Wi-Fi MAC addresses: Google's long-term memory

Android map interrogates Google's WLAN MAC database - here, it shows where a WLAN router used by The H's colleagues in Germany is located

For some time now, Google has been collecting information about stationary Wi-Fi base stations, not only from Streetview vehicles, but also from Android smartphones. This makes it possible for phones to determine their approximate locations even when GPS is switched off; to this end, Google not only stores the network's name (SSID), which can easily be changed, but also the Wi-Fi base station's constant and globally unique MAC address.

It turns out, however, that stationary Wi-Fi base stations are not the only things in the database: notebooks and smartphones show up there as well. This finding is not surprising for devices with active tethering, since they essentially act as a Wi-Fi router by offering their internet connection as a mobile hotspot; Google would have a hard time distinguishing them from stationary bases.

But it now appears that devices that have never been used as a base station also appear in the database. Otherwise, CNet concludes based on a sample survey, the high number of mobile devices in the database (10 per cent) cannot be explained. Google says that it removes mobile devices from the database when they are discovered. At Skyhook Wireless, which has also been running a similar Wi-Fi location database since 2005, the mobile ratio is only five per cent.

The problem with this is that tools such as AndroidMap can be used to track devices based on their Wi-Fi MAC address and produce a rough history of movement. It is unclear how old the location information is and how often it is updated: a mobile device located in San Francisco appeared, according to the sample, to be in Berlin. The process therefore does not seem to be particularly reliable. According to CNet, Android devices change their MAC address every time tethering is enabled; however The H's colleagues at heise Security were not able to reproduce this effect – a Milestone running Android 2.2.1 always used its original MAC address for its Wi-Fi interface.

(ehe)