintain and adhere to compliance regulations and standards. Solutionary's blog is a place to learn about, and discuss, a wide variety of security and compliance topics.

For more information about Solutionary, click here.

To read the Solutionary blog comment policy and disclaimer, click here.

Solutionary Bloggers:

Brad Curtis, Compliance Manager              Jon Heimerl, Director of Strategic Security  Mike Hrabik, President and CTO             Don Gray, Chief Security Strategist       Court Little, Director of Strategic Security Joseph Blankenship, Director of Marketing 
Doug Picotte, Regional Technical Manager
Rob Kraus, Director of Research               Erik Barnett, Regional Technical Manager Jose Hernandez, Security Consultant
Jozef Krakora, Sr Product Manager      Robert Jeffries, Research Analyst, Security Engineering Research Team (SERT)

Subscribe to our blog

Your email:

Browse by Tag

Posts by popularity

Solutionary Minds - Your Information Security Blog Source

Current Articles | RSS Feed RSS Feed

Paranoia or Prudence? Don’t Give Google the Keys to Your Wireless Network

Posted by Jose Hernandez on Thu, Dec 15, 2011 @ 09:44 AM
  
  
  
Add to delicious  delicious  
  
As a way to improve location based services for applications like Google Maps, Google started implementing WIFI positioning.  WIFI positioning uses nearby WIFI access points to help triangulate the location of a user’s device.  Some of these include devices we use everyday, such as iPhones, iPads, Kindles, tablets, and laptops. I assure you, the list goes on and on.

WIFI positioning was implemented to help locate devices where GPS and cell tower signals are weak.  In order for WIFI positioning to work Google needs to collect the SSID and MAC address of any broadcasting Access Point. This information is collected using Google Street View vehicles that drive around taking pictures for Google maps.  

In theory this sounds like a good idea, and it can help applications better pinpoint the location of user devices.  WIFI positioning was not a big deal until Google confirmed it was mistakenly collecting payload data from Open WIFI access points with their Street View cars.  This revelation was not a big surprise to me because open access points do not encrypt data and therefore the data can be sniffed by anyone.

This is the part of the blog where I recommend you start wearing your tin foil hats.  Waiting for a plane in Pittsburgh I started looking for an application setting on my android phone.  While checking through my privacy settings, I stumbled on the Backup and Restore setting that was enabled by default on my phone.  This backup agent stores Android settings, application data, and… wait for it…WIFI passwords to Google servers. So, if Google saw your WIFI network while taking photos for street view, and you connected to that same WIFI network with your Android phone, Google now has all the information it would need to gain access into a person’s private home network or even a corporate network.  The user only has to connect to the Access point with their android device and the credentials will be cached in the phone that in turn will be backed up to the Google servers.  To be fair I only checked this backup agent with my Android phone that is running version 2.3.6, the backup agent settings may very well have changed in later version of the Android OS.

So if you are a paranoid person like myself these are some of the things you can do to help mitigate your paranoia.  

•    Change the SSID name of your wireless router and append the words “_nomap”. Doing this will stop Google from including your Wireless Access Point in its location database.
•     Uncheck the backup and restore setting in your android phone.  
•    Change the password in your router since the old password is probably stored on one of Google’s servers.


Okay, maybe that isn’t so paranoid…

 

describe the image

Tags: , , ,

COMMENTS

Currently, there are no comments. Be the first to post one!
Post Comment
Name
 *
Email
 *
Website (optional)
Comment
 *

Allowed tags: <a> link, <b> bold, <i> italics