By default, my AT&T home router doesn't ask for credentials until I ask to change something. Our office router is completely authenticated with HTTP Basic. Different routers, different results, but there are an awful lot of routers that assume that if you can hit the router's internal address, it must be safe for you to get information about the router.
Typically this means there's either a serious XSS flaw or a default password on your router. Someone could, for example, change your DNS settings and start intercepting your traffic.
If your browser runs Java code without a warning you have a lot more problems than someone knowing your MAC... Also that would still not be your router's MAC.
How does google know where MAC addresses are? I thought that they were non-routable, so they are limited to the extremely local connection. Presumably the range from your computer to the termination of the cable modem on the other end.
It's the MAC or your wireless router. They collected them with their street view cars.
There was a big, overblown privacy scare some months ago because it was discovered that the cars also accidentally saved some stray unencrypted packets of traffic as they cruised around.
Yes, it's significant to note that Google (à la Street View scanning) is not the only party that's made a concerted effort to collect them. Whether Google's purchased (or absorbed) such data from others, I don't know.
I speculate that further routes for collection may be available. E.g. a user uses a wi-fi connection with a device that has geo-location turned on, and "Bob's your uncle".
It relies on the fact that the router web admin page is unsecured and someone hasn't changed the default password. I'm pretty certain this could also work on linksys:linksys or admin:password default login routers.
So if you don't want to be hacked, change your password.
That behavior can easily be toggled on/off in the Administration->Management section for your DD-WRT router. Take a look at "Info Site Password Protection" and "Info Site MAC Masking" on that page.
Most of the comcast cable modems I've had in the past years let you see the mac address if you navigate to 192.168.100.1 without any password, so xss that loaded that page would work.
His particular demo only works with a specific Verizon router, but the notional attack works against any wireless router that has any XSS flaw --- ie, any wireless router.
There are really just two simple ideas here (taking a couple simple ideas and plugging them together in some totally unexpected way being a Samy Kamkar trademark):
* Any website can usually use reflected XSS to interact with a browser's upstream wireless router, because wireless routers suck, and because they assume that the "inside" network is safe.
* There are databases that translate wireless MAC into location (like Skyhook).
My Belkin router spews both of its MAC addresses onto the screen to anybody who hits the admin website, before authentication.
Getting to my router with an attack is a little less trivial since it is no longer on 192.168.1.1. Also I'm not sure if there's an XSS attack that an unauthenticated user can fire, as any attempt to do anything is just giving me a login box which itself doesn't have an XSS. But this is my 90 second security analysis, if I tried harder I'm sure there's something nasty somewhere.
