Noisy Networks, Nosy Neighbors: Inferring Privacy Invasive Information from Encrypted Wireless Traffic

TL;DR

This work demonstrates that a passive observer behind a wall can infer privacy-sensitive information from encrypted wireless traffic in a smart home. By combining RSSI-based localization, device fingerprinting from WiFi and BLE metadata, and activity inference from traffic patterns, the study reconstructs which devices are present, their states, approximate room locations, and inhabitants' daily routines, including probe-request-derived context. The multi-stage approach reveals that multimedia devices yield the strongest signals for human activity recognition, and even a guest presence can be detected through new device appearances and traffic patterns. The findings highlight substantial privacy risks in smart home deployments and call for defenses against side-channel leakage in encrypted wireless communications.

Abstract

This thesis explores the extent to which passive observation of wireless traffic in a smart home environment can be used to infer privacy-invasive information about its inhabitants. Using a setup that mimics the capabilities of a nosy neighbor in an adjacent flat, we analyze raw 802.11 packets and Bluetooth Low Energy advertisemets. From this data, we identify devices, infer their activity states and approximate their location using RSSI-based trilateration. Despite the encrypted nature of the data, we demonstrate that it is possible to detect active periods of multimedia devices, infer common activities such as sleeping, working and consuming media, and even approximate the layout of the neighbor's apartment. Our results show that privacy risks in smart homes extend beyond traditional data breaches: a nosy neighbor behind the wall can gain privacy-invasive insights into the lives of their neighbors purely from encrypted network traffic.

Figures (49)

• Figure 1: Visualization of all channels in a 2.4 GHz spectrum with 20 MHz channel width.
• Figure 2: Distribution of used channels in a routers vicinity. Each unique color represents a different WiFi router. The width of each shape describes the channel width, the narrower being 20 MHz and the wider being 40 MHz.
• Figure 3: Radiotap Header of a 802.11n frame viewed in Wireshark.
• Figure 4: Communication workflow between two devices, routed through two relays. Big arrow from device A to D represents the higher level IP traffic. The values for TA/RA changes at every node, whereas SA/DA remains constant.
• Figure 5: General 802.11n frame format. Adopted from 9363693.