Hacker News Reader

Comment by transpute | Hacker News Reader

> This proof-of-concept would be a breakthrough for healthcare, security, gaming (VR), and a host of other industries.

Similar capability is scheduled for new consumer routers in 2024 via Wi-Fi 7 Sensing / IEEE 802.11bf. Hundreds of previous papers include terms like these:

  human-to-human interaction recognition
  device-free human activity recognition
  occupant activity recognition in smart offices
  emotion sensing via wireless channel data
  CSI learning for gait biometric sensing
  sleep monitoring from afar 
  human breath status via commodity wifi
  device-free crowd sensing

Earlier discussion: https://news.ycombinator.com/item?id=34423395

Sample code exists for ESP32 WROOM, https://wrlab.github.io/Wi-ESP/ and Intel 5300, https://dhalperi.github.io/linux-80211n-csitool/

View on HN

> Similar capability is scheduled for new consumer routers in 2024 via Wi-Fi 7 Sensing / IEEE 802.11bf.

Reminds me somewhat of a joke I recently saw posted somewhere in social media by a greybeard Unix sysadmin. In a discussion related new consumer grade IOT technology.

"The newest piece of technology I have in my house is an HP Laserjet 4, and I keep a revolver ready to shoot it if it ever makes an unexpected noise"

On a more serious note, however, I see a real serious problem with having consumer/residential wifi routers that can attempt to track people or movement around a house and have the default-on, built in capability to make themselves centrally manageable by some form of persistent internet-based connection-over-TLS link to their manufacturer. Same general ideas as Meraki or other.

Who wants to bet that the manufacturers of these things leave this capability turned on by default AND submitting data through its "cloud management" feature persistently for as long as the device is powered on and has a viable default route/gateway to the internet?

Who wants to bet that in 5-7 years we're seeing problems with these things submitting data sets of peoples' movement around a house into some database run by a vendor that then suffers a major data breach?

That joke is one of the all-time top /r/ProgrammerHumor posts:

https://old.reddit.com/r/ProgrammerHumor/comments/aloi5v/pro...

As you said, I can't imagine how this will not go wrong.

> Earlier discussion: https://news.ycombinator.com/item?id=34423395

The top comment [0] on this has:

> Counter-measures: https://news.ycombinator.com/item?id=27121918#27133079

but I don't understand the setup here. If you have the capability to run custom firmware on your router then don't you not need this countermeasure, since you can be confident your router isn't doing this wireframing anyway? Or is it saying that a passive bystander who is not connected to your network can infer the wireframes as well? That seems unlikely to me?

[0]: https://news.ycombinator.com/item?id=34424242

> passive bystander who is not connected to your network can infer the wireframes as well?

Yes, this can be done with a custom client monitoring existing routers today.

A bystander can also use their own router (2.4Ghz passes through most walls) to make inferences about human activity inside your building.

Then the countermeasure does nothing since you can't run your firmware on their router?

Correct, this 'countermeasure' is for a fantasy world in which it's easier to compromise your router than set up a couple clients and a router nearby.

Also, realistically, wi-fi isn't the boogeyman here, even though the person you're replying to has been doom-posting about it for years - UWB and various other tech is going to make detecting location and movement from RF frequency fairly trivial.

> compromise your router

No compromise needed. This was one research project looking at the current world where your existing router is happily beaming location information out of your home, which can be read by an attacker with a passive receiver. If an attacker is forced to use their own transmitter, that can potentially be detected.

> wi-fi isn't the bogeyman here

Wi-Fi is the lowest cost modern application of ancient doppler imaging radar that has been around for decades. There is code for ESP32 devices, https://wrlab.github.io/Wi-ESP/. Many years ago, through-the-wall surveillance was primarily used by military and law enforcement with devices costing thousands of dollars. How many people are aware that the capability is now available for $20?

This was just one tiny EU research project with limited funding, which was focused only on passive attacks, e.g. a receiver with custom firmware can make inferences from existing Wi-Fi routers. Their research was looking for a way to modify the default behavior of Wi-Fi transmitters to reduce leakage of location information. If this was the default behavior (e.g. via some combination of IEEE standard and regulation), then active attackers could be easily identified.

https://ans.unibs.it/projects/csi-murder/

> this paper addressed passive attacks, where the attacker controls only a receiver, but exploits the normal Wi-Fi traffic. In this case, the only useful traffic for the attacker comes from transmitters that are perfectly fixed and whose position is well known and stable, so that the NN can be trained in advance, thus the obfuscator needs to be installed only in APs or similar ‘infrastructure’ devices. Active attacks, where the attacker controls both the transmitter and the receiver are another very interesting research area, where, however, privacy protection cannot be based on randomization at the transmitter.

More research and funding is needed.

I'm not sure that's accurate. The article suggests they used three routers, and mention 'interference'. I think you'd perhaps need to be more than a 'bystander' to be able to set up a triangle of WiFi routers around someone's home.

Not impossible, of course, but by that point, no longer really a 'bystander'.

Depends on the adversary's objective. The DensePose paper is only one of hundreds of papers on Wi-Fi Sensing for different activities, over ~10 years of funded research, https://news.ycombinator.com/item?id=34485816. E.g. keystroke recognition can be done with a single passive receiver, https://news.ycombinator.com/item?id=34485613

Some research is less dependent on the training environment, https://techxplore.com/news/2021-11-winect-tracks-3d-human-p...

> wireless sensing systems .. mostly rely on models that were pre-trained on a fixed set of known activities, thus they can only classify a limited number of human poses or movements .. our system uses signal processing techniques to separate the Wi-Fi signals reflected from each moving limb and track the trajectory of each limb .. Winect could track free-form human activities with centimeter-level accuracy in a variety of challenging environments and scenarios.

Dec 2022 survey paper categorized recent research on wireless device-free human sensing, https://dl.acm.org/doi/10.1145/3530682

> WDHS systems involve three primary sensing task types. The first type, behavior recognition .. second type is movement tracking .. The third type, user identification, leverages the unique features in behaviors to identify who performs the movements .. we believe that more context-aware multi-modal systems will be proposed to handle the complex sensing tasks in real life.

I read it as three WiFi modules .. such as the three contained in the WIFI router mentioned.

Good shout. I checked the actual paper (here: https://arxiv.org/pdf/2301.00250.pdf, link in the article is broken), and seems you would need multiple routers:

> [...] three WiFi transmitters and three aligned receivers [...]. It should be noted that many WiFi routers, such as TP-Link AC1750, come with 3 antennas, so our method only requires 2 of these routers.

So basically, one on each side of the subject, one to transmit the signal, the other to receive, and then you can work out the interference pattern. It may be possible to do the same with the transmitters and receivers on the same physical device by measuring the reflected signal, but that doesn't seem to be what they were testing.

It seems that the person needs to be between the transmitter and receiver, so I'm not even sure if triangulation would work, although figure 2 implies that you need the 'line of sight' between the routers to be blocked (three 'transmitter' routers and three 'receiver' routers).

> (three 'transmitter' routers and three 'receiver' routers).

Three Tx antennas and three Rx antennas.

You need 3 of them to make a 3d point, otherwise you would have 2d/1d only. Even 1cm difference between antennas placement is more than enough.

> It seems that the person needs to be between the transmitter and receiver

You receive the direct signal earlier than the reflected one. If you find a way to capture both/only reflections then you can do it without LoS and consequently from only one device (though you would still need at least 3 Tx/Rx pairs.)

It seems that it's for installing on a station device I guess?

Time to cover walls with tinfoil? :)

I've actually seen people doing this. I wish I had one too. In few decades we'll have Faradey chambers for rent on per hour basis, just like music studios nowadays.

For smaller rooms with good HVAC ventilation for fresh air, EMF reduction can be achieved with removable clamping ZipWall/FastCap poles to support grounded aluminum radiant barrier on walls, roof & floor. E.g. Attic Foil has white vinyl on one side and conductive foil on the other side, about $0.25/sq ft. Matching tape for joints.

To frame the shielded room-within-a-room, cheaper alternatives to ZipWall/FastCap are PVC furniture pipe, electric metallic tube (EMT) conduit or 2x4 pine. Doorway can be shielded with radiant barrier and RE-U-ZIP magnetic entry strip for a reclosable opening. Bonus side effect is thermal insulation.

Transparent RF shielding for windows is more expensive ($4/sq ft), https://safelivingtechnologies.com/signal-protect/.

Use air quality and EMF meters to validate the design and monitor ongoing effectiveness.

> Or is it saying that a passive bystander who is not connected to your network can infer the wireframes as well? That seems unlikely to me?

Also known as passive radar

Even pre-WiFi 7, there are companies such as Cognitive who allow you to detect motion (as well as occupant activity, etc.). I implemented such a system at my previous company which sold Wi-Fi.

Yes, some vendors have shipped their own implementations. There's also custom firmware for some radios. But standardization will bring scale and ubiquity to non-technical users. Are millions of city occupants ready for transparent walls, floors and ceilings? Are businesses ready for remote keystroke detection?

I guess the future is RF blocking walls. Might even be a good thing since It'll allow for less congested airwaves for yourself.

Maybe something like this foil-backed gypsum board, https://www.goldbondbuilding.com/products/drywall-panels/foi...

RF/sound blocking drywall for SCIFs costs a small fortune, https://www.quietrock.com/products/quietrock-530rf

EMF shielding case study, https://www.zokazola.com/emf_reduction.html

You can get a lot of sound proofing by double layering drywall with an air gap in-between in exchange for some floor space.

My apartment ceiling has a ~60cm air gap with air conditioner ducting and stuff inside, not sure how responsible it is but I hear basically nothing from above me. Same for the side walls although I believe those are just super dense fire proof walls.

I suggest the opposite - it will enable many exciting smart home possibilities which in some could seriously reduce HVAC energy needs beyond what’s possible today.

You could leave the internal walls RF transparent. Which allows you to do whatever you want without your neighbors wifi scanning you.

Building energy efficient homes also does that. No need to over complicate the situation.

Lot easier to deploy WiFi in existing homes than build new one. It’s about easy impact on the world.

> remote keystroke detection

Wait what..? Is it that good? That's even more terrifying

Thankfully I use an extreme custom keyboard layout so I wish them luck.

Well I think with enough time you could just use the key press model to try different configurations until you got one that gave intelligible results. The process could be easily automated if the resolution is enough to support accuracy in the 90th percentile

That's about as hard as decrypting substitution cipher. Just think about the problem for a second, you will figure out how to trivially go around it.

That’s just as secure as ROT13

Do you also have your number keys remapped non-linearly?

2015 paper, https://dl.acm.org/doi/abs/10.1145/2789168.2790109

> We implemented the WiKey system using a TP-Link TL-WR1043ND WiFi router and a Lenovo X200 laptop. WiKey achieves more than 97.5% detection rate for detecting the keystroke and 96.4% recognition accuracy for classifying single keys. In real-world experiments, WiKey can recognize keystrokes in a continuously typed sentence with an accuracy of 93.5%.

More papers on keystroke recognition: https://scholar.google.com/scholar?hl=en&as_sdt=5%2C31&sciod...

60Ghz mmWave radar (coming to Wi-Fi via 802.11ay) has higher resolution, shorter range and low ability to penetrate building walls, but can pass through unshielded windows: https://news.ycombinator.com/item?id=30172647.

> there are companies such as Cognitive

It's my understanding that there have been companies trying to sell solutions like this for people-tracking indoors for supermarkets/grocery stores, shopping malls, large department stores for at least 7-8 years now.

(edit: Stuff like RF beacons built into shopping cart handles, right? Since the shopping carts are centrally owned/managed/controlled and with unique serial numbers, and mostly don't get stolen or leave the property.)

Your understanding is correct, but most of those were based on iBeacons/NFC/other tech and not Wi-Fi.

There were some things around WiFi, but on a higher level, e.g. recognizing unique radio mac addresses that were sending probes for their home SSIDs. Big reason most devices will now randomize their MAC address until actually authenticated with a network.

Sounds like phrases out of 1984.

does it thouuuugh?

I understand that references to 1984 are meant to convey an aversion to the potential of government surveillance, unavoidable totalitarian control, and a society that exists far after this has already occurred

but there aren't any phrases in that 73 year old book like that, kind of overused and dilutive

Just because the bad guys already has some power doesn’t mean we should be making things even easier for them.

Maybe they meant it more as a comparison to Winston's living situation and how he had to stand in one corner to not be seen if I remember correctly. The very first thing I thought of when I read through this here was how I might be less safe from observation by the government with this. And I'm really no anti or even small government type yet it's the first thing that came to mind.

It takes one person (somewhere between invention and extinction) to flip that switch.

I'm fairly convinced drone technology is a bad idea for the very same reason.

Can you give us an example of the kind of phase you're talking about?

Reply on news.ycombinator.com