November 19, 2025
Cloud audit vs. penetration test – or both? Everything you need to know about cloud audits and penetration tests to conduct a sound audit.
WiFi Sensing has gained considerable importance in recent years – not only in research, but also in real-world applications. The ability to analyze Wi-Fi signals to detect movements and activities is not only interesting for smart home and security applications. Intelligence services have also recognized that this technology is a powerful tool for covert surveillance But how exactly does this work? And how do we use these technologies in the context of penetration testing
WiFi Sensing is based on the analysis of Channel State Information (CSI)which is included in modern WLAN protocols such as IEEE 802.11n/ac.
A simplified example:
A person moves in a room with active WiFi. The reflections of the signal on the person cause specific patterns in the CSI data that can be analyzed and interpreted
use intelligence services WiFi Sensing especially for covert surveillance in situations where the use of cameras or other sensors would be too conspicuous. Typical applications include:
The big advantage: Wi-Fi is ubiquitousIn contrast to traditional surveillance methods, WiFi Sensing does not require special sensors or cameras – the existing WiFi signal is sufficient.
The Physical Assessments we use similar techniques to penetrate security-critical areas and uncover vulnerabilities:
Technical implementation:
A proof of concept (PoC) can be realized using a Raspberry Pi and a compatible Broadcom WiFi chip. Here are the basic steps:
Result: Movements or activities in the room cause clear patterns in the CSI data.
import matplotlib.pyplot as plt
import numpy as np
# Beispiel-Daten simulieren (in echt durch Nexmon extrahiert)
time = np.linspace(0, 10, 1000)
csi_data = np.sin(time) + np.random.normal(0, 0.1, len(time))
plt.plot(time, csi_data)
plt.title(‘Beispiel: CSI-Datenvisualisierung’)
plt.xlabel(‘Zeit (s)’)
plt.ylabel(‘Amplitude’)
plt.show()
Result: Movements or activities in the room cause clear patterns in the CSI data.
Complete protection against WiFi sensing is hardly possible because this technology is based on ubiquitous WiFi signals. Nevertheless, there are two sensible approaches to minimize the risks and even gain security benefits:
Use of technology for self-protection: Companies can actively use WiFi Sensing to detect potential security incidents, such as break-ins or unauthorized movements in security-critical areas. By analyzing the WiFi signals, activities can be monitored without having to install additional sensors.
Signal shielding in critical areas: In particularly sensitive environments – such as research departments or meeting rooms – care should be taken to ensure that WLAN signals are effectively shielded. This can render attacks based on WiFi sensing ineffective. This can be achieved, for example, through special structural measures such as Faraday cages or signal-blocking materials.
Instead of just acting reactively, companies can also use these technologies proactively to uncover security gaps and better protect themselves.
WiFi Sensing is not only a tool for intelligence services or research institutions. It also offers penetration testing and Physical Assessments a decisive advantage in making security gaps visible.
We show our customers how attackers can use modern technologies - and how to protect themselves against them. WiFi is everywhere. Let's use it correctly.
Cloud audit vs. penetration test – or both? Everything you need to know about cloud audits and penetration tests to conduct a sound audit.
Efficiently uncover hidden attack paths in scheduled tasks. TaskHound helps! TaskHound: Search for scheduled task credentials in Windows systems and their associated information.
Which IT regulations apply to my financial institution? Overview of DORA, MaRisk, BAIT, and more. Regulation, resilience, responsibility: Why IT security matters in the financial sector
2 comments
Hello, what if you don't have Wi-Fi and have also deactivated Wi-Fi and Bluetooth on your phone.
the monitoring then also works.
Greetings, Marie
Hi Marie,
If Wi-Fi and Bluetooth are completely deactivated – both on the router and on the smartphone – no connection can be established via these radio channels.
However, this does not automatically mean that any form of surveillance is no longer possible:
Devices can often still use mobile data (4G/5G) as long as the SIM card is active. This can be used to transmit location and usage data.
Even without an internet connection, local sensors (e.g. GPS, accelerometer) can collect data that is later transmitted once a connection is re-established.
Some devices have additional radio modules (e.g. NFC) that could also be active if they are not turned off separately.
In short:
Turning off Wi-Fi and Bluetooth will eliminate these two transmission paths, but complete protection against surveillance requires you to disable all possible wireless and data connections or turn off the device entirely.