Et Tu Alexa? When Commodity WiFi Devices Turn into Adversarial Motion Sensors

Abstract

Our work demonstrates a new set of silent reconnaissance attacks, which leverages the presence of commodity WiFi devices to track users inside private homes and offices, without compromising any WiFi network, data packets, or devices. We show that just by sniffing existing WiFi signals, an adversary can accurately detect and track movements of users inside a building. This is made possible by our new signal model that links together human motion near WiFi transmitters and variance of multipath signal propagation seen by the attacker sniffer outside of the property. The resulting attacks are cheap, highly effective, and yet difficult to detect. We implement the attack using a single commodity smartphone, deploy it in 11 realworld offices and residential apartments, and show it is highly effective. Finally, we evaluate potential defenses, and propose a practical and effective defense based on AP signal obfuscation.

IRShield: A Countermeasure Against Adversarial Physical-Layer Wireless Sensing

“…With a particular focus on privacy violations, Banerjee et al [5] and Zhu et al [32] studied Wi-Fi-based physicallayer attacks to infer human motion from channel observations by eavesdropping packets. In both papers, the authors utilized a sliding-window standard deviation or variance as a measure of temporal channel variation.…”

“…In both papers, the authors utilized a sliding-window standard deviation or variance as a measure of temporal channel variation. While [5] focused on detecting LOS crossings, [32] pursues monitoring of entire environments for motion, including differentiation of motion in specific parts of the target environment. The authors of [5] employed Wi-Fi routers with MIMO functionality to implement the attack and [32] presented a smartphone-based implementation.…”

“…Zhu et al [32] demonstrated the feasibility of carrying out fine-grained detection and tracking of human movements inside a building by only sniffing ordinary Wi-Fi signals.…”

“…While eliminating the use of full-duplex equipment, the proposal by Yao et al [29] requires several motorized moving hardware parts. Other approaches by Zhu et al [32] and Wijewardena et al [25] change the allocation of the channel. Therefore, they not only trade the quality of service of wireless communication against adversarial sensing capabilities, but also require integration with the wireless devices in the field.…”

Private Data Exfiltration from Cyber-Physical Systems Using Channel State Information

“…As RSS is the combination of many subcarriers, this gives a fairly poor resolution when examining the environments effect on the channel state. CSI is conventionally used to improve the reliability of communication, but being able to view subcarrier level effects caused by the environment has led to improvements in the fields of localization [41,43,47], device-free activity recognition [13,28,48], fall detection and health monitoring [46], smartphone gesture recognition [30], and cross-technology communication [16].…”