UNVEIL: Capture and Visualise WiFi Data Leakages

Abstract

In the past few years, numerous privacy vulnerabilities have been discovered in the WiFi standards and their implementations for mobile devices. These vulnerabilities allow an attacker to collect large amounts of data on the device user, which could be used to infer sensitive information such as religion, gender, and sexual orientation. Solutions for these vulnerabilities are often hard to design and typically require many years to be widely adopted, leaving many devices at risk. In this paper, we present UNVEIL-an interactive and extendable platform to demonstrate the consequences of these attacks. The platform performs passive and active attacks on smartphones to collect and analyze data leaked through WiFi and communicate the analysis results to users through simple and interactive visualizations. The platform currently performs two attacks. First, it captures probe requests sent by nearby devices and combines them with public WiFi location databases to generate a map of locations previously visited by the device users. Second, it creates rogue access points with SSIDs of popular public WiFis (e.g. _Heathrow WiFi, Railways WiFi) and records the resulting internet traffic. This data is then analyzed and presented in a format that highlights the privacy leakage. The platform has been designed to be easily extendable to include more attacks and to be easily deployable in public spaces. We hope that UNVEIL will help raise public awareness of privacy risks of WiFi networks. CCS CONCEPTS • Security and privacy → Social aspects of security and privacy; • Human-centered computing → Information visualization.

Detrimental network effects in privacy: A graph-theoretic model for node-based intrusions

“…Attacks based on Wi-Fi are either passive, where the app simply observes probe requests that mobile phones send to sense nearby Wi-Fi hotspots, or active, running a fake hotspot with a common SSID (e.g., attwifi, xfinitywifi) for nearby phones to connect to. 46 While more complex, the latter bypasses MAC address randomization used by some operating systems, including relatively recent versions of both Android and iOS. 47 , 48 The two main platforms are thus moving toward re-randomization of the MAC address even when connecting to previously known networks.…”

A Consumer Product of Wi-Fi Tracker System using RSSI-based Distance for Indoor Crowd Monitoring

“…To address this gap, the focus of this study is to provide a comprehensive design of Wi-Fi tracking system that offers a clearer understanding. The study aims to delve into the different components of system in greater detail compared to previous studies [ [18][19][20][21][22][23][24][25][26]. It is expected to make it easier for readers to understand the whole system.…”

“…For example, unauthorized individuals can steal information stored in MAC address and use it to identify peoples' location and duration of stay in a building [24]. This raises significant safety and privacy concerns [25]. In this study, TLS/SSL is employed for MQTT communication to ensure secure transmission due to its ability to provide a secure communication channel between the client and server.…”

“…However, before sending the data, it is encrypted using Transport Layer Security/Secure Sockets Layer (TLS/SSL) with 1024-RSA encryption to ensure compliance with data security requirements. This step is crucial as the data transmitted during communication are susceptible to vulnerabilities [ [24], [25]. Subsequently, the nodes establish a connection with Wi-Fi tracker AP and the collected data is finally transmitted to the server using MQTT protocol.…”

An Experiment to Prevent Malicious Actors from Compromising Private Digital Assets Over a Public Network

“…In the past 10 years, mobile devices have been growing rapidly at a speed unthought before. The advent of smartphones would not exactly be as great as they are if it were not for the invention of fast and reliable internet broadbands, thus much of the credit goes to Wi-Fi protocols and their improving implementation over the years (Jain et. al, 2019).…”