Researchers at the University of Waterloo have developed a device capable of “seeing” through walls. The device exploits flaws in the WiFi network to locate smartphones, laptops, or connected objects, which represents a danger for security and privacy.
A study to identify what can go wrong, and find solutions
Nicknamed Wi-Peep, this drone detects from the sky the electronic devices present inside the houses. Phones, laptops and the like reveal their location, and can be located quickly and accurately. This technology could fall into the wrong hands, either to prepare a coup and steal valuable devices inside a house, or to detect the location of security guards inside a bank for example, from their cell phones. « There is a flaw in Wi-Fi devices, and sooner or later people might start using it for obscure purposes said Ali Abedi, professor at Waterloo School of Computing and principal investigator of this new study of location data privacy compromised by wifi networks. By studying what can go wrong, researchers hope to help find solutions.
Even a password-protected Wi-Fi network can have a loophole that responds to connection attempts.
Abedi first discovered the flaw in 2020 while experimenting with wireless networks. Previously, it was thought that due to Wi-Fi security protocols, only devices on the same network could “talk” to each other, send and receive small packets of data. The assumption was that if a device received a packet from outside a network, something it didn’t expect, it would ignore it. But when Abedi and his team sent random data packets to 5,000 WiFi-enabled devices, to their surprise, all of them, including the password-protected ones, automatically responded with an acknowledgment. While no private data can be shared, Abedi thought it was possible to infer all sorts of other information, specifically device location data. “Location information is very important because many of us carry a Wi-Fi connected device almost all the time, like a cell phone or smartwatch”, did he declare. So, in general, finding the location of the device means finding the location of a person.
A drone could use the flaw to collect this location data… Unless researchers find a way to fix the flaw
Using a drone equipped with a wifi network detector, the researchers were able to identify the locations of devices to about one meter. To prevent criminals from using this technology, the researchers hope their work will inform the design of next-generation security protocols. In the meantime, Ali Abedi is urging Wi-Fi chipmakers to introduce artificial, random variation in device response time, which will make calculations like the ones Wi-Peep uses extremely inaccurate.