I Went Wardriving Nearly 25 Years Ago. Here’s What I Found.
Sometime in late 2001 or 2002, I suction-cupped an antenna to the roof of my car and went for a drive.
Inside was an IBM ThinkPad running NetStumbler and a PCMCIA Wi-Fi card. A cable ran from the wireless card to the external antenna on the roof, while a Garmin GPS sat on the dashboard.
I wasn’t trying to connect to anyone’s wireless network. I wanted to see what was already being broadcast into the air around me.
Wi-Fi was still relatively new, and I was curious about how securely people were deploying it. So I drove around my neighborhood and the surrounding area in Pennsylvania, collecting information about the wireless access points I encountered and correlating those observations with GPS coordinates.
I eventually mapped the results using Microsoft Streets and published the research as a few web pages on my personal website at the time.
Then, for the most part, I forgot about it.
Nearly 25 years later, I found the files again.
And they provide a fascinating snapshot of what Wi-Fi security looked like in its early years.
Wardriving Before It Was Commonplace
Today, detecting nearby Wi-Fi networks seems almost mundane. Our phones, laptops, watches and countless other devices continuously interact with wireless technologies.
In the early 2000s, doing this deliberately required a little more effort.
NetStumbler detected the nearby wireless networks, the GPS recorded where my car was when each one was detected, and Microsoft Streets, a desktop mapping program that worked much like Google Maps does today, let me plot the results.
My resulting dataset included the network name, or SSID, the BSSID (the MAC address identifying the access point radio), GPS coordinates, and whether the network appeared to be using Wired Equivalent Privacy (WEP), the Wi-Fi encryption standard of the time.
That was wardriving.
At the time, wardriving generally meant detecting and mapping wireless networks, not connecting to them. Over the years, the term has sometimes been used more broadly, often as shorthand for finding and then attacking vulnerable Wi-Fi networks.
I wasn’t authenticating to these networks or attempting to access them. I was observing wireless network information being broadcast around me.
And there was a lot to observe.
More Than 80 Percent Weren’t Using WEP
One of my surveys covered Hampden Township, Pennsylvania.
I detected 102 wireless access points.
Only 15 were identified as using WEP.
The other 87, or 85.3 percent, did not appear to be using WEP encryption.
I also conducted a broader survey around the Harrisburg area.
That dataset contained 142 wireless access points.
Only 24 were identified as using WEP.
The remaining 118, or 83.1 percent, did not appear to be using WEP encryption.
First 50 of 142 entries from the Harrisburg wardriving survey. Some SSID names and location data have been redacted for privacy.
“Privacy note: Some of the data shown in the screenshot has been lightly redacted. SSIDs that appeared to identify individuals or families have been removed, and the device-specific portion of each BSSID has been redacted.”
The listed GPS coordinates show the position of my car when a wireless network was detected, not necessarily the location of the access point. Detection distance varied based on the quality of the antenna, the access point’s equipment and transmit power, terrain, buildings, interference, and other conditions. Without signal-strength measurements or readings from multiple positions, an access point could have been right next to my car or much farther away.
Looking at the data today, some of the network names are almost as interesting as the security statistics. There are plenty of linksys, default, Wireless, WLAN, Intel Gateway and MSHOME entries. Anyone who worked with consumer networking equipment in that era will probably recognize some of those names, and perhaps experience an unwelcome flashback.
At first glance, the security lesson seems obvious.
More people should have turned on WEP.
Except there was a problem.
The Security They Weren’t Using Was Already Broken
WEP was intended to give wireless networks privacy roughly comparable to that of a wired network.
By the time I could have conducted my wardrive, researchers had already demonstrated serious problems with that promise.
In 2001, Nikita Borisov, Ian Goldberg and David Wagner published research documenting fundamental security weaknesses in WEP. Their work showed that WEP failed to provide the level of confidentiality and security its designers intended.
Then things moved quickly.
Cryptographers Scott Fluhrer, Itsik Mantin and Adi Shamir identified weaknesses involving RC4, the stream cipher used by WEP, and the way keys were constructed.
In August 2001, researchers at AT&T Research tested a production network with its administrator’s permission and recovered a 128-bit WEP key using passive observation.
That was before the earliest possible date of my wardriving research.
So my old research captures an interesting moment in cybersecurity history.
More than 80 percent of the wireless networks I detected weren’t using WEP. Yet the security mechanism they weren’t using had already been shown to be fundamentally inadequate. It was still better than broadcasting everything in the clear, but the margin of victory was not especially comforting.
Telling everyone to simply “turn on security” wasn’t going to solve the problem.
The security itself needed to get better.
This Wasn’t Just Pennsylvania
My research wasn’t scientific, and it shouldn’t be treated as representative of Wi-Fi deployment everywhere in 2001 or 2002.
But wardriving itself was emerging as a security research technique around this time. In April 2001, security researcher Peter Shipley was documented driving around San Francisco looking for wireless networks with a laptop, wireless card, GPS and an external antenna on his car.
The resemblance to my own setup is striking. It shows what an effective wardriving rig looked like during that brief period, as Wi-Fi adoption moved faster than Wi-Fi security.
Wi-Fi Security Catches Up
Fortunately, WEP wasn’t the end of the story.
In October 2002, the Wi-Fi Alliance announced Wi-Fi Protected Access, or WPA, as a stronger interim replacement for WEP. WPA-capable products began appearing in 2003.
The IEEE subsequently completed the more comprehensive 802.11i security standard in 2004, and the Wi-Fi Alliance began certifying WPA2 products that year.
Over time, wireless security improved dramatically.
That progression is worth remembering because it’s easy to look back at early Wi-Fi security and wonder how anyone could have deployed a wireless network without encryption.
But Wi-Fi itself was new.
The Technology Changes. The Cycle Doesn’t.
Looking through these files nearly 25 years later, what strikes me isn’t how primitive Wi-Fi security was.
It’s how familiar the pattern feels.
A transformative technology arrives.
Adoption accelerates.
People find new ways to use it.
Researchers begin testing assumptions and finding weaknesses.
Security practices race to catch up.
Standards change. Products improve. What once required specialized knowledge eventually becomes standard.
We watched the same cycle unfold with cloud computing. Organizations moved applications and data to the cloud, often faster than their security practices could follow. Misconfigured storage, exposed services, and overly broad permissions became familiar problems. Over time, the tools improved and cloud security matured.
Now we’re watching another version of the cycle with AI.
AI systems are being connected to sensitive data, business applications, and tools that can take action. Researchers are finding problems such as prompt injection, data leakage, excessive permissions, and unpredictable agent behavior. The vulnerabilities are different, but the pattern is not.
And sometimes security isn’t merely playing catch-up.
Sometimes we discover that the security controls we started with were built on assumptions that don’t survive contact with the real world. WEP was one of those controls.
Nearly 25 years ago, one way we tested those assumptions was to put an antenna on the roof of a car, connect it to a laptop, turn on a GPS and start driving.
Today, researchers may be testing cloud services or probing AI agents instead.
The technology changes.
The cycle doesn’t.
Enjoyed this article?
Subscribe to Between The Hacks for practical cybersecurity, real-world stories, and fresh perspectives on the technologies shaping our digital future.
