Wardriving and Wireless Network Databases: What Your SSID Discloses

Wardriving is collecting wireless network observations while moving — network name, hardware identifier, encryption type and location. Aggregated into public databases over two decades, the result is a searchable map of hundreds of millions of wireless networks worldwide, including almost certainly yours.

What gets collected, and why it is passive

Access points broadcast beacon frames continuously so clients can find them. Those beacons contain the network name, the radio's hardware identifier, the supported rates and the security configuration — all in the clear, by necessity, before any association occurs.

A device listening while its location is recorded builds a database entry per network. Nothing is connected to and nothing is attacked, which makes this passive reconnaissance: the collector never transmits to the target. That classification matters on the exam, and it also means there is no way to detect that it happened.

Hiding the network name does not remove you from these databases. The identifier is still broadcast in other frame types, and clients probing for the hidden network disclose its name anyway — hiding the SSID is a usability cost with no security benefit, as noted under SSID and BSSID.

Geolocation, and why your router is in a database

The same technique underpins how phones locate themselves indoors. Observing which wireless networks are nearby and looking them up in a database of known positions gives a location fix faster and more reliably than satellite positioning in a building.

Which means major platform operators maintain their own versions of this data, collected from ordinary user devices. It is not a niche activity by hobbyists; it is infrastructure.

The consequence for an organization is that the location of its wireless networks is public information, and the network names are the index into it.

What an attacker gets from it

Organization identification. A network named after the company maps that company's premises, including sites that do not appear on the website — warehouses, remote offices, a director's home office running a corporate access point.

Equipment identification. The hardware identifier's prefix identifies the manufacturer, and default network names frequently identify the model outright. Knowing the vendor and model narrows the search for applicable vulnerabilities and default credentials.

Security posture. The encryption type is recorded, so open networks and legacy configurations are visible without visiting.

Target selection before travelling. An attacker plans against a specific site knowing what is there, which access point models are in use, and where the boundaries fall.

All of it without approaching the building, which is the same asymmetry described under internet-wide scanning — someone else did the collection, and the attacker queries an index.

The client-side leak

The less obvious half, and the more interesting one. Devices remember networks they have joined and, historically, actively probe for them — broadcasting a list of every remembered network name wherever they go.

That list is a travel and affiliation history: a corporate network name, a hotel chain, an airport, a home network named after a family. An attacker listening in a public place learns which organizations a passer-by belongs to, and can stand up an access point matching a remembered name to attract that device automatically — the setup for the evil twin attacks.

Modern operating systems reduced this with passive scanning and randomized hardware identifiers during scanning, which also frustrates the tracking of individuals across locations. Randomization is not universal, and remembered-network lists still grow without limit unless someone prunes them.

What to change

Name networks neutrally. Do not use the company name, the address, the department, or the access point model. A generic name provides no less usability and considerably less information.

Do not rely on hiding. It does not work and it breaks client behaviour.

Configure the security that matters. WPA3 where clients support it, WPA2 with AES otherwise, and enterprise authentication rather than a shared passphrase — the design under guest and BYOD wireless.

Tell staff to remove networks they no longer use from their devices, and to disable automatic joining for open networks — a device that will automatically join any network named after a coffee shop is a device that will join an attacker's.

Watch for rogue access points advertising your network names, which is the wireless intrusion detection function most controllers include and most organizations leave unconfigured.

Defensively, searching these databases for your own organization's names is a five-minute exercise that regularly finds an access point somebody deployed without telling anyone — the Shadow IT problem with a radio attached.

Exam angles

Know wardriving as passive collection of wireless network information while in motion, recording SSID, BSSID, encryption type and location into public databases. Understand that beacons broadcast this before any association and that hiding the SSID does not prevent collection. Recognize network naming as an information disclosure decision, and client probe requests and remembered networks as a separate leak enabling tracking and evil twin attacks.