1 min read

New Malware Uses WiFi BSSID to Determine the Victim's Location

Silviu STAHIE

January 06, 2021

New Malware Uses WiFi BSSID to Determine the Victim's Location

A security researcher has identified a new malware sample that uses an interesting technique to determine the potential victim’s location, without using the various GeoIP API services.

Some hackers don’t want to draw attention to their activities in the countries they operate from, and they usually give their attacks features that let them determine the location of a target. It also allows them to target specific countries.

Threat actors use GeoIP API services for this task, but it turns out there are other ways to find out the location that don’t require access to those APIs. Security researcher Xavier Mertens found a malware sample that initially queries for the victim’s public IP address with the help of icanhazip.com.

On the second step, though, the malware uses another service, ‘api.mylnikov.org.’

“This free service provides geolocation data for WiFi MAC addresses or BSSID,” says Mertens. “This is also useful to detect the location of the victim. The malware submits the MAC address of the default gateway (in my VM environment) or the BSSID (the MAC address of the wireless access point).”

The API returns the latitude and longitude in the JSON data, which is more than enough to find the country and city of origin. Bad actors always update their malware with new features and functionalities that let them bypass security measures or add new capabilities.

This is only a sample, but there’s no reason to believe that it’s not already implemented in active pieces of malware.

tags


Author



Right now

Top posts

Ultimate Privacy Guide for Your Facebook Account

Ultimate Privacy Guide for Your Facebook Account

August 31, 2021

6 min read
7 Signs It’s Time to Use Parental Controls On Your Family’s Devices

7 Signs It’s Time to Use Parental Controls On Your Family’s Devices

August 27, 2021

2 min read
Your Netflix Account May Be on Sale on Darkweb. Protect It

Your Netflix Account May Be on Sale on Darkweb. Protect It

August 13, 2021

3 min read
E-mails claiming your computer was hacked and your privacy exposed - what you need to know (spoiler: you can relax - they’re bluffing)

E-mails claiming your computer was hacked and your privacy exposed - what you need to know (spoiler: you can relax - they’re bluffing)

July 29, 2021

5 min read
Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US

Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US

July 16, 2021

3 min read
How to protect yourself against cyberstalking

How to protect yourself against cyberstalking

July 06, 2021

2 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

New Malware Campaign Targets Linux and Web Apps to Install Crypto-Mining Software New Malware Campaign Targets Linux and Web Apps to Install Crypto-Mining Software
Silviu STAHIE

September 23, 2021

1 min read
What Is a VPN, How Does It Protect Me, and What Cool Perks Does it Offer? What Is a VPN, How Does It Protect Me, and What Cool Perks Does it Offer?
Filip TRUȚĂ

September 23, 2021

2 min read
Security Researcher Publishes Lock Screen Bypass for iOS 15 on Launch Day Security Researcher Publishes Lock Screen Bypass for iOS 15 on Launch Day
Silviu STAHIE

September 22, 2021

1 min read