It is known that another way to determine the position is through WPS (Wi-Fi Positioning System). This uses the Wi-Fi networks available in the area, if any, to dermine the position. But according to this, it requires that the network had been previously gathered and stored in a database through a process called wardriving, it stores the SSID and the MAC Address, so I was wondering how it is possible that this wardriving applications can obtain the MAC Address of the Wi-Fi network (access point)? Is it possible to obtain it even though your network is password protected (WEP, WPA2, etc)?
closed as off-topic by Xander, Adnan, Lucas Kauffman, Iszi, TildalWave Aug 20 at 16:37
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – Xander, Adnan, Lucas Kauffman, TildalWave
Wardriving is now out of date, if you're a corporation that sells phones. Google used to perform wardriving with their Street View trucks, but they no longer do. You might describe the modern tactic as "distributed war-usering". A ZDNet article entitled "How Google--and everyone else--gets Wi-Fi location data" describes the process:
To describe a simple case: your Android phone has GPS and Wifi turned on. Your phone sends a message to Google saying, "I am at long/lat location (X,Y), and I can see two Wifi networks; one with SSID Foobar (with MAC 11:22:...) and another with SSID Bazzle (with MAC address 33:44:...)." Google uses this information to learn that networks with those particular SSIDs and MACs are near geographic location (X,Y).
Thus, when a user without GPS wants to know his location, his phone can say to Google, "I see Bazzle with MAC 33:44:..." and Google can respond that he is probably near location (X,Y).
The MAC address of an access point is no more private than its SSID. Wifi encryption can protect the information above the media-exchange level, but currently no Wifi protocols encrypt the Level 2 communication. The advertised MAC addresses of participants in any Wifi communication is public information to anyone nearby.
I think the first confusion is that it is not your MAC address, as in the MAC address of your device, but it's actually the MAC address of the Access Point. The access point generally has a fixed location where a WiFi device, such as your phone or laptop, may not.
Even so, moving on from that you can also still obtain the MAC address of all the WiFi clients in range without being connected to their respective WiFi Access Point. The source and destination MAC address of any packet are clearly visible.
You can use tools like Backtrack which is a Linux distro that contains a wide range of penetration testing tools. Airodump can tell you all Access Points in range, which WiFi clients are connected to them and the MAC addresses of all of them.