SpyDir: Spy Device Localization Through Accurate Direction Finding

TL;DR

This paper tackles the privacy risks posed by covert spy IoT cameras by enabling accurate localization from their unintentional electromagnetic emanations. It introduces SpyDir, a system that combines a portable switching-antenna array, a time-offset based noise decorrelation scheme, and a sparse-optimization AoA estimator to achieve high-precision 2D localization in multipath indoor environments. The approach yields an average AoA error of approximately $6.30^ ext{o}$ and a mean localization error of about $19.86$ cm, outperforming state-of-the-art baselines by large margins. The work demonstrates practical feasibility, robustness across device types, and potential for open-sourcing hardware and software to foster reproducibility and further research in emanation-based localization.

Abstract

Hidden spy cameras have become a great privacy threat recently, as these low-cost, low-power, and small form-factor IoT devices can quietly monitor human activities in the indoor environment without generating any side-channel information. As such, it is difficult to detect and even more challenging to localize them in the rich-scattering indoor environment. To this end, this paper presents the design, implementation, and evaluation of SpyDir, a system that can accurately localize the hidden spy IoT devices by harnessing the electromagnetic emanations automatically and unintentionally emitted from them. Our system design mainly consists of a portable switching antenna array to sniff the spectrum-spread emanations, an emanation enhancement algorithm through non-coherent averaging that can de-correlate the correlated noise effect due to the square-wave emanation structure, and a multipath-resolving algorithm that can exploit the relative channels using a novel optimization-based sparse AoA derivation. Our real-world experimental evaluation across different indoor environments demonstrates an average AoA error of 6.30 deg, whereas the baseline algorithm yields 21.06 deg, achieving over a 3.3 times improvement in accuracy, and a mean localization error of 19.86cm over baseline algorithms of 206.79cm (MUSIC) and 294.75cm (SpotFi), achieving over a 10.41 times and 14.8 times improvement in accuracy.

Figures (15)

• Figure 1: SpyDir (right) can accurately locate a spy camera in just two steps, where it can sniff and derive the emanation direction through AoA estimation and further accurately localize the spy camera. Unlike traditional systems (left), which need you to scan multiple locations to detect and coarsely locate the spy camera based on the camera's thermal noise, wireless communication traffic, or laser-based sensing, etc.
• Figure 2: Autocorrelation of an emanation signal showing clear harmonics of the device’s internal clock.
• Figure 3: The workflow of SpyDir consists of three modules: the switched-antenna array module, the detection enhancement module, and the AoA estimation and localization module.
• Figure 4: SpyDir consists of the RF switch, SDR, control PCB, and an antenna array.
• Figure 5: Noise cross-correlation between the switched antenna and the reference antenna, measured in an anechoic chamber. With no external signals present, the received samples contain only hardware and environmental noise, revealing strong noise correlation across antennas.