Location services? I don't think so. Big Brother’s out there for you.
Location, location, location.
No, I'm not talking about a hotel, I'm talking about location services.
Nowadays, an overwhelming number of auto-starting location services are installed in computers and a bunch of other devices (mobile phones, "smart" devices connected to the Internet, etc.).
Unless you disable these services, they can track every minute of your day.
How convenient for intelligence services and corporations, isn't it?
Even disabling them could not be enough, though.
Every time you use your cell phone, it needs to connect to at least two towers, for it to have coverage (ever wondered why do you sometimes see something like "looking for service"?)
This is called triangulation.
Another source of potential privacy invasion are the pictures you post online, or save to the cloud.
Pictures contain a bunch of metadata, that can be used for hacking and forensics, as they supply valuable information, such as latitude and longitude, camera type and settings, who created the file. etc.
If you plug the coordinates into Google Maps, you can have a very precise idea of the location they're referred to.
For a clearer understanding of how this works, I'm going to analyze (like I did for my Computer Crime class) a random picture on Google to see what information I can harvest from it.
I found a beautiful photo. From Firefox, by right-clicking the image, you can copy the link location.
With this data, I went to http://regex.info/exif.cgi
This website allows to view metadata from images.
I was able to spot a specific location for this file and also a map of the coordinates retrieved (view the embedded videos for more details about it).
You can plug location data into Google Maps, or Map Quest for more details.
You can also use Google Earth and StreetView to narrow down your search.
Once you have a location, you can plug the coordinates into search engines like People Finder - AnyWho (along with Google and other common engines) and obtain many more valuable pieces of information, such as social media profiles, phone numbers, financial reports, employer, etc. (depending on what stuff you got online).
After retrieving your social media profiles, attackers can try and hack into them. If they succeed and, by chance, you got daisy-chained accounts and used a social profile password for other websites, they can hack those related accounts, too.
Nowadays even a small crumb of information can wreak havoc.
An attacker can uncover for example, what ISP you have (based on your location and other data) and what places you visited.
Check, for example:
Check, for example:
Attackers could also use social engineering.
They could know from your location history that you've been to a certain store the day before and you bought something from there.
They could know from your location history that you've been to a certain store the day before and you bought something from there.
At this point they could call you pretending to be a store employee and try tricking you into opening an infected site, or giving away personal credentials (passwords, userid, etc.).
There's no limit to imagination...
Comments
Post a Comment