
DORA Regulation: Requirements, implementation and strategic opportunities DORA Regulation – what you definitely didn’t know Before you read on: In this article
WiFi Sensing has gained considerable importance in recent years – not only in research, but also in real-world applications. The ability to analyze Wi-Fi signals to detect movements and activities is not only interesting for smart home and security applications. Intelligence services have also recognized that this technology is a powerful tool for covert surveillance But how exactly does this work? And how do we use these technologies in the context of penetration testing
WiFi Sensing is based on the analysis of Channel State Information (CSI)which is included in modern WLAN protocols such as IEEE 802.11n/ac.
A simplified example:
A person moves in a room with active WiFi. The reflections of the signal on the person cause specific patterns in the CSI data that can be analyzed and interpreted
use intelligence services WiFi Sensing especially for covert surveillance in situations where the use of cameras or other sensors would be too conspicuous. Typical applications include:
The big advantage: Wi-Fi is ubiquitousIn contrast to traditional surveillance methods, WiFi Sensing does not require special sensors or cameras – the existing WiFi signal is sufficient.
The Physical Assessments we use similar techniques to penetrate security-critical areas and uncover vulnerabilities:
Technical implementation:
A proof of concept (PoC) can be realized using a Raspberry Pi and a compatible Broadcom WiFi chip. Here are the basic steps:
Result: Movements or activities in the room cause clear patterns in the CSI data.
import matplotlib.pyplot as plt
import numpy as np
# Beispiel-Daten simulieren (in echt durch Nexmon extrahiert)
time = np.linspace(0, 10, 1000)
csi_data = np.sin(time) + np.random.normal(0, 0.1, len(time))
plt.plot(time, csi_data)
plt.title(‘Beispiel: CSI-Datenvisualisierung’)
plt.xlabel(‘Zeit (s)’)
plt.ylabel(‘Amplitude’)
plt.show()
Result: Movements or activities in the room cause clear patterns in the CSI data.
Complete protection against WiFi sensing is hardly possible because this technology is based on ubiquitous WiFi signals. Nevertheless, there are two sensible approaches to minimize the risks and even gain security benefits:
Use of technology for self-protection: Companies can actively use WiFi Sensing to detect potential security incidents, such as break-ins or unauthorized movements in security-critical areas. By analyzing the WiFi signals, activities can be monitored without having to install additional sensors.
Signal shielding in critical areas: In particularly sensitive environments – such as research departments or meeting rooms – care should be taken to ensure that WLAN signals are effectively shielded. This can render attacks based on WiFi sensing ineffective. This can be achieved, for example, through special structural measures such as Faraday cages or signal-blocking materials.
Instead of just acting reactively, companies can also use these technologies proactively to uncover security gaps and better protect themselves.
WiFi Sensing is not only a tool for intelligence services or research institutions. It also offers penetration testing and Physical Assessments a decisive advantage in making security gaps visible.
We show our customers how attackers can use modern technologies - and how to protect themselves against them. WiFi is everywhere. Let's use it correctly.
DORA Regulation: Requirements, implementation and strategic opportunities DORA Regulation – what you definitely didn’t know Before you read on: In this article
Pentest Budget 2025 for IT decision-makers: How to explain pentests & Co. to your management The planning of the Pentest Budget 2025 is
The one where we stole some cars – Cybersecurity Insights by Immanuel Bär “I gave them a get-out-of-jail-free card,” says
We use cookies, and Google reCAPTCHA, which loads Google Fonts and communicates with Google servers. By continuing to use our website, you agree to the use of cookies and our privacy policy.