This is also useful to detect the location of the victim. This free service provides geolocation data for WiFi MAC addresses (or BSSIDs). The first services was, which helps the attacker grab the victim’s public IP address. Mertens found a piece of malware that was using a series of services to identify the MAC address of the default gateway for a targeted system. The BSSID is the MAC-based physical address of the wireless router or access point through which the user is connecting to the Internet via WiFi. The new technique is based on identifying the infected system’s BSSID (Basic Service Set Identifier). In the post, Mertens said he had discovered a new malware strain that is using a second technique on top of the IP-to-Geo database lookup. Xavier Mertens, a security researcher with the SANS Internet Storm Center, unveiled a discovery in a blog post last month. Increasing accuracy through layered geo-location methods

That said, it has been the most reliable method of determining a user’s actual physical location based on data found on their computer. This IP-to-geo database technique isn’t very accurate. By the same token, an attacker might specifically target computers located in a specific country, or target IPs belonging to a targeted organization.

Why does location matter?įor example, a malefactor might avoid infecting addresses from their own country, or they could avoid the IPs that belong to a security vendor. They simply grab the victim’s IP address and check it against an IP-to-geo database to get a victim’s approximate geographical location.īy checking the public IP address used by the victim, an attacker can thus avoid infecting friendlies or security services that could pose a threat to their activities. Malware operators who want to know the location of their victims usually rely on a simple technique to determine the infected system’s location. The malware authors the WiFi AP MAC address (aka BSSID) to geo-locate the systems they have infected.

How to know bssid of wifi