Wardriving: Complete Guide to Wi-Fi Mapping & Safety

The Day Google Accidentally Wardrove the Entire Planet

When Google engineers made a particular choice in 2010, it sparked investigations on three continents at once. As their Street View vans were driving miles and miles taking pictures of the roads all over the planet, they also gathered another piece of information: the names, MAC addresses, and locations of every single Wi-Fi network the vehicles passed through. Sometimes, the vehicles captured actual information that was being transmitted via these networks, including emails and passwords.

Google engineers called this “an accident,” while privacy organizations called it “a violation of privacy,” but security researchers called this something completely different: industrial wardriving.

However, the Street View incident is not the start of wardriving; it is the time when people started noticing it. The technique of wardriving had existed for more than a decade by that time, evolving from hacker activity to the research method and data collection technique.

There has never been a more critical time to understand wardriving, as the world of wireless communications continues to evolve. Wi-Fi 7 technology is being deployed. The 6 GHz spectrum is becoming available for use. Every new frequency, every new protocol, creates a further need to be concerned about what is being listened to and how that information could be used.

This guide covers all the essentials: history, tools, laws, threats, and countermeasures. No matter if you’re an infosec expert, just curious, or simply looking to make sure your personal wireless connections are safe, there’s something here for you.

What Wardriving Actually Is (And Isn’t)

Let’s begin with the definition, since it tends to confuse some people. The term “wardriving” refers to the act of traveling around in a vehicle, although people may walk, cycle, or even use drones for it while simultaneously looking for wireless access points with their Wi-Fi devices. It’s a combination of the phrase “war driving,” which comes from the 1983 film WarGames, and the verb “to drive.”

The main technique of wardriving is known as passive scanning. In order to advertise its availability to all devices nearby, each Wi-Fi access point sends out beacon frames, small packets that contain information such as SSID (the name of the network), BSSID (the MAC address of the access point), the frequency used by the access point, etc. Wardriving software listens to those beacons, timestamps them, adds the GPS location to it, and saves it into the database.

The equipment never becomes part of anything; it merely listens to what is already being screamed into the void. This is the technological reason why passive wardriving is not considered the same as hacking in most legal systems: you are receiving a public broadcast, not attempting to break in.

The misconception stems from the fact that wardriving is usually only the beginning of a process. Once you’ve mapped out all of the networks and their levels of security, you’ll know what targets to go after. However, the two processes are separate.

A Short History: From “WarGames” to WiGLE

The origin of wardriving comes from a movie. In the movie WarGames (1983), Matthew Broderick’s character makes the computer dial all the phone numbers in an area code until it gets a connection via a modem. Wardialing was a practice used by early hackers for identifying computers vulnerable to attacks. It made its way into the public awareness through the movie. Wardriving came about a decade later.

Peter Shipley was the person who invented the term “wardriving” sometime in the period of 2000 to 2001. With the help of a GPS unit and a wireless card, he went around the city of Berkeley, California, to automatically log access points along with their positions. He created some scripts that can read the GPS position data and plot the wireless networks on the map.

What Shipley found was quite shocking at that time. Only 15 percent of the wireless networks that he surveyed were protected with encryption. The rest were totally unprotected. In the same year, the Wireless Geographic Logging Engine (WiGLE) was introduced as a crowdsourced repository for storing information collected by wardrivers. To this day, it remains the primary data source for wireless network maps.

However, the years 2000 saw a proliferation of wardriving, with applications such as NetStumbler (for Windows) and Kismet (for Linux) becoming widely available. War Chalking, marking the presence of open wireless networks by drawing certain symbols on the ground after the fashion of hoboes in the 1930s, briefly caught the public attention.

But then the tide began to turn. The era of WEP encryption passed; there were WPA, WPA2, and finally WPA3. Networks became more difficult to crack. But wardriving did not go away; it simply moved from a popular pastime to a niche pursuit, carried out by security experts, red teams, and aficionados for the information itself.

How Wardriving Works: The Technical Foundation

In order to understand wardriving, one has to know what is being broadcast through the Wi-Fi network.

Beacon Frames: The Open Broadcast

Beacon frames are always broadcasted by Wi-Fi access points, whether you use them in your own house, your office, or even in your favorite café. It broadcasts these frames periodically (every 100 milliseconds), announcing the network’s presence. The frames include the following information:

SSID: Name of the network (for example, “HomeWiFi” or “Starbucks_Guest”)
BSSID: The MAC address of the radio card of the access point
Channel: Frequency band and channel
Capabilities of security: Which kinds of encryption and authentication methods are supported
Supported data rates: Technical parameters for communication

These frames are designed to not be encrypted. Even when you use the WPA3 encryption protocol, the beacon frames are broadcast in plain. It is not a vulnerability; it is how Wi-Fi works. You cannot connect to a network that you cannot find.

All that a radar tool does is put the WiFi card in monitor mode which is an operation mode wherein the card listens to all frames broadcasted over the air as opposed to listening for a particular network only. The tool logs all beacons it receives, attaches them to GPS coordinates and timestamps, and stores this information in a file/database.

What Gets Logged

A typical wardriving log entry includes:

Field	Description
SSID	Network name
BSSID	Access point MAC address
GPS coordinates	Latitude, longitude, altitude
Timestamp	When the observation was made
Signal strength	RSSI (Received Signal Strength Indicator)
Channel	2.4 GHz, 5 GHz, or 6 GHz band and channel number
Encryption type	Open, WEP, WPA, WPA2, WPA3, or enterprise
Vendor	Often inferred from the BSSID’s OUI (Organizationally Unique Identifier)

As time passes, this information is used to create an understanding of the wireless environment in terms of location, names, security, and evolution of the networks.

The Wardriving Toolkit: Hardware & Software

Wardriving can range from using an app on your mobile device to building your own rig with several different radios and antennae. Let’s examine our options.

Software

Kismet is the benchmark tool for wardriving on Linux. It is a wireless network detector, sniffer, and intrusion detection system that offers support for monitor mode, GPS integration, and multiple output formats. It is able to detect hidden SSIDs (networks without an advertised name) using probes and other network data. Kismet is the right choice for those who wish to engage in wardriving.

WiGLE WiFi Wardriving is an Android application that will turn your smartphone into a tool for wardriving. This application is capable of logging WiFi networks, geotagging them, and uploading to WiGLE.net network databases. WiGLE WiFi Wardriving is the easiest way to get started.

Airodump-ng (part of the Aircrack-ng suite) is a packet sniffer capable of scanning all channels and logging access points. An example command would be

bash
sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon

To focus on a specific band (e.g., 5 GHz):

bash
sudo airodump-ng --band a wlan0mon

Airodump-ng can be used for both targeted sniffing and long-range wardriving, even though it’s more often used for the former.

NetStumbler was the initial wardriving application for Windows, which is not used much anymore. Some current applications for Windows are WiFi Explorer (macOS) and inSSIDer.

Hardware

Wi-Fi Adapter: While it may be sufficient to use the Wi-Fi capabilities of laptops and smartphones for basic wardriving, you need a dedicated Wi-Fi adapter that supports monitor and packet injection modes. Examples of such adapters include Alfa AWUS036ACH and its alternatives with external antennas.

GPS Receiver: It gives location information. Kismet uses gpsd (GPS daemon) to mark observed access points and networks with geographical coordinates.

Antenna: While a unidirectional antenna may have a better reach in a certain direction, the omnidirectional one is much better for wardriving since it can capture signals from all directions.

Raspberry Pi kits: A good option for creating a portable wardriving device is a Raspberry Pi computer running Kali Linux with Wi-Fi adapters and a GPS module. There are also some people who build special kits on Raspberry Pi for cars using 3D printing.

War Chalking: The Lost Art of Wireless Graffiti

During the early 2000s, another related practice developed known as “war chalking.” War drivers would chalk certain symbols onto sidewalks, walls, and structures to signify the presence of wireless networks in the vicinity. These symbols took inspiration from the signs created by hobos in the 1930s, which was basically a visual language created to pass information about a place.

The basic symbols included:

Two semi-circles placed back-to-back: open node (not encrypted)
Circle: closed node (encrypted)
A circle with “W” inside: WEP-encrypted node

War chalking was one of the practices of the early Wi-Fi culture, which involved passing information among the enthusiast community and marking their territory. However, with the advent of security in networks and the rise of smartphone applications to give out the same information instantly, it died down.

Legal Environment: Passive Reception versus Active Access

One of the most frequent questions regarding wardriving is, “Is it legal?”

The issue may be complex, but the general rule is unambiguous across most countries: receiving publicly transmitted signals is perfectly legal. However, gaining access to a computer network without permission is illegal.

The Passive Side

The act of recording information such as SSID, BSSID, strength, and geographical location of the networks within your range is legally acceptable in many countries. You are not accessing the network but only listening to the network broadcast. Storing that data in a publicly available database such as WiGLE is also legally permissible.

This explains why there are apps available in the application stores that do wardriving, for example, WiGLE WiFi Wardriving.

The Active Side

When you take an action, crossing the legal line becomes a reality in the following scenarios:

Connecting illegally: It is considered illegal to access a computer system without proper authorization.
Capturing a handshake in order to break the password: This amounts to active interception of communication.
Deauthenticating a device by sending deauth frames: This amounts to interfering with a network you do not own.
Making use of MAC/SSID information to locate a particular individual: You commit a breach of his or her privacy.

In the United States, the two statutes include the Computer Fraud and Abuse Act (CFAA) and the Federal Wiretap Act. In fact, under the Wiretap Act, intentional interception of electronic communications subjects one to a fine of up to $250,000 and five years’ imprisonment.

The Google Street View Case

One of the best-known cases concerning the issue of wardriving has been related to Google’s Street View project. From 2007 until 2010, Google’s Street View cars have been gathering information on Wi-Fi networks, including payload data on those Wi-Fi networks that did not use encryption. While Google claimed this had been done accidentally, the investigation conducted by the FCC showed that the company had deliberately obtained the data and obstructed the investigation.

Google got fined $25,000 by the FCC, but the Justice Department has decided against filing charges. What this case has revealed is the important distinction between obtaining the data of network identification and actually intercepting communications.

The Importance of Wardriving: Security Considerations

If passive wardriving is not illegal and does not involve any penetration, why would anyone even bother? The answer is that the information gathered is an attack surface map.

Targeting Weak Networks

The wardriving database points the attacker directly to the targets.

Corporate Reconnaissance

Wardriving is a completely valid method for red teams and pentesters. Discovering all the wireless networks in the vicinity of the targeted building allows the discovery of:

Company-owned SSIDs (usually with internal naming conventions)
Guest wireless network (which will likely be less secured)
Employee wireless networks at home, if in the vicinity of the office
Neighboring networks that can be exploited through pivot attack

This information then becomes useful in mounting further attacks, such as the evil twin AP attack (wherein a fake AP mimics the real one to capture credentials) or PMKID attacks.

The Data Itself

This is despite the fact that even without connecting to any network, the data within a wardriving database is still very useful:

Geolocation companies leverage the WiGLE data to enhance their geolocation when GPS is not available.
It can be used by researchers to study things like wireless coverage, adoption of encryption, and the digital divide.
It could be used by marketers to know about the density and movement of devices.

Today, the WiGLE database has more than 350 million unique networks and billions of records.

Advanced Corner: Warkitting and Beyond

If you are an advanced reader, there is an even more complex attack where wardriving goes together with firmware exploits: the warkitting.

Defined in a paper from 2006, the work is the “drive-by subversion of wireless home routers through unauthorized access by mobile WiFi clients. ” Warkitting means that an attacker uses a car to drive through a city looking for routers with exploitable vulnerabilities (default credentials or outdated firmware versions) to infect their firmware with malicious software, which would serve as a backdoor.

The authors managed to prove that warkitting attacks were technically feasible using inexpensive equipment and that the amount of credentials that could be harvested using warkitting was larger than phishing. Nowadays, the workshopping is mostly a thing of the past because new-generation routers use much more secure defaults and automatic update features.

Wardriving in the Era of WPA3 and Wi-Fi 7

The wireless environment has been significantly transformed from what it was in the early 2000s. How does that impact wardriving?

WPA3 and Protected Management Frames

The current gold standard in Wi-Fi security is WPA3. This wireless security protocol features a Simultaneous Authentication of Equals (SAE), instead of PSK, that is not vulnerable to offline brute-force attacks. An attacker won’t be able to perform an offline attack on the captured handshake, as is possible with WPA2.

WPA3 protocol requires using Protected Management Frames (PMF) to prevent deauthentication attacks that are often used before launching evil twin attacks. The use of PMF means that an attacker will be unable to disconnect a client from an access point to make it join a rogue access point.

As a result, the discovered networks by a wardriver become more difficult to exploit. However, WPA3 does not affect the process of network discovery.

The 6 GHz Band

However, the introduction of Wi-Fi 6E and Wi-Fi 7 brings about the emergence of the 6 GHz frequency band. This offers several advantages to wardriving:

Greater number of channels to scan (and thus greater amount of data collected)
Less interference by legacy devices
Faster data rates, allowing for possible real-time upload of wardriving data

However, there are several obstacles as well. Most wardriving equipment does not currently support 6 GHz, and the radio wave propagation of 6 GHz is not similar to those of 2.4 GHz and 5 GHz.

AI and Automated Analysis

The next evolution in wardriving is AI analysis of wardriving data, through which machine learning algorithms can:

Determine patterns within network naming systems that identify organizational hierarchy
Identify potential vulnerabilities within a network based on firmware version, manufacturer, and configuration
Automatically classify types of networks as residential, corporate, IoT, and more
Identify anomalies such as rogue access points

With the development of AI and Wi-Fi 7 technologies, wardriving has evolved from an entirely manual process into an increasingly automated one.

Protecting Yourself: A Practical Defense Guide

As a network owner, be it at home or at a business, here is what you can do to protect yourself from wardriving reconnaissance and attacks.

1. Enable WPA3 (or WPA2 at the least).

This is the best method to go for. If you have the ability, set this up; otherwise, go for WPA2 with AES encryption. Stay away from WEP and TKIP.

2. Change Your Defaults

This is by far the best way you could defend against warkitting and any number of similar attacks. This can be done by changing the password to both the admin page and the wireless network from the default.

3. Turn On Protected Management Frames (PMF)

With PMF, deauthentication attacks are prevented. This is commonly employed when an attacker tries to get users to connect to an evil twin access point.

4. Install Firmware Updates on a Routine Basis

Firmware updates of a router fix bugs. If you can, make sure that firmware updates happen automatically, or set an alarm for yourself to perform them once in a while.

5. Have a Guest Network for IoT Devices

Internet of Things devices have become weak links in many networks. It is recommended to place them in a guest network, which would be password protected.

6. Do Not Count on Hidden SSIDs

An SSID being turned off does not protect the network at all. There is special software called Kismet that finds even hidden networks because it analyzes probe requests and other types of traffic.

7. Think about a Wireless Intrusion Detection System (WIDS)

The use of a WIDS helps businesses identify rogue access points and any suspicious scanning activity that may be related to wireless reconnaissance attempts. This is particularly important for businesses that have classified information.

8. Use a Virtual Private Network (VPN) while using public Wi-Fi

Using a virtual private network while on a public Wi-Fi connection will ensure your privacy since the encryption takes place end-to-end even if the public Wi-Fi itself is compromised.

The Future of Wardriving

Wardriving will not fade out anytime soon. Wardriving will transform into something new. There is growing feasibility of wardriving with the help of drones due to their decreasing cost and weight. Drone equipped with a Wi-Fi adapter and GPS can scan locations inaccessible by vehicle, such as rooftops and industries.

Collecting crowdsourced data becomes more popular every day. It is now incredibly easy to contribute to the global database using apps like WiGLE WiFi Wardriving. There are now 350 million networks in the database, and this number is growing every day.

There might be an increased pressure from authorities in terms of regulation. As the issues of privacy related to wireless tracking become more popular, the restrictions concerning the collecting or publishing of location information of networks might appear.

Another trend is integration of collected data with other reconnaissance sources. Wardriving is used together with other open-source intelligence data, such as satellite imagery or building permits.

Key Takeaways

Wardriving involves passively scanning wireless access points while traveling. SSID, BSSID, location, and encryption type information are collected.
This is often a legal activity unless one connects to the access point.
This information is useful not only to the researcher or hacker but also to the red team.
While WPA3 and PMF protect networks from exploitation, they do not prevent the scanning.
Self-protection is achieved through implementing up-to-date encryption standards, modifying default configurations, and upgrading the firmware.
It is becoming an increasingly sophisticated practice along with the development of Wi-Fi 7/6 GHz, AI technologies, and drones.

What Should Be Done Next?

If you are a network owner: Go to the settings of your router right now and enable WPA3 if it is supported by it, replace the default login password, and enable firmware updates automatically. That’s it; those three actions neutralize all the attack vectors mentioned.

If you are a security specialist: Evaluate how the data gained through wardriving can fit into your threat model. The red team should definitely use it during the reconnaissance process, and the blue team should be watching for any suspicious activity related to wireless scanning and rogue access points.

If you are a security enthusiast: Get yourself the WiGLE WiFi Wardriving application and go for a ride. Contribute to the database and discover what is around.

And if you are a user who cares about the safety of their private network, do not panic; everything will be fine, as long as you follow the basics like using WPA3, having a strong password, and making sure your devices get updated.

Conclusion

The practice of wardriving itself doesn’t constitute an enigma for hackers but an evident indication of your wireless network being open and broadcasted in its plain format to anyone who cares to listen. Beacon frames are public in nature, and therefore such information as SSIDs, router MAC addresses, and locations can be picked up by anyone. How does one respond to the situation? Configure WPA3 or WPA2-AES. Change default credentials. Use Protected Management Frames. Apply updates for the firmware of your routers. Create a separate guest network for your IoT devices. These measures will not make you invisible but will make you a more difficult target for attacks.

Wardriving, while being a legitimate method of conducting reconnaissance, makes security professionals aware of their networks being scanned and mapped out by others. In the future, such technologies as Wi-Fi 7, 6 GHz frequency, AI-driven analysis, and even drones will be used for wardriving. It is not going to make the practice any more secret, but the lesson remains secure on your wireless network. Don’t be afraid of wardriving. Be informed about it. Never scan the networks without owning them or having permission to do so.

It must be noted that all the information provided in this article is intended for educational and defensive purposes only. It is strictly forbidden to use any of these techniques on networks that do not belong to you and that you do not have written permission to attack. Unauthorized network access is illegal in most countries.

Explore Our Cybersecurity Category. And if you are reading it up to here, leave a sweet comment to motivate us to write blog everyday.