Common WiFi routers can track your identity and movements without your knowledge. This has been claimed in a new study. According to the study, the beamforming feedback information (BFI) used in it is broadcast without encryption and can be captured from any device. Researchers at Germany’s Karlsruhe Institute of Technology found that BFI can identify people walking in a room with 99.5% accuracy. This danger increases due to the fact that it requires neither network hacking nor WiFi password.
How WiFi feature became the new weapon of surveillance
Beamforming is a feature in modern WiFi standards that helps send signals to devices more efficiently. For this, smartphones and laptops continuously send small reports about how they are seeing the wireless channel. This is beamforming feedback information or BFI, which is completely unencrypted. The study found that this BFI can be easily captured by any nearby device and can be misused for identification and movement tracking.
How was the experiment conducted in the study?
The researchers created a WiFi setup with two access points and four listening points on the 6 GHz band. They recorded 197 volunteers walking at a normal walk, walking briskly, passing through turnstiles, and carrying bags or crates. Both BFI and CSI data were processed in a simple neural network. The results were surprising – using BFI alone, the model identified more than 160 people with 99.5% accuracy, which was better than CSI.
Why is BFI becoming more dangerous than CCTV?
Researchers said that achieving CSI requires special hardware and firmware, but BFI is available from every common WiFi router. This turns it into a serious privacy threat. While CCTV cameras make their presence visible, WiFi access points remain silently installed on the ceiling or in corners. People try to avoid cameras, but ignore the presence of WiFi. This creates an environment like the inverse panopticon where people think they are unseen, while they are constantly being profiled.
What else can be tracked after identification, how big is the danger?
According to the study, once the system establishes the identity of a person from his movements, all his movements, activities and behavior over time can be linked to that identity. This increases the privacy risk manifold, even if the real name of the person is not known. Researchers warned that effective security measures have not yet been made regarding BFI. Existing noise-based mitigation techniques also mostly focus on CSI, while the major threat is from BFI.
Leave a Reply