Covered in full in Network Discovery Each wireless device maintains a "memory" of what networks it has successfully connected to. When it is connecting to a network, it sends out "probes" to all of the networks it has in this memory. It is important to note that this data gets broadcast widely, and can be collected without any network access, only proximity to the device. These network probes can often contain names (especially from mobile phone tethers), organizational affiliations, device manufacturers, and a mixture of other potentially valuable data (home network names, recent airports/travel locations, cafés and conference networks). If there are many networks in the office's vicinity, this activity can also help identify the specific office network (if there is any doubt). In many cases, an organization may not want the name of their wireless network to be associated with to their organization, but it may be revealed by this additional meta-data. Beacons can "de-anonymize" an obfuscated network name as well as provide rich content for social engineering attacks. This provides an only-lightly-invasive introduction to discuss the trackability of devices, particularly mobiles and laptops. Scan for wireless networks nearby, identify (and confirm) the office network(s). Monitor traffic of that network and capture potentially sensitive metadata (wireless security settings, beacons, and MAC addresses). Research likely device hardware using MAC addresses. Do the staff devices leak sensitive metadata? What can be determined about the organization based on broadcast wireless data? Page 68 of 240