利用 MAC address 抓出網路攝影機 (AirBnB 事件後續的反制)

之前 AirBnB 的屋主在屋內安裝攝影機而打官司的事情繼續被討論:「Beware, houseguests: Cheap home surveillance cameras are everywhere now」。有人提出自救方法,作者使用 DropCam 與 Withings 的 MAC Address Prefix 抓出網路攝影機:「Detect and disconnect WiFi cameras in that AirBnB you’re staying in」。

由於 MAC address 不需要知道 WPA passphase,所以可以直接掃出來。作者提供的程式需要使用 airmon-ng 來掃無線網路。

另外作者有點出這個方法可以打掛透過無線網路的裝置 (像是 WiFi jammer),用在安全機制上 (也就是這些產品本來的設計) 未必有效,還是建議用有線網路接:

For the record, I’m well aware DropCam and Withings are also sold as baby monitors and home security products. The very fact this code exists should challenge you to reconsider the non-sane choice to rely on anything wireless for home security. More so, WiFi jammers - while illegal - are cheap. If you care, use cable.

另外要注意的是,在美國地區使用這樣的技術可能是違法的,使用時請自己負責:

It may be illegal to use this script in the US. Due to changes in FCC regulation in 2015, it appears intentionally de-authing WiFi clients, even in your own home, is now classed as ‘jamming’. Up until recently, jamming was defined as the indiscriminate addition of noise to signal - still the global technical definition. It’s worth noting here that all wireless routers necessarily ship with the ability to de-auth, as part of the 802.11 specification.