Home Business IT Security Google Maps - we know what you're looking at

SSL traffic analysis is good enough to see exactly what location you're looking at on Google Maps.

As we all know, communication between Google Maps and any client is protected via SSL (secure socket layer) aka the browser padlock.  This means that the content of all communication via this session is completely hidden from view.

Well not entirely.  It's actually not immune to all kinds of cunning attacks. 

Today at Ruxcon (the computer security conference), Vincent Berg of scurity company IOactive demonstrated how so-called side-channel analysis can reveal far more than was intended.

What Berg found was that even though encrypted, the 256x256 pixel subsections used to build the map image on the client browser do not radically change their size compared to their un-encrypted cousins.  This meant that he was able to create a image-size map of potential locations and by capturing the data stream between Google and the user could identify the images and use nothing more than their size to re-create the map being viewed.

Currently Berg has built this as a simple proof-of-concept and has only pre-analysed a small number of European cities.  However there is no reason why this couldn't be extrapolated to the entire world at all resolutions, given enough disk storage and processing power.

It would probably be wise to assume every major government has already done this.

The author is attending Ruxcon as a guest of the organisers.


Did you know: Key business communication services may not work on the NBN?

Would your office survive without a phone, fax or email?

Avoid disruption and despair for your business.

Learn the NBN tricks and traps with your FREE 10-page NBN Business Survival Guide

The NBN Business Survival Guide answers your key questions:

· When can I get NBN?
· Will my business phones work?
· Will fax & EFTPOS be affected?
· How much will NBN cost?
· When should I start preparing?


David Heath

joomla statistics

David Heath has over 25 years experience in the IT industry, specializing particularly in customer support, security and computer networking. Heath has worked previously as head of IT for The Television Shopping Network, as the network and desktop manager for Armstrong Jones (a major funds management organization) and has consulted into various Australian federal government agencies (including the Department of Immigration and the Australian Bureau of Criminal Intelligence). He has also served on various state, national and international committees for Novell Users International; he was also the organising chairman for the 1994 Novell Users' Conference in Brisbane. Heath is currently employed as an Instructional Designer, building technical training courses for industrial process control systems.






Join the iTWire Community and be part of the latest news, invites to exclusive events, whitepapers and educational materials and oppertunities.
Why do I want to receive this daily update?
  • The latest features from iTWire
  • Free whitepaper downloads
  • Industry opportunities