k074m4n
◂ BACK TO ARCHIVE

2026.09.15DECRYPTED

Wardriving: what war?

  • WARDRIVING
  • WIFI
  • OSINT
  • PRIVACY

Your router is shouting. Every hundred milliseconds or so it broadcasts a beacon frame carrying its name, its MAC address and the encryption it expects, to anyone in range who cares to listen. It does this when nobody is connected. It does this when you are asleep. That is not a bug, it is the only way a phone can find a network it has never seen.

Wardriving is driving around with something that listens and writing down what it hears. A laptop or a phone, a GPS fix, one row per access point. No connecting, no cracking, no touching anything. Just a receiver in a car and a record of what was already in the air.

I got into it recently and it is more fun than it has any right to be. It is also the rare security hobby where collecting the data is the easy half. The argument about what the map means comes after and that is the half worth writing down.

The war is a movie reference

The name is borrowed twice over. Wardialing came first: point a modem at every number in a range and note which ones answer with a carrier tone instead of a voice. Wikipedia traces the popularity of the technique to the character Matthew Broderick plays in WarGames, the 1983 film where a teenager dials his way across Sunnyvale looking for a game company and finds NORAD instead.

Pete Shipley moved the idea to radio. He drove the Bay Area with a GPS receiver and an antenna on the car, scripted the two together so the logging happened automatically and presented 802.11b War Driving and LAN Jacking at DEF CON 9 in July 2001.

So the war is a film reference wearing a second film reference. Nobody declared anything. The word stuck because it sounded good in 2001 and it has been making a legal hobby sound like a felony ever since. The honest comparison is birdwatching. You go out, you write down what you saw and where, you compare lists with people who did the same thing somewhere else.

That sounds like a joke at the expense of the name. It is also the entire legal and ethical argument.

Millions of dots on a map

Those lists have a home. WiGLE, the Wireless Geographic Logging Engine, took its first uploaded hotspot in September 2001, the same year as Shipley’s talk and has been accepting them ever since.

I pulled the live numbers while writing this. WiGLE holds 2,050,636,595 unique WiFi networks, seen 27.5 billion times, alongside 5.8 billion Bluetooth devices. Two billion routers, each one found by somebody who drove or walked past it with a logger running.

The encryption breakdown is the part I keep going back to. Of those two billion networks, 38,563,928 are open with no encryption at all, which is under two percent. 51,102,839 still speak WEP, a cipher that has been known-broken since 2001. 102,193,598 have moved to WPA3. And 20,232,621 are still running the SSID their router shipped with.

Hold that against the earliest numbers we have. In December 2004 a class of a hundred undergraduates spent several weeks mapping Seattle and logged 5,225 access points: 44 percent on WEP, 52 percent wide open, 3 percent pay-for-access. Half a city, unencrypted.

The two samples are not comparable in any strict sense. One is a few weeks in one American city, the other is a cumulative global pile with twenty years of duplicates, uneven coverage and a heavy bias toward wherever wardrivers happen to live. But the direction is real and the reason is boring: routers started shipping with WPA2 on and a random password printed on the sticker. Nobody was convinced of anything. The default changed. That did more for WiFi security than every awareness slide ever written.

The rest of the data is texture. The most-seen network name on earth is xfinitywifi at 27.9 million observations. iPhone shows up 4.9 million times, which is a lot of people leaving a hotspot on in a pocket. eduroam shows up 3.7 million times because students travel.

None of this is a solitary hobby, either. RF Hackers Sanctuary runs a World Wide War Drive alongside DEF CON, where the scoring runs through WiGLE and people compete on coverage.

Listening is not breaking in

WiGLE’s own Cardinal Rules Of Wardriving opens with the definition and never softens it: “Wardriving is mapping wireless networks (gps+wifi). It’s not connecting or hacking.” A few lines down it handles the obvious temptation just as bluntly: “Don’t use other people’s networks. That’s not Wardriving it’s Piggybacking!”

I think that line holds and not as a technicality. A beacon frame is unsolicited and unaddressed. Your router sends it to everyone, forever, by design, in the same way a shop puts its name on the sign above the door. Reading the sign is not entering the shop. If the mere act of receiving a broadcast that was aimed at you along with everyone else counted as intrusion, every radio would be contraband.

And mapping does something I care about. Radio is invisible and people reason terribly about things they cannot see. A map turns “there is probably WiFi around here” into a count, a coordinate and an encryption column. That is the version you can show somebody. WiGLE says outright that the point is to create awareness of the need for security by making the encryption status public and the numbers above are that argument working.

The obvious objection is that I spent a whole post attacking license plate readers on exactly this ground: one read is trivial, six months of reads is a pattern of life, the harm is aggregation. Why is a map of two billion routers any different?

Because of what sits at the other end of the identifier. A plate is attached to a car and a car is attached to a person who drives it somewhere. Stack the reads and you get a route, a schedule, a set of places someone chose to be. An access point is screwed to a wall. Its coordinate is the building’s coordinate and it will be the same coordinate next year. The log has no occupant in it, no arrival time, no direction of travel. Flock answers “where has this person been.” WiGLE answers “what radio is at this address.” Those are not the same question and no amount of stacking turns the second into the first.

There are two places where that stops being true and both are worth naming. SSIDs are written by people so a network name can carry a surname, a flat number or a company. And not every access point is furniture. A phone hotspot, a travel router or a Starlink terminal moves with its owner and an identifier that moves is a movement history. That is the narrow case and it is the one somebody has already built a tracking system on top of, which is section five. None of that is a reason to panic and all of it is a reason to pay attention to what you name, what your devices announce while you are not thinking about them and what you carry from place to place with a radio inside it.

Worth noticing who built it, though. That system was not made by hobbyists with antennas on their cars. It was assembled quietly from handsets and the researchers who broke it never left the house.

The kit and the rules

The cheapest entry is the phone in your pocket. WiGLE’s Android app uses the phone’s own radio and GPS, logs as you move and uploads when you are done. No car modifications, no purchases and it is the honest way to find out whether you like this before spending money.

Past that, the standard rig is Kismet on a laptop or a Raspberry Pi with an adapter that does monitor mode and a GPS dongle. Kismet ships a wardrive mode built for exactly this:

kismet -t some_wardrive --override wardrive

Read what that override actually does. Per the documentation it “turns off most logging and data retention, disables processing most packets as much as possible, and configures the radios for optimized AP detection.” Specifically it will not track non-access-point devices, does not log data packets, does not retain handshakes and switches logging to WiGLE CSV.

Someone drew an ethical line and shipped it as a config file.

Two practical notes that matter more than which adapter you buy. The GPS needs to see sky so it goes on the dash or the roof and not in the footwell and you want a lock before you start moving rather than after. And WiGLE’s rules put the sweet spot at 35 to 45 mph. Slower wastes your evening, faster and you punch through a beacon interval without hearing anything.

Now the rules, in rough order of how much trouble ignoring them will cause you.

Do not connect. Ever. Not to the open one, not to check if it works, not for a second. Everything protecting you legally depends on the distinction between receiving a broadcast and initiating a session and there is precedent sitting right on that line. In State v. Allen the Kansas Supreme Court looked at a teenager who had wardialed his way into finding Southwestern Bell’s modems, never got past a login prompt and ruled in 1996 that contacting or approaching a system is not “access” under the statute. The gap between approaching and accessing is where this entire hobby lives.

Do not capture payload. This is the one that ended badly for a company with real lawyers. Between 2008 and 2010 Google’s Street View cars logged beacon data and also hoovered up the actual contents of traffic on open networks: emails, passwords, documents. The Ninth Circuit put the haul at around three billion frames of raw wireless data, of which roughly 300 million carried payload. Google paid $7 million to 38 states and the District of Columbia in March 2013, agreed to destroy the data and later settled a class action for $13 million. It argued in court that an unencrypted network is like an FM broadcast and therefore exempt from the Wiretap Act. That argument did not survive the appeal. Beacons are the sign on the door, payload is the conversation inside and an open window does not make the second one yours to record.

Know that the log is personal data where you live. A MAC address on its own is a number. A MAC address with a timestamp and a coordinate is, under GDPR, capable of identifying a person, which is the Dutch DPA’s stated position on WiFi tracking. Publishing a hobby map is not the same as running a tracking business but “it is just a MAC address” is not the defence people assume it is.

Somebody turned it into a territory war

The DEF CON drive is one weekend a year. WDGWars, short for Watch Dogs Go Wars, is a Polish project that runs the same instinct continuously and keeps score. It ingests the WigleWifi CSV that Kismet already writes, which means the rig from the previous section is also a controller.

One rule does most of the work: “Every Access Point on the map belongs to the team that last scanned it.” Your team holds a router until somebody else drives past it. There is no remote capture and no way to click your way into territory. To take a street you have to stand on it. That is the most honest piece of game design I have run into in a long time.

Repeated scans harden an access point so a team that keeps covering its own neighbourhood makes it progressively more expensive to flip while a single rescan rebuilds the defence. Coloured zones grow and shrink on a live map and captures are logged as events so you can watch a city change hands. The project does not hedge about what it is: “This is not a passive WiFi tracker. This is a war game for control over digital territory.”

The gear list reads like the previous section with a budget attached. An ESP32 running projectZero firmware does the scanning, a ClockworkPi uConsole runs the game and a Flipper Zero or a LILYGO smartwatch feeds in extras. There is a fork of Bruce firmware that uploads straight from a Cardputer or an M5Stick with no computer involved, plus an open REST API and a documented CSV endpoint so anything emitting WiGLE format can play. The map carries ADS-B aircraft and LoRa mesh nodes as well, which makes it a general RF scoreboard rather than a WiFi one.

The detail that won me over is unglamorous. Scoring has a one hour cooldown per access point per user and duplicate observations are merged by strongest signal with averaged GPS. That is a data quality rule wearing a game rule’s clothes. Somebody sat down and thought about what happens when you pay people to rescan the same router forever, which is more than most crowdsourced datasets manage.

So you have a map. Now what?

“I logged some routers” is not a conclusion. The question is what the file is for and the honest answer starts with what it is worth to somebody else.

Your phone gets a location fix in a basement with no GPS by listening for nearby access points and asking a WiFi Positioning System which BSSIDs it knows and where they are. Apple and Google both run one. Those databases are built from exactly the data wardrivers collect, just gathered at the scale of every handset on earth reporting back.

Which means the map is a lookup table from a router’s MAC address to a point on the planet. Point that backwards and you have a tracking system.

That is not hypothetical. In Surveilling the Masses with Wi-Fi-Based Positioning Systems, presented at IEEE Security and Privacy in 2024, Erik Rye and Dave Levin showed that Apple’s WPS API would answer queries for BSSIDs you had never seen and that allocated MAC space is dense enough to guess through. No driving required. Over a year they geolocated more than two billion access points worldwide from a desk. Then, they did the part that matters: they followed devices over time. Travel routers moving in and out of Ukraine and Gaza. Population movement after the Maui fires. Individual people, tracked by the hotspot in their bag. Apple and some access point vendors have since shipped mitigations, including BSSID randomization.

A follow-up paper, Buy it Now, Track Me Later, is funnier still. The researchers scraped eBay listings for used access points, read the BSSID off the sticker in the seller’s own photographs using computer vision and then looked those identifiers up in a WPS database to place the device before and after the sale. Somebody sold a router and shipped a beacon that still pointed at their old address.

So the first answer to “now what” is: understand that the thing you collected by hand is being collected at planetary scale by people who do not publish their methods and that its natural use is finding where a specific device sleeps at night. Knowing this changes what you do with your own file.

The defensive use is the boring one that pays rent. Drive your own perimeter. Every organisation has access points nobody in IT knows about: a lab router someone plugged in, a printer running an open ad-hoc network, a contractor’s travel hotspot, a rogue AP broadcasting your corporate SSID from the coffee shop next door. You cannot find any of that from a dashboard because the dashboard only knows about equipment you own. A walk around the building with Kismet does not care who owns the radio.

Then, there is the WEP number. Fifty one million networks in one public database are still running a cipher that has been broken for twenty five years and twenty million are broadcasting a default SSID that names the router model for anyone deciding which exploit to try. A map is what turns that from a claim into a list of coordinates, which is exactly what WiGLE set out to do.

And the one that got me into this: SSIDs are written by people. A city’s network names are apartment numbers, surnames, jokes, band names, complaints about neighbours and the occasional threat. Nobody thinks of a router name as publishing. It is public, permanent and it travels with the hardware.

Why I keep driving

There is no war and there is no target. There is a city broadcasting a couple of hundred thousand names into the street, continuously, to nobody in particular and a receiver costs nothing.

What I like about it is how little it asks of you and how much it changes. You drive a route you have driven a thousand times and it comes back annotated. The invisible layer resolves. After that you cannot go back to thinking of radio as empty space and a lot of standard WiFi security advice starts sounding like it was written for a threat model nobody had bothered to look at.

The part I would not hand-wave is the mobile one. Most of what you log is masonry but some of it walks around with its owner and that is the sliver where a map of radios turns into a map of people. It is also the part hobbyists have the least to do with. The two billion lookups in that paper came out of a corporate positioning database, not out of WiGLE and the open map at least publishes what it holds and lets you pull your own network out of it.

So: listen, log, publish, do not connect, do not touch payload. Read your own city. It is talking constantly and almost nobody is writing it down.

Sources