Black Hat

Hacker Uses XSS and Google Street View Data to Determine Physical Location

Samy Kamkar, in an incredibly interesting session at Black Hat titled “How I Met Your Girlfriend,” highlighted new types attacks executed from the Web.

SecurityWeek Video

Published

August 2, 2010

<img src="/sites/default/files/How_I_Met_Your_Girlfriend_0.jpg" alt="Black Hat - How I met your Girlfriend" title="Samy Kamkar - Black Hat - How I met your Girlfriend" width="150" height="103" style="margin: 5px; float: left;" />Samy Kamkar, in an incredibly interesting session at Black Hat titled “How I Met Your Girlfriend,” highlighted new types attacks executed from the Web.

Samy Kamkar, in an incredibly interesting session at Black Hat titled “How I Met Your Girlfriend,” highlighted new types attacks executed from the Web. During his talk Kamkar demonstrated how to extract extremely accurate geo-location information from a Web browser, while not using any IP geo-location data.

Kamkar, by convincing the victim to visit his malicious Web site, used remote JavaScript and AJAX to acquire a routers MAC address. When the unsuspecting user visited his malicious Web site, JavaScript remotely scanned for the type of router used, accessed the routers MAC address and sent it directly to him. From there, he was able to utilize Google Street View data to determine the location of a router – in his case, accurate within 30 feet.

Kamkar, author of an XSS worm that hit MySpace and generated over 1mm friends for him in less than 24 hours, demonstrates this hack in the video below.

Video of Samy Kamkar demonstrating the geolocation hack from his talk at Black Hat 2010 last week in Las Vegas.

Subscribe to SecurityWeek by RSS (Opens New Window)

In this article:

Related Content