Using a $20 unmanned drone, researchers at the University of Waterloo in Ontario have created what is essentially an airborne scanning device that can triangulate the location of every WiFi-connected device in your home. Yes. Researchers Ali Abedi and Deepak Vasisht, who recently presented their findings at the 28th Annual International Conference on Portable Computing and Networking, call this trick “Wi-Peep,” which is a deceptively cute name for a project with such dire consequences . Wi-Peep is involved in what the researchers call a “location-revealing privacy attack” that can manipulate data on WiFi networks and use it to “see through walls” or, rather, access the location of devices through insidious scanning. How does the attack work? The researchers say their device exploits security flaws in IEEE 802.11—a long-standing wireless protocol for local access networks that has a history of problems with eavesdropping and eavesdropping. The program deploys what is known as a “time-of-flight” (ToF) technique, which uses a data manipulation trick to measure the physical distance between a signal and an object. Researchers imagine some pretty creepy scenarios involving Wi-Peep’s secret data collection. Abedi and Vasisht worry that a hacker armed with this device could potentially “infer the location of the home’s occupants, security cameras and even home intrusion sensors.” G/O Media may receive a commission Going a step further, they imagine an intruder: A burglar could use this information to locate valuable items such as laptops and identify prime opportunities when people are either not at home or away from a certain area (eg everyone is in the basement) by monitoring smartphones or their smart watches. During his presentation, Abedi further speculated that the tool could be used to “monitor the movements of security guards inside a bank by tracking the location of their phones or smartwatches. Similarly, a thief could identify the location and type of smart devices in a home, including security cameras, laptops and smart TVs, to find a good candidate to break into. Furthermore, operating the device via drone means it can be used quickly and remotely without much chance of the user being detected.” Abedi and Vasisht say they hope their research will lead to the development of better protections for WiFi protocols so that future iterations are not as vulnerable to attacks as the current ones. “We hope our work will inform the design of next-generation protocols,” the researchers write.
