Researchers at the Karlsruhe Institute of Technology (KIT) in Germany say ordinary WiFi networks can be used to identify people with an eerie amount of accuracy.
In a study, the researchers describe using beamforming feedback information (BFI) and machine learning models to identify people walking within a network’s range. The team found that this BFI-based technique was able to infer a person’s identity with 99.5% accuracy. They presented their findings at the ACM’s Conference on Computer and Communications Security last November.
Beamforming, which was introduced with WiFi 5, allows routers to direct their signals more efficiently toward connected devices. To make that work, devices connected to a network send feedback to the router.
The problem, according to the researchers, is that this feedback is unencrypted and can be accessed without the need of specialized hardware or even a direct connection to the WiFi network. This method could also identify people that don’t have any connected devices on them as long as they are in the network’s range.
According to the study’s press release, once a machine learning model has been trained, identifying someone takes only a few seconds.
This is accomplished through what is known as WiFi sensing, or the use of WiFi signals to infer information about a physical environment. When radio signals like WiFi travel through a space, they interact with the objects and people around them. Those signals can be reflected, scattered, or absorbed. By analyzing how the signal is expected to behave compared with how it is actually received, researchers can infer details about the surrounding environment.
“By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present,” said Thorsten Strufe, a KIT professor and study co-author, in a press release. “This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition.”
During the study, researchers collected WiFi signal recordings from nearly 200 participants as they walked through a WiFi field using different walking styles. The data was recorded from four different perspectives using both the BFI method and an older WiFi sensing approach relying on channel state information, or CSI.
CSI measures how a radio signal changes as it travels through a room and reflects off walls, furniture, and people. It has already been used in previous WiFi sensing research, but it is harder to access in practice because it often requires modified firmware.
The older CSI method was able to identify individuals based on their normal walking style at an 82.4% accuracy.
“This technology turns every router into a potential means for surveillance,” said co-author Julian Todt in the press release. “If you regularly pass by a café that operates a WiFi network, you could be identified there without noticing it and be recognized later – for example by public authorities or companies.”
The researchers are urging the IEEE, the organization that sets industry standards, to include stronger privacy safeguards in the upcoming 802.11bf standard, which is meant to standardize WiFi sensing applications.
