Security musings

I needed to set up a new printer recently, so I hooked it up over USB and ran the setup program.  Everything went as expected, the printer was located and the driver installed.  So far, so normal.  I also wanted to set it up to be accessed over my home wireless network. so I ran the wireless configuration and this is where the oddness began.

I was presented with a list of networks that were reachable by the printer.  I saw my network, selected it, entered the passphrase and finished the configuration.  Once I unhooked the USB cable and restarted the printer I was able to reach it over the wireless connection.

Something had caught my eye during the process, so I went back over it and paid more attention to the information presented.  Below you can see a screen grab of the information.  Things like SSID, signal strength, security, mode, channel and BSSID are all generally available so there's no issue there.  The fact that I could see my neighbours networks is also no surprise - radio signals travel, that's what they are supposed to do.

The interesting bits are that it correctly identified my location (down to the road name level) and my GPS co-ordinates as well as my neighbours co-ordinates.  It took me a while to work out what it was that bugged me about this, but then I realised that of course I hadn't told my printer anything about GPS, so where was it getting this information from?  And why does it need it?  Apart from anything else, wireless technology is such that the GPS co-ordinates are only going to vary by a tiny amount (10s of meters) for any devices that you can get signal for - so almost by definition, any devices you can see are going to have very similar GPS co-ordinates, and probably won't be accurate enough to determine anything other than "these are nearby" . . . which you already knew since you could pick up their radio.  If they weren't nearby then they wouldn't be on the list in the first place.

It's most likely that the printer and/or the setup program is using information gathered by Google, relating to one of their location services.  The location could have been divulged (or exposed, depending on your degree of concern) when an Android phone with GPS enabled connected to my network.  Google knows where the phone is, so it now also knows where the network that the phone is connected to is.  Alternatively, Google may have fixed the location of the network when they "accidentally" gathered information while passing my house taking images for Street View.  The BSSID field provided by the network is unique, so it can be used to identify the network even if I change my SSID from the default that came configured on the device.

The mildly surprising thing in this is that the printer manufacturer has access to the Google location information.  It's pretty certain that they don't need the information for the purposes it is used for in this case.

Have you come across GPS information like this in other places you didn't expect it?