BSSID: how your Wi-Fi router gives away where you live

Early in his project, a PhD student at the University of Maryland spent a month doing something slightly absurd. Erik Rye sent Apple more than a billion made-up BSSIDs, the hardware identifiers that every Wi-Fi network broadcasts, and asked Apple’s location service where each one was. Almost all of them were fiction. Just under three million turned out to be real. And for every hit, Apple helpfully returned the locations of up to 400 other networks nearby that nobody had asked about. By the end of that month Rye and his adviser, associate professor Dave Levin, had 488 million extra access points on a map.

Within a year they had more than two billion. The only large blank spaces left on their world map were almost all of China, the deserts of central Australia and Africa, and the deep Amazon. If you have a router at home, it could well have been on that map, whether or not you have ever owned an Apple device.

This piece explains how those maps get built and what the Maryland team managed to see with them. It then goes back about fifteen years, to a time when, on certain routers, the same identifier gave away the Wi-Fi password as well as the location. The last part is about your own router: what you can switch, and where those switches stop helping.

What a BSSID actually is

Your Wi-Fi network has two names. The one you know is the SSID, the label that shows up when your phone scans for networks: “BT-7XQ2”, “Virgin Media”, or whatever you renamed it to. You can change it any time. The other is the BSSID, typically the MAC address of the router’s radio: six pairs of hex characters fixed at the factory. This has nothing to do with Apple’s Mac: MAC stands for Media Access Control, and every device that joins a network has such an address, from your phone to your TV. The first three pairs identify the manufacturer, because those blocks are handed out by the IEEE, and the list is public. What your own phone’s MAC address gives away, and how a private Wi-Fi address helps, is covered in our piece on what a MAC address is.

Your router announces this identifier constantly, several times a second, so that devices can find it. Nobody needs to connect to receive it. A phone in the pocket of someone walking past picks it up just as easily as your laptop does. Encryption protects what travels over the network; it does nothing to hide who is transmitting.

That is fine from an engineering point of view. The privacy problem is that a home router’s BSSID usually never changes. In a sample of ten million access points the Maryland researchers checked daily, only 0.06 percent moved more than a kilometre over a month. Routers sit still. So their identifiers end up working a lot like a street address.

How Apple, Google and WiGLE map the world’s Wi-Fi

GPS is precise, but it drains batteries and needs a clear view of the sky. So phones also work out where they are from the Wi-Fi networks around them. Apple describes this openly on its Location Services support page: with Location Services on, your device periodically sends the geotagged locations of nearby Wi-Fi hotspots and cell towers to Apple, which uses them to build a crowdsourced database. Another iPhone standing in the same spot later, without a GPS fix, only has to look at which networks it can see.

Google runs its own system, fed in the same way by Android phones. Its help page says it uses “publicly broadcast” Wi-Fi access point data together with GPS, mobile network and sensor data. Street View cars used to log networks as well, until that went badly wrong. Between 2008 and 2010 the cars also captured content from unencrypted networks, including emails, passwords and photos. In April 2013 the Hamburg data protection commissioner fined Google 145,000 euros and called it one of the most serious data protection violations that had come to light so far.

The third big collection belongs to no company. WiGLE is a volunteer project that has been mapping wireless networks since 2001, using data its members gather with scanning apps while they drive or walk around. Its public statistics currently list a little over two billion Wi-Fi networks, contributed by around 744,000 registered users. Anyone with an account can type a BSSID into wigle.net and, if it has been logged, see it as a dot on a map.

The difference between Apple and Google is in the detail, and that is where Rye and Levin found their opening. Google’s geolocation API wants at least two BSSIDs, computes a position, and returns only that. It also needs an API key, which is how Google bills: at the time of the study, five dollars per thousand requests. Apple’s service accepted a single BSSID with no key and no account, and sent back up to 400 neighbours so the device could do the maths itself.

Two billion BSSIDs in a year

To map every Wi-Fi network on Earth you do not need to know which routers exist. You only need to know which identifier ranges have been assigned, and the IEEE publishes that. The researchers aimed their random guesses at those ranges, and every answer with up to 400 neighbours gave them fresh BSSIDs to ask about next.

Between November 2022 and November 2023 that produced locations for more than two billion access points. The paper, “Surveilling the Masses with Wi-Fi-Based Positioning Systems”, was presented at the IEEE Symposium on Security and Privacy in May 2024. Brian Krebs covered it on 21 May under a headline that stuck: your Wi-Fi router doubles as an Apple AirTag.

Where it got interesting was repetition. Query the same identifiers week after week, and you can see a router vanish, which usually means it was switched off or destroyed, or reappear somewhere else, which means it moved. After the August 2023 fire on Maui, many BSSIDs around Lahaina dropped out of Apple’s database within days, and the map of missing routers lined up closely with published damage maps. In Gaza, the number of locatable access points fell steadily after 7 October 2023. By the end of that month only 28 percent of the original set could still be found.

In Ukraine the team identified at least 3,722 Starlink terminals. Each one has its own Wi-Fi access point, so iPhones nearby with Location Services on report it to Apple. The data also showed where devices in contested regions came from. Levin told Krebs that this exposed residential addresses around the world, and that the team believed it could identify people who had joined Ukraine’s Foreign Legion.

When the router moves with you

For an individual, one passage of the paper matters more than the war zones. Many home routers move house with their owners. If someone knows your router’s BSSID, they can check every so often whether it is still at the old address or has turned up in a new town. The researchers spell out who this hurts: people who have fled an abusive partner or a stalker, whose router “simply being online can disclose their new location.” The paper leaves out details about the people they tracked for that reason.

Travel routers make it worse. GL.iNet sells pocket-sized routers for hotels, camper vans and boats, and the team located more than half a million of them. Among the ones that moved, the median distance covered in a month was 97 kilometres, against 4 kilometres for ordinary routers that moved at all. The researchers watched them shuttle between campsites and marinas, and travel with service members from home to a war zone.

Starlink was already on it. Since early 2023 it has been shipping updates that give its routers a random BSSID, rolled out region by region, and the number of Starlink devices the team could find dropped sharply. GL.iNet said it had no plans to do the same. Phones already behave well here: the researchers point out that recent iPhones and Android phones pick a random BSSID for every hotspot.

Apple made a change of its own after the disclosure. Since March 2024 its Location Services page has said that access point owners can opt out by adding “_nomap” to the network name. Apple told Krebs it had honoured the flag for some time but only documented it that year. According to the paper, Google and WiGLE have excluded such networks since at least 2016. Rye’s verdict was blunt: before, there was simply no way to keep your access point out of Apple’s database.

When the identifier gave away the key

So far this has been about location. On some routers, though, the broadcast identifiers gave away more. Shipping every unit with its own Wi-Fi key is good practice, but it means keeping track of millions of keys. Some manufacturers took a shortcut and derived the key from data the router already had: serial number, MAC address, default network name. The result was printed on the sticker and looked random. Anyone who knew the recipe did not need the sticker.

One of the early public cases hit the Thomson SpeedTouch and the BT Home Hub, at the time the most common broadband router in the UK. In April 2008 the research group GNUCITIZEN published work by security researcher Kevin Devine showing that the default network name and the default key came from the same source. Seeing the network name was enough to narrow the key down to between two and about 80 candidates. The group’s advice was the same then as it is now: change the default key.

Germany had its own version in 2011. Two students, Stefan Viehböck and Manuel Müller, took apart the firmware of Deutsche Telekom’s Speedport routers, made by Arcadyan, and found that the factory key was largely derived from visible identifiers. Around a hundred candidates were left, and on a Speedport W700V they were in within four minutes, according to the German tech site heise. On Vodafone’s EasyBox routers, also built by Arcadyan, the key was reportedly derived entirely from the MAC address. When they surveyed almost 14,000 access points in four German cities, between 17 and 25 percent still broadcast a default Speedport or EasyBox name.

The German router maker AVM told heise at the time that its own keys were “rolled”, meaning genuinely random. That is the whole difference. A factory key is safe if it was generated at random at the factory and cannot be derived from anything else. It stops being safe the moment it comes from data the router itself broadcasts to the street.

We are deliberately not describing the derivation methods here, and we are not naming tools. What matters is the model, not just the age. The publicly documented cases are the ones in the table below: Thomson SpeedTouch and the BT Home Hub, Deutsche Telekom Speedports built by Arcadyan such as the W700V, and Vodafone’s EasyBox routers. If one of these still runs the key from the sticker, outside access was at least theoretically possible. According to AVM, its Fritz!Box routers from the same period are not affected. The model name is on the label underneath your router.

The WPS PIN: eight digits, 11,000 guesses

The second weak spot in factory settings is WPS, Wi-Fi Protected Setup. It was meant to make pairing easy: press a button or type an eight-digit PIN instead of a long passphrase.

In late 2011 the same Stefan Viehböck reported a design flaw in the standard, and the US CERT Coordination Center published it on 27 December as VU#723755. A router tells a wrong guess whether the first half of the PIN was right, and the last digit is only a checksum. That turns 100 million possibilities into about 11,000 attempts, and many routers did nothing to slow repeated failures. A correct guess, CERT/CC wrote, can reveal the Wi-Fi password and allow changes to the router’s settings. There was no real fix, so the advice was to switch the PIN feature off.

In August 2013 Viehböck, by then at SEC Consult, showed that on Vodafone’s EasyBox 802 and older 803 units the WPS PIN itself could be calculated from the BSSID. That was nastier than the 2011 problem, because even people who had changed their Wi-Fi password were still exposed while WPS stayed on. Germany’s federal cyber security agency BSI rated it critical.

Two weeks later heise reported what the EasyBox flaws meant in practice. Around the city of Krefeld, a local IT company’s hotline was jammed for hours by a stream of calls. When the owner rang some of the numbers back, the subscribers had no idea. All of them were Vodafone customers with an EasyBox, and one had been hit with expensive international calls. Vodafone confirmed that vulnerable routers had been abused for the calls.

The third default is the admin password for the router’s own settings page. On many older devices it was identical across every unit and printed in the manual. What happens when logins like that are reachable from the internet is the Mirai story, which we told in our piece on public webcams, along with how to check port forwarding and UPnP on your router.

Is your router still affected?

Probably not in that form, but only your model can answer that for sure. Makers such as AVM say they generate their factory keys at random. In the UK, the product security regime that took effect on 29 April 2024 bans universal default passwords on consumer connectable devices. In Germany the Federal Court of Justice ruled in 2016 that a subscriber who kept a unique, factory-set 16-digit WPA2 key was not secondarily liable when it was cracked.

The real world is messier. Plenty of routers in basements, holiday lets and small offices have been running for ten years without an update and are no longer supported by anyone. If the sticker key was never changed and WPS was never touched, the weaknesses of that device may well be described in articles from 2011.

Taking your BSSID off the map with _nomap

Now for your own router. To keep your network out of Google’s and Apple’s databases, change its name so that it ends in “_nomap”. “Home” becomes “Home_nomap”. Google’s Maps help and Apple’s Location Services page describe the same rule. Nearby devices see the suffix and stop reporting the access point.

You change the name in your router’s settings page, which you usually reach by typing an address printed on the router or in its manual into a browser. Look for a section called Wi-Fi, Wireless or WLAN and the field for the network name (SSID). Menus vary by maker and firmware, so if you rent the router from your provider, their help pages or support line are the quickest route. Google suggests the same.

A few things worth knowing first:

• Everything drops off for a moment. Phones, TVs, printers and smart plugs look for the old name and need reconnecting with the new one. Allow half an hour.
• Hidden networks do not help. Apple says outright that the opt-out does not work for hidden networks, because other devices never see the name.
• Every network counts separately. If your router broadcasts several names, for instance a guest network or a separate 5 GHz band, each needs the suffix.
• WiGLE has its own rules. According to the Maryland paper it honours both “_nomap” and “_optout”. For entries already in its database, WiGLE asks you to email the BSSID and it will remove them.

Google itself points out that location providers operate independently. The suffix is a request that Google and Apple have promised to respect. Whether smaller services and data brokers do the same is unknown.

Getting past the factory settings

The second job is the security of the network itself. A short order of work:

1. Change the router admin password. This is the password for the settings page, not for the Wi-Fi. If it is still the one from the sticker or the manual, replace it with a long, unique one from your password manager.

2. Set your own Wi-Fi passphrase. On a recent router from a major brand the sticker key is probably random and long enough. On an older ISP router you cannot know that. A passphrase of 20 characters or more costs you some typing once. Use WPA3 if all your devices support it, otherwise WPA2.

3. Turn off the WPS PIN. That has been CERT/CC’s advice since 2011 and was the BSI’s advice in the EasyBox case. The manual will tell you whether your model keeps the push-button method separate. If you never use WPS, switch it off completely.

4. Check the firmware. Look at when the last update arrived and whether your model is still supported. Many manufacturers publish lists of products that no longer get updates. If yours is on it, a new router is the honest answer. If you rent it, ask your provider about a swap.

5. Review remote access and port forwarding. Anything reachable from outside should be there on purpose. Our webcam piece walks through the check.

What _nomap cannot do

The suffix works going forward. It stops your network from being reported again. Neither Apple nor Google says how quickly an existing entry disappears. The Maryland team saw Apple forget routers destroyed in the Maui fire after a few days. We know of no comparable measurement for renamed ones.

Your BSSID does not change either. Anyone who already has it, because they once visited, found it in an old dataset or stood outside your house, still has it. And the suffix is visible to every neighbour. Most people will not care, but it is worth knowing.

Your phone leaks location in other ways too: photo metadata, apps with location permission, your IP address. How much of that comes together at Google is covered in what Google knows about you. How precise an IP address really is, we tested in trace an IP address. And which apps hand your location to other people is the subject of our piece on location sharing.

The real fix sits with manufacturers. Rye and Levin recommend that routers pick a fresh random BSSID on every reboot or move, the way phone hotspots and now Starlink already do. On ordinary home routers that was still the exception at the time of the study. Until it changes, the suffix in your network name is the tool you control.

What stays

Your router stands still and broadcasts its identifier into the street day and night. Every phone that passes can write it down, and the big platforms have done so billions of times without asking you. On some ISP routers around 2011, that same identifier was enough to open the network as well.

The old holes are mostly closed. The databases are still there. With “_nomap” in the name, your own passphrase, WPS switched off and current firmware, you have done in one evening about as much as anyone without a networking degree can do to a router. The rest is up to the people who make them.

---

Sources: Erik Rye, Dave Levin, Surveilling the Masses with Wi-Fi-Based Positioning Systems (PDF), IEEE Symposium on Security and Privacy 2024 · Krebs on Security, Why Your Wi-Fi Router Doubles as an Apple AirTag, 21 May 2024 · Apple Support, About privacy and Location Services in iOS, iPadOS and watchOS · Google Maps Help, Access points and Google location services · WiGLE, statistics and contact · Hamburg Commissioner for Data Protection, Fine imposed upon Google (PDF), 22 April 2013 · GNUCITIZEN, Default Key Algorithm in Thomson and BT Home Hub Routers, 14 April 2008 · heise online, Vorkonfigurierte WPA-Schlüssel bei T-Online und Vodafone leicht erratbar (German), 20 August 2011 · heise online, Voreingestellte WPA-Passphrase bei EasyBox-Routern berechenbar (German), 16 March 2012 · CERT/CC, VU#723755: WiFi Protected Setup (WPS) PIN brute force vulnerability, 27 December 2011 · heise online, BSI warnt vor WPS-Schwachstelle in Vodafone-Routern (German), 6 August 2013 · heise online, Router-Schwachstelle für Telefonterror missbraucht (German), 21 August 2013 · LTO, BGH: WLAN-Verschlüsselung nach Werkseinstellung genügt (German), 24 November 2016 · GOV.UK, The UK Product Security and Telecommunications Infrastructure (Product Security) regime

Frequently asked questions

What is a BSSID?

The BSSID is the hardware identifier a Wi-Fi network broadcasts, usually the MAC address of the router’s radio. It looks like six pairs of characters, for example 00:11:22:AA:BB:CC. Unlike the network name (SSID), which you can change whenever you like, the BSSID of most home routers stays the same for the life of the device. Anything within radio range can pick it up without joining the network.

Can someone find my location from my BSSID?

If your router’s BSSID is in a Wi-Fi positioning database, yes. Apple and Google collect the positions of access points through their users’ phones. In 2024 researchers at the University of Maryland showed that Apple’s database could be queried from outside, and used it to locate more than two billion access points worldwide. To look up your router, though, someone first needs its BSSID, which a stranger usually only gets by being within range or from another data source.

What does _nomap in a Wi-Fi name do?

If your network name ends in “_nomap”, Google and Apple say they will not add the access point to their location databases. “Home” becomes “Home_nomap”. Apple’s support page notes that this does not work for hidden networks, because other devices cannot see the name. The volunteer database WiGLE also honours “_optout” and removes entries on request by email.

Does changing my Wi-Fi name change the BSSID?

No. The name is a setting, the BSSID belongs to the hardware. That is why _nomap works through the name: collecting devices see the suffix and skip the access point. Some makers now randomise the BSSID, Starlink among them since 2023, and many phones have done it in hotspot mode for a while. On ordinary home routers it was still rare at the time of the Maryland study.

Is the Wi-Fi password on my router’s sticker safe?

On current routers from major brands it usually is, provided the key was generated at random and is long enough. Problems came from older ISP routers whose factory key could be worked out from the identifiers the router broadcasts, including BT Home Hub and Thomson SpeedTouch units around 2008 and German Speedport and EasyBox models around 2011. Setting your own long passphrase costs you a minute.

Should I turn off WPS on my router?

Turn off the PIN method if you do not use it. In 2011 the US coordination centre CERT/CC described a design flaw that cuts the number of guesses needed to about 11,000 and recommended disabling the feature. Whether your model lets you keep the push-button method separately is something the manufacturer’s manual will tell you.