Someone from the annual Black Hat Technical Security Conference has discovered an exploit that unveils the MAC address of someone's home router and have thought of a potential way of using it to find out someone's address via a carefully tailored webpage.

It's an interesting idea minus the privacy concerns...

Every networking device e.g. your wireless router and phone has a unique Media Access Control (MAC) address that identifies it. Usually this can be found printed underneath the device and this MAC address is broadcast together with the signals that the device sends out. There's not much you can do hide it although there are ways to "spoof" (i.e. change it to something fake).

As you may know, recently Google has been caught up in a fiasco about how they have been gathering unencrypted wireless data around the world including SSIDs and MACs while recording for their Street View service.

As wireless routers aren't moved between locations very much, the MAC addresses can easily be recorded together with where they're found which would most likely be your home.

In other words, it's like having another line tacked to your home address and having public access to it via this exploit. You can imagine the risks this could have via social networking sites such as Facebook - A simple click on one of the ads or games could reveal who you are and your address.

All those jokes about "stalking" someone with these services could really come true ^^;

In case you're wondering, this kind of tracking has already been in use for a while and the exploit takes advantage of it. If you use GPS on a modern phone the chances are you'll find an option to let people know where you are and this technology is also known as "Geolocation". Some camera phones even tag photos with location data using this feature if you enable the option.

I think it's only recently that browsers such as IE, Firefox, Safari and Opera have passively implemented this to allow websites to better understand where their visitors are coming from and what content they should be directed to.

By default, it's turned on in Firefox and there's nothing in the options to turn it off unless you access this "hidden" configuration page.

The chances of someone coming across this exploit is probably similar to being robbed so I don't think there's a need to be paranoid but as a software developer, I think it's important to ensure exploits such as this are minimised.