Person detection without cameras using wifi beacons

[M4DM4NZ]

TL'DR

• Capture beacon requests over wifi being broadcasted from peoples phones in their pocket/car as they walk/drive by
• Log the "timestamp" and "signal" strength into a dump file
• Write a loop script that checks the last 100 lines of the dump for MAC address and timestamps to filter out beacons that are STILL seen within a 1 min time-frame
• If true, then send alert to BI using your preferred method
• Now the fun part, compare the timestamps from your wifi capture log to your Blueiris alerts timestamp, you should see footage of a person walking past at the same time the wifi log was created.
• Advantages? you can now see around corners, whitelist your neighbors MAC address's and let the fun begin

Hey guys,

So a few years back I installed Kali linux onto a raspberry pi and started messing around with the aircrack-ng suite of programs.

Its been a while, but i figured some of you with more time might like to recreate what I did.

first off, do note that when i was doing this, Apple and Android phones older than 2018 didn't randomize their MAC address's when sending out broadcast beacons, so it was much easier back then to confirm a persons phone was in the area because their MAC address would never change.

These days, I'm pretty sure the MACs are randomized within a short timeframe, but if i remember correctly, The SSID is still broadcasted in the beacon packet, so you could us that as a filter, depends on your use case.

I would say the most important use-case for most people here is getting some kind of notification if ANY mac address that's not whitelisted is found broadcasting for longer than a person just passing by.

Dont forget, you can run into some false flags here, for example, you have whitelisted your neighbor, but they invite friends over for the first time.... or someone just pulls over outside your house thats not from around the area. I've even had my system detect the wifi from "smart" cars themselves which is pretty funny
even aftermarket air tire sensors on some wheels get detected.

There are some command line switches in airmon to tag hardware manufactures using a common database list, this will tell you if a MAC address is related to a Apple,Intel,Sony,Realtek device etc. (another useful whitelist possibility)


You will need:

Anyway, this can get pretty technical, but there's a few things you'll need to get started....

First off, you'll need a USB wifi dongle that's capable of working in whats called "monitor"mode, I've found most TP-link adapters have the correct chip-sets that support this mode. (also, try looking for a dual band device that does 2.4Ghz and 5Ghz)

A raspberry pi with a high endurance Micro SD card (because it will be constantly writing log files)

A really long extension USB cable ( so you can possession your wifi dongle as close to the front of your house or area of interest..)


That should be just about all the info you need to get started, honestly the hardest part is writing the loop script, I used bash, but im sure there are better ways to write these days, I'm just not good at programming.

So yeah, if any of you wanna have a go at creating this, here are a few links to help.(see below)

If you do end up writing a script, please post it here for everyone to use, i can guess something like this would be an amazing add-on for programs like "Home Assistant"
some conditions i had running were awesome like, "if a person who's not on the whitelist gets to close to the house for longer than 2 min, turn on the stereo and crank the volume playing an alarm WAV file.
or flash smartlights when someone drives past thats not from around here (this takes months of capturing logs to work out who actively lives in the neighborhood )

Screenshots:





btw, you dont need to use a raspberry pi, an old laptop will do the trick too.



LINKS:

airmon-ng [Aircrack-ng]

www.aircrack-ng.org

Get Kali | Kali Linux

Home of Kali Linux, an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments.

www.kali.org

150Mbps High Gain Wireless USB Adapter

The TL-WN722N Wireless N USB Adapter allows you to connect any computer to high-speed internet. Speeds of up to 150Mbpsare ideal for online gaming and smooth video streaming.

www.tp-link.com

 

[actran]

@M4DM4NZ You have any working code for this project?

Also, people who have no phones or have dumb phones would not be detected via this method.

 

[Gargoile]

And what if I never turn on my cell's wifi and bluetooth?

 

[lcam]

This is an interesting idea but I'm not sure how practical it is for security alone but in conjunction with cameras and AI it will give you more information.

 

[M4DM4NZ]

@M4DM4NZ You have any working code for this project?

Also, people who have no phones or have dumb phones would not be detected via this method.

well considering your grandparents might be the only ones walking around these days without a phone with wifi turned on....

this system covers 99% of people walking around

 

[M4DM4NZ]

This is an interesting idea but I'm not sure how practical it is for security alone but in conjunction with cameras and AI it will give you more information.

Yes in conjunction with cameras, it can get interesting.... for example, before random MACs, if i ever spotted cop cars driving past, i could flag their macs and sent alerts every time they drove past again in the future.

in my neibouhood, somthing interesting is always going down if the cops are driving past lol

 

[M4DM4NZ]

And what if I never turn on my cell's wifi and bluetooth?

no one does that theses days, there was a time when people would turn off wifi/bluetooth when not in use to save power, but battery tech is much more optimized now.

 

[wittaj]

I think it is a cool idea and another tool in the toolbox. I would be interested in looking into this further.

It would be a further way to help the police IDENTIFY who was in a vehicle or who walked by.

Every thief that has come past here has had a phone, so it could provide some useful information. I would assume if the crime was high enough or bad enough the police could get warrants to mobile providers to find the MAC address?

 

[Gargoile]

no one does that theses days, there was a time when people would turn off wifi/bluetooth when not in use to save power, but battery tech is much more optimized now.

I never use WiFi on my phone and Bluetooth is always off on my phone too. So this system of yours will NEVER pick me up when I walk past your home.

 

[DanDenver]

This does not seem to even exist. The OP is asking for code in case anyone actually does this. So mostly just an idea. Certainly an interesting one in certain edge cases for sure.

 

[M4DM4NZ]

This does not seem to even exist. The OP is asking for code in case anyone actually does this. So mostly just an idea. Certainly an interesting one in certain edge cases for sure.

I do actually have code for this, it was running at one stage inside a VM, i'll see if i can dig up the bash script from one of my old archive HDDs

but yeah, it would be better written by someone more experience with programing, my script pretty much just did this...

Poll output of airmon,
save output to a txt file
echo the last 100 lines of output to a 2nd text file every 1 min
then grep the 2nd txt file using filters to look at timestamps / mac / signal strength
delete first dump file, and loop this process


When i did have this running, the power signal being captured by the phone was good enough that i could see and "average" PwR output telling me which side of the street a person was walking on.

 

[M4DM4NZ]

I never use WiFi on my phone and Bluetooth is always off on my phone too. So this system of yours will NEVER pick me up when I walk past your home.

well, you must be one of the special ones

I used to be paranoid too and stitch anti-static bags into "one" of my jean pockets, that way whenever i felt like being tracked, id just swap my phone into the other pocket, it acts like a faraday cage, blocks all signals

 

[DanDenver]

@actran asked you for your code:
"@M4DM4NZ You have any working code for this project?"
But you chose not to post it. So not sure what is working where or when.
So I got the impression this is just an idea

 

[M4DM4NZ]

@actran asked you for your code:
"@M4DM4NZ You have any working code for this project?"
But you chose not to post it. So not sure what is working where or when.
So I got the impression this is just an idea

yeah soz, still getting to the replys, im at work lol

 

[M4DM4NZ]

Anyway, guys alot can be done with this, but since modern versions of iOS and Android make MAC address random now when broadcasting beacon requests, our only use-case for this with cameras would be capturing "timeframes" of when ANY beacon is discovered.
If you capture beacons for say 1 week, and find out the approximate number of access points and other stations that exist within your area long-term (lets say 15 devices), then your script should just alert you when a 16th device not only appears, but is still polling after 2min of timeframe.
that way you can safely say, theres someone here, thats not normally here, could be the mailman, garbage truck whatever.... but this is where you need to tweak the timeframe to get good results.

 

[DanDenver]

I don't get it, but when you have something working it would be interesting to see what you can do with it.

I find that so many of my friends get new phones so often, and others do as well. Each delivery truck is a Truck with a new person - and a new phone.

I guess I am just trying to see how you can eliminate the "noise" so that you have something useful. But again an interesting subject for sure.

 

[wittaj]

In the use case I am thinking of, I wouldn't use it to alert me, rather it would be another tool.

Say my cams catch a door checker at 2am. I pull this up and see if they had a phone with a MAC address and then see what I can do with it, if anything. Provide it to the police along with the video and if the crime was bad enough, maybe they can get warrants to the mobile providers to provide who the MAC belongs to?

I figure anything we can provide to the police is one more item that can be used to track or tie the person to the crime.

 

[DanDenver]

Like I said, when it is up and running, report back : )

 

[M4DM4NZ]

In the use case I am thinking of, I wouldn't use it to alert me, rather it would be another tool.

Say my cams catch a door checker at 2am. I pull this up and see if they had a phone with a MAC address and then see what I can do with it, if anything. Provide it to the police along with the video and if the crime was bad enough, maybe they can get warrants to the mobile providers to provide who the MAC belongs to?

I figure anything we can provide to the police is one more item that can be used to track or tie the person to the crime.

Exactly, this is what i used my system for back when MAC's were static and never changed, i could search the MAC address on Wiggle.net, and find an actual house address, wiggle.net works by people who enable monitor mode on there phone and start whats called "war driving", every time they drive past a wifi access point, the GPS coordinates are taken and overlapped onto google maps. as more driving is done, the more populated the SSID's become over the map, I did this manually by driving around my street with the laptop in my car then uploading the captured data to wiggle.net.



Each little purple square on the map is a wifi access point, you can zoom right in and see the mac address, you can even search the maps for the mac address in question...

 

[M4DM4NZ]

I don't get it, but when you have something working it would be interesting to see what you can do with it.

I find that so many of my friends get new phones so often, and others do as well. Each delivery truck is a Truck with a new person - and a new phone.

I guess I am just trying to see how you can eliminate the "noise" so that you have something useful. But again an interesting subject for sure.

You cant eliminate the "noise" because the phones (station) MAC is always changing, but the wifi access points SSID's are always the same (unless the user changes them on their router) but that's pretty uncommon.

Hence why i stopped doing this a few years back when apple,android updated their mobile operating systems. but still.... using timeframes and signal strength is still a possibility to harvest accurate data to combine with camera footage, and even act as triggers.