Violating privacy through walls by passive monitoring of radio windows

Abstract

We investigate the ability of an attacker to passively use an otherwise secure wireless network to detect moving people through walls. We call this attack on privacy of people a "monitoring radio windows" (MRW) attack. We design and implement the MRW attack methodology to reliably detect when a person crosses the link lines between the legitimate transmitters and the attack receivers, by using physical layer measurements. We also develop a method to estimate the direction of movement of a person from the sequence of link lines crossed during a short time interval. Additionally, we describe how an attacker may estimate any artificial changes in transmit power (used as a countermeasure), compensate for these power changes using measurements from sufficient number of links, and still detect line crossings. We implement our methodology on WiFi and ZigBee nodes and experimentally evaluate the MRW attack by passively monitoring human movements through external walls in two real-world settings. We find that achieve close to 100% accuracy in detecting line crossings and determining direction of motion, even through reinforced concrete walls.

Gait recognition using wifi signals

“…PinLoc gathered location dependent CSI value distributions to localize a target with accuracy of several centimeters [23]. MRW used CSI or Received Signal Strength (RSS) values to monitor the presence of human movement behind a concrete wall [4]. CARM used CSI-speed model to extract human movement speeds from CSI signal [31].…”

Et Tu Alexa? When Commodity WiFi Devices Turn into Adversarial Motion Sensors

“…Similarly, an earlier work [17] detects the presence of a user when she disturbs the direct path between a WiFi access point (AP) and a sniffer. Again, the attacker must obtain AP locations a priori, and must deploy multiple sniffers around the target area to detect user presence (see Figure 1b).…”

“…Along these lines, our proposed attack only requires a single commodity WiFi receiver (with a single antenna) outside of the target area ( Figure 1c). As we will explain in §IV, this is made possible by building a new model to detect motion using dynamics of multipath signal propagation from each anchor to the sniffer, rather than those of the direct path as in [63], [17].…”

“…Unlike prior work on passive RF sensing [63], [17], our new model focuses on capturing temporal dynamics of multipath signal propagation 3 from each anchor to the sniffer, rather than only the direct path. This lets the attacker detect any motion around each anchor that disturbs the multipath signal propagation, and also eliminates the need to obtain precise anchor locations and deploy multiple sniffers [63], [17].…”

“…The final group detects user motion using passive sniffers to collect and analyze physical RF signals [17], [19], [63]. As discussed earlier, both [17], [63] target user motion that disturbs the direct propagation path, requiring precise locations of the anchors. [19] uses multiple sniffers with bulky directional antennas to compute doppler shift of user motion.…”