Et Tu Alexa? When Commodity WiFi Devices Turn into Adversarial Motion Sensors

TL;DR

This paper reveals that commodity WiFi devices can be exploited to silently track user movements inside private spaces without network compromise, using signal analysis and a new motion detection model.

Contribution

The authors introduce a novel signal model linking human motion to WiFi signal variance, enabling covert tracking with off-the-shelf devices, and propose a practical defense mechanism.

Findings

Effective motion detection with a single smartphone

Successful deployment in 11 real-world environments

Proposed defense based on AP signal obfuscation

Abstract

Our work demonstrates a new set of silent reconnaissance attacks, which leverages the presence of commodity WiFi devices to track users inside private homes and offices, without compromising any WiFi network, data packets, or devices. We show that just by sniffing existing WiFi signals, an adversary can accurately detect and track movements of users inside a building. This is made possible by our new signal model that links together human motion near WiFi transmitters and variance of multipath signal propagation seen by the attacker sniffer outside of the property. The resulting attacks are cheap, highly effective, and yet difficult to detect. We implement the attack using a single commodity smartphone, deploy it in 11 real-world offices and residential apartments, and show it is highly effective. Finally, we evaluate potential defenses, and propose a practical and effective defense based on AP signal obfuscation.