Thread

WaveDigger: Dig into wireless signals to discover their physical locations

138 points · 28 comments · 882542F3884314B

Loading the complete thread in the background. This saved snapshot is available now. Refresh

doublerabbit · 1790266423 · focus · HN ↗
Cool. This'll go nicely with my hackslab and tinfoil hat upgrade.
oulipo · 1790268348 · focus · HN ↗
Interesting, wondering why Apple doesn't restrict the queries to its server using a certificate that would be pinned on the devices, etc, so at least you would need a legit iPhone/Mac to be able to do a query?
1. mcculley · 1790279775 · focus · HN ↗
  Are you imagining some certificate unique to each device? What would prevent someone copying it?
  1. BobbyTables2 · 1790304184 · focus · HN ↗
    I don’t think Apple would have much trouble burying a certificate and key in a IOS device that would be very hard to access.
  2. oulipo · 1790369899 · focus · HN ↗
    This is quite common, you add the private key to some secure hardware module, so that only that device can sign using the certificate, and then use TLS to connect
    mcculley · 1790376773 · focus · HN ↗
    I get that this is how iMessage works, as I understand it. I am wondering what tradeoffs make Apple decide to use the Secure Enclave versus more mundane certificate infrastructure and how they would make it hard for us to get at this with a debugger if they chose that route.
drnick1 · 1790270806 · focus · HN ↗
I started rotating my BSSID weekly after I learned Apple and Google abused it to track the location of people and devices.
Permanent hardware or software IDs, such as the Windows GUID or machine-id on Linux (systemd) are inevitably abused for surveillance sooner or later.
1. S0und · 1790271756 · focus · HN ↗
  You have all the good intentions, but since no one else does this around your location, I don't think you're achieving anything.
2. skinfaxi · 1790283483 · focus · HN ↗
  How do you coordinate across all of your devices?
3. astrange · 1790284550 · focus · HN ↗
  You mean, they used it so people trying to use their maps apps didn't have to wait several minutes for a cold GPS fix?
  1. gpm · 1790297927 · focus · HN ↗
    > wait several minutes for a cold GPS fix
    My phone doesn't take several minutes to get a GPS fix even when I'm in the middle of nowhere well beyond the range of cell towers let alone wifi routers...
    I understand that in theory it could if it had no clue what time it was either for some reason... but in practice it does and we're talking seconds (though more than 2) not minutes.
    Fabricio20 · 1790299124 · focus · HN ↗
    I feel like that's not a true cold GPS signal! Though I'm not arguing the parents scenario is realistic either. I got a GPS module for a drone I was building and it took 20 minutes to get a proper GPS lock from cold!!! I was sitting there watching betaflight doing it's thing wondering why the heck it takes so long when there's so many satellites in view!
    gpm · 1790299662 · focus · HN ↗
    [delayed]
    15155 · 1790326457 · focus · HN ↗
    It doesn't need to be a cold GPS signal, it only needs to be one that doesn't track you. Your drone doesn't have access to the internet to do the almanac and ephemeris download, that's the difference.
    Aiding the fix by obtaining data from a faster unidirectional source (instead of satellite to device, it's just internet to device) doesn't reveal anything private, unlike mass-capture of WiFi (B)SSIDs.
    Also, I would look into the quality of the GPS radio and antenna you are using - $95 u-blox modules will get an RTK-quality fix without outside assistance in minutes.
    05 · 1790327465 · focus · HN ↗
    20minutes just means a shitty module or lots of ~1.3ghz noise (e.g. from dji o3/o4 or gopro cpu), although bad input filtering and gps located near an antenna could saturate the amplifier even with antenna on a different frequency. 1min is typical for cold fixes but you can make it faster by uploading ephemeris/cache using AssistNow (valid for about a month).
4. XorNot · 1790287926 · focus · HN ↗
  The same physical location showing a different SSID every week but the surrounding ones not changing would be deanonymizing you much more aggressively.
  People mostly don't change SSIDs or even move networking hardware - e.g. AirBnBs.
  Edit: and also are you still carrying a smart phone while doing this? The device which has GPS and a cloud internet connection?
luma · 1790272805 · focus · HN ↗
Looks like an open version of SkyHook from way back in 2003: <a href="https://en.wikipedia.org/wiki/Skyhook_Wireless" rel="nofollow">https://en.wikipedia.org/wiki/Skyhook_Wireless
For a while they had a paid program, I had a Windows Mobile app I could run with an external GPS dongle that would record wifi APs and location, upload to skyhook, who would occasionally cut me a check for my trouble. I made tens of dollars!
1. Mashimo · 1790279617 · focus · HN ↗
  Ohhh, there was money to be made with war driving? I just got points on a German bb forum.
2. newtwentysix · 1790313980 · focus · HN ↗
  Wow! That reminded me of an interesting article in NYT about Skyhook wirless.
  <a href="https://www.nytimes.com/2009/06/01/technology/start-ups/01locate.html" rel="nofollow">https://www.nytimes.com/2009/06/01/technology/start-ups/01lo...
anigbrowl · 1790273566 · focus · HN ↗
Isn't this just wha WIGLE does?
1. jcims · 1790275617 · focus · HN ↗
  Basically except it's using an Apple service for the backend.
  Which will likely get cut off at some point.
  1. mcculley · 1790279184 · focus · HN ↗
    Why would it be cut off? Doesn’t Apple use this on devices?
    RockRobotRock · 1790377873 · focus · HN ↗
    They can always add some obfuscation/hardware attestation bullshit to make it harder to scrape.
Insimwytim · 1790276184 · focus · HN ↗
I thought this would be about measuring distance to source, and determining direction. This seems to be just a database check.
totetsu · 1790291878 · focus · HN ↗
This talk seems to give a good introduction to bssid <a href="https://www.youtube.com/watch?v=hlbjUvkoyBA" rel="nofollow">https://www.youtube.com/watch?v=hlbjUvkoyBA
bryancoxwell · 1790298288 · focus · HN ↗
Worth noting that the coordinates for cell towers returned by the WLOC API are coarse enough to be just about useless for locating towers. For APs it’s much better but still not great.
WorseIsBetter · 1790329024 · focus · HN ↗
[dead]
OptionOfT · 1790359235 · focus · HN ↗
Apple says you can opt out of this collection by appending _nomap to the SSID:
<a href="https://support.apple.com/en-us/102515" rel="nofollow">https://support.apple.com/en-us/102515
> The owner of a Wi-Fi access point can opt it out of Apple's Location Services by changing the access point's SSID (name) to end with "_nomap." For example, "Access_Point" would be changed to "Access_Point_nomap."
imagetic · 1790359680 · focus · HN ↗
I had an an interference issue with a logitech mouse on my desk so I asked Pi to take a look. Next thing I knew I'm in the macOS sdk measuring all the wireless devices at my desk. That was the coolest experience to date. I could see everything in our house in RF.
4d4m · 1790462055 · focus · HN ↗
This is awesome

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.