15 ms·

Count the people around you by monitoring wifi signals

492 points by captn3m0 8y ago

markovbot 8y ago
I thought I remembered schollz (the GitHub user that this is under) from something else, and sure enough, I did! They did another interesting thing with wifi that I believe I discovered from hackernews years ago (appears to have evolved somewhat since then): https://github.com/schollz/find3 https://github.com/schollz/find3
macthrow 8y ago
I've been researching and working with this for some years now. There's a lot of stuff that can interfere with the quality/accuracy of the numbers (e.g. MAC randomization). I found out that there's also various ways to circumvent and improve upon those problems.
- justsomeguy1981 8y ago
  If you have found a way to circumvent the latest iPhone MAC randomisation I would be very very interested to talk to you.
Cynddl 8y ago
Although there is a remark about the potential legal issues in the US, it should also be noted that capturing and storing MAC addresses without explicit consent is not GDPR compliant, and not legal in Europe.
- hathawsh 8y ago
  Interesting. What if I own a shop and I want to use this technique to graph the number of people near my shop over time? Would I be in the clear if I hash the MAC addresses?
  - komali2 8y ago
    The operative word being "collect," the second being "store," what you do between those steps is not really relevant. In other words: no, you probably will not be in the clear. https://iapp.org/news/a/what-the-gdpr-will-mean-for-companies-tracking-location/ https://iapp.org/news/a/what-the-gdpr-will-mean-for-companie...
    - thfuran 8y ago
      Operations before storage don't avoid any legal issues around the collection, but they certainly can obviate legal issues with storing the data. For example, if you 'hashed' them with an algorithm that always yield 0, you'd surely be in the clear as far as the storage goes. Probably you'd still be fine if the output of the hash was 1 bit. I don't know whether you'd still be in the clear for more common hash algorithms.
    - jcoffland 8y ago
      Storing the hash is not the same as storing the actual data.
      - tantalor 8y ago
        The hash of PII is still PII.
- eeeeeeeeeeeee 8y ago
  Couldn't almost any WiFi router, and thus the user of that router, then be in violation of GDPR simply by logging which MAC addresses attempt to connect to that router? Even connections by accident (selecting the wrong SSID). I know my Netgear router has a history of basically any connection attempts and their MAC address; it does this by default, not sure I can even turn it off. And how would you even present a GDPR notice to the user prior to logging that kind of information?
  - matte_black 8y ago
    No one said GDPR was well thought out.
  - lccarrasco 8y ago
    Depends if you can argue successfully that a MAC Address is Personal Data or not.
  - casylum 8y ago
    Sticker on the window? There is an issue with retailers tracking shoppers movements in a store. FTC take on the issue: https://www.ftc.gov/news-events/blogs/techftc/2015/04/privacy-trade-offs-retail-tracking https://www.ftc.gov/news-events/blogs/techftc/2015/04/privac...
  - jhonkola 8y ago
    No. Wifi router needs the MAC address in order to provide a service to the user, thus it is allowed to collect the MAC. GDPR allows collecting personally identifying information if it is necessary for providing the service.
- tastroder 8y ago
  Would you mind explaining that? I'm pretty certain doing this would get you in trouble with a range of other legislation around the EU and put you in line with similar PR nightmares in the past but I don't really see how MAC addresses alone would be covered by the GDPR (at least not in the text/precedence I'm aware of).
- tombrossman 8y ago
  Not legal in Europe? That's a bold claim, can you cite any documentation please? I'm in Europe and I know of many local shops, plus at least two pub chains that do this right now. The pub chains are registered with our Information Commissioners office and I am struggling to understand how every one of those people (including the ICO!) could have missed this. I note Bluetooth also uses MAC addresses, so this issue is not limited to WiFi. Spoofing your WiFi MAC on a mobile phone with Bluetooth may not be making you as anonymous as you hope to be.
  - Cynddl 8y ago
    The ICO addresses the issue of MAC addresses in: https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data-1-0.pdf https://ico.org.uk/media/for-organisations/guide-to-the-gene... > A business uses Wi-Fi analytics data to count the number of visitors per hour across different retail outlets. It is not necessary to know whether an individual has visited an individual store (or multiple stores) before. > This involves the business processing the Media Access Control (MAC) addresses of mobile devices that broadcast probe requests to its public Wi-Fi hotspots. MAC addresses are intended to be unique to the device (although they can be modified or spoofed using software). > If an individual can be identified from that MAC address, or other information in the possession of the network operator (the business, in this example), then the data is personal data. Indeed, collecting unique MAC addresses, potentially from multiple endpoints, can reveal a lot of personal, sensitive, information (location, trips, time you go to the coffee shop or which hospital you visit, etc.). The only ways to properly collect and store MAC addresses are either using privacy-protecting methods (e.g. cutting the last bits of the MAC address, potentially using bloom filters) or immediately aggregating the collected MAC addresses.
bjoli 8y ago
I did something similar using my jobs open network, a raspberry and nmap. I was able to correlate devices to people, and depending on which floor they were on they had different DHCP IP ranges. I then made a webpage out of it that let me see who was where. People changed devices too often and I was lazy, but if I could have figured out how to get people's hostnames I could probably make the process a lot simpler.
- chooseaname 8y ago
  Not the least bit creepy.
  - bjoli 8y ago
    I know, I know. To my defence it was more to see if it could be done than anything else. I have actually used the very same nmap technique in an argument with a "I have nothing to hide" coworker. It is a great example of how a simple concept like "I can see other devices connected to the network" can be transformed into "I can log who is at work when". This could be done with a $45 device. With $500 I could make something much more nefarious with regular arduinos.
    - brokenmachine 8y ago
      How would the arduinos make it more nefarious?
      - bjoli 8y ago
        Several devices,camera at the entrance, Bluetooth LE, not having to do obvious network monitoring. We have loads of good places to hide them, and I suspect they would go unnoticed for years
louismerlin 8y ago
I wrote a similar program 2+ years ago (it is very rough around the edges). I used ARP-scan to log and monitor the MAC addresses of the people on the network. Had a lot of fun at the time ! https://github.com/louismerlin/spydeer https://github.com/louismerlin/spydeer
jcfrei 8y ago
Thought about this too a while back. If I remember correctly the "issue" (actually I consider it a feature) with most modern smartphones is that they will randomly change their MAC address in order to prevent exactly this kind of tracking.
- crankylinuxuser 8y ago
  However, if your wifi is on and not connected to an AP, then you will broadcast mgmt frame pings with the correct MAC for all the networks you've been connected to. An enterprising hacker could submit those to wigle and figure out not only uniques, but also tell what geographical part of the world you're from. Nicer hackers share this for public knowledge on HN :-D (edit: really? -1'ed? How is this wrong? Would love to hear from detractors, as this technique is how malls and supermarkets track individual users.)
  - walterbell 8y ago
    iOS has sadly made it more difficult to disable WiFi in Control Center (turns back on after fixed time). I wonder if iOS12 Shortcuts could perform geofencing of WiFi.
  - rsync 8y ago
    "edit: really? -1'ed? How is this wrong?" No idea. I downvoted you because you complained about your downvotes. Don't interrupt the discussion to meta-discuss the scoring system.
    - crankylinuxuser 8y ago
      You mean, doing what your response is doing. How interesting.
- gkfasdfasdf 8y ago
  Do you have any idea how often they change? Like if you were only looking counts of distinct MAC addresses, could you shorten the listening window so that an individual phone would have the same address?
electriclove 8y ago
I carry 2 phones and use an iWatch. Will I register as 3 people?
- komali2 8y ago
  I'm sensing bold new avenues for Citizens United.
  - matt4077 8y ago
    “Yes, my plus-one is all of Microsoft. If corporations are people, corporation is person, my friend”
- jedberg 8y ago
  4 people, since it assumes 70% coverage. :)
renholder 8y ago
I did something similar[1] in C++ (on Windows - I know, I know...) but I feared that the rate of the scan requests could inadvertently cause me to be "interesting": even though I was only storing the IDs in memory - due to GDPR - which, from the wording of another comment[2], sounds like could still land me in trouble. It's interesting (and a bit frightening) to see just how many devices (e.g.: APs, mobile phones, dash cams, etc.) there are discoverable out in the wild. [1] - https://github.com/felsokning/Cpp/blob/master/Public.Cpp.Research/Public.Cpp.Research/WlanObtainBssids.cpp https://github.com/felsokning/Cpp/blob/master/Public.Cpp.Res... [2] - https://news.ycombinator.com/item?id=18932906 https://news.ycombinator.com/item?id=18932906
jasonhong 8y ago
Our research group also had a similar idea to this back in 2006, though looking at laptops (since this was before smartphones really took off). This was also before MAC randomization, as many other posters have pointed out. Here's our research paper if you're interested: http://cmuchimps.org/uploads/publication/paper/86/putting_people_in_their_place_an_anonymous_and_privacy_sensitive_approach_to_collecting_sensed_data_in_location_based_applications.pdf http://cmuchimps.org/uploads/publication/paper/86/putting_pe... Two ideas to consider for next steps, if you're interested. One is to crowdsource the data, to build out a map of places and how busy those places are. You would need to add in a lot of privacy mechanisms though, e.g. only sharing data of mostly public places vs homes. You could also build out a map of interesting places based on this (e.g. we used foursquare data in our past research to build out clusters of places, see http://livehoods.org/ http://livehoods.org/) Another is to estimate how busy a place really is based on traffic, in terms of #people, and #seats or #tables available. This could be especially useful for campuses (where is a good place to study?) or cafes. You might need some crowd-based approach to label ground truth, and it's unclear what the incentive would be. We did consider commercialization back in the day, but never came up with a plausible business model. It's not clear why business owners would want this, and they might even have an incentive to cheat. Though I would definitely say that cities would be interested in this data, e.g. urban planners or depts of public works. They have so little data about what is actually going on in a city. For example, we spoke with people who wanted to know the effects of closing a bridge or closing off a street.
- slig 8y ago
  > Another is to estimate how busy a place really is based on traffic, in terms of #people, and #seats or #tables available. This could be especially useful for campuses (where is a good place to study?) or cafes. You might need some crowd-based approach to label ground truth, and it's unclear what the incentive would be. Google Maps does that. Search for a popular cafe on your area and you should see the "Popular times" graph with live data.
  - copperx 8y ago
    I assume they do that by tracking how many Androids are at a given location; so that doesn't count those who are using iOS. Given Android's dominance though, not counting iOS devices might not be even skew the results significantly.
wstuartcl 8y ago
It would be worthwhile to also scan bluetooth discoverable devices and try to normalize the two for cases where: * you usually see entry and exits of both and can start to map them as "one" user. * you see only wifi entries and exists without corresponding bluetooth (maybe user usually has bluetooth turned off or is out of range of BT capture). * You see only BT with no corresponding wifi (user has discoverable bt but wifi off). The normalization is complicated as wifi/bt range are pretty different (unless you have hardware to extend the pickup for bt) -- but if you deal with a time window slide (and repeat event correlations) it should be possible.
arayh 8y ago
It sounds like a lot of people aren't too familiar with the "people counter". https://en.wikipedia.org/wiki/People_counter https://en.wikipedia.org/wiki/People_counter It's commonly used by some retail and shopping malls to "estimate" traffic and conversion. It's great for determining peak times and visit duration. This kind of technology has been commercialized for some time now.
- dpods 8y ago
  My wife manages a retail store and they use this tech to track sales conversions by the hour. Gross sales / Number of people walking in the store broken out by hour. Each conversion rate for each hour is tied back to the manager on duty for that hour so they can see how effectively the store is managed. They also take weather into account since that has a strong effect on foot traffic for an outdoor mall.
  - jen729w 8y ago
    Forgive me, but that sounds awful. Does she like this system? Genuinely curious if it works or if it just results in a pushy manager trying to get her numbers up?
    - __jal 8y ago
      Metric-driven automated employee tracking is everywhere. If you're a software engineer or similar at a tech company, be aware that you have a very cushy, unmonitored job by most comparisons. It isn't "just" Amazon warehouse employees and other low-paid folks. https://www.buzzfeed.com/jimwaterson/telegraph-workplace-sensors#.akZ8dQxp6V https://www.buzzfeed.com/jimwaterson/telegraph-workplace-sen...
      - politician 8y ago
        Manna is a short story about the future of metric-driven employment culture. http://marshallbrain.com/manna1.htm http://marshallbrain.com/manna1.htm
dom96 8y ago
I did something similar for macOS, my aim was to see how effective deauthing a router is (turns out it's incredibly effective, the readme has more details) and as a side effect the app shows a list of all WiFi traffic. It was a pretty fun project. 1 - https://github.com/dom96/deauther https://github.com/dom96/deauther
- msravi 8y ago
  The readme doesn't seem to say - how does one install/run it?
  - laumars 8y ago
    Looks like it was written in Nim. They will likely have a getting started guide: https://nim-lang.org/ https://nim-lang.org/
  - dom96 8y ago
    Uploaded a binary to make the usage a little easier. Haven't used it in a while but should work, give it a try: https://github.com/dom96/deauther/releases/download/v0.1.0/deauther_macosx_0.1.0.zip https://github.com/dom96/deauther/releases/download/v0.1.0/d...
- stcredzero 8y ago
  I find this interesting, because my old Apple Time Capsule was doing just fine for well over a year, especially when I changed settings to use only 5GHz and eschew all backwards compatibility. But a few months ago, I started having to occasionally reconnect machines on wifi. My wife's machine on the wired network isn't subject to this, either. I wonder if people in my apartment are experimenting with this.
  - angott 8y ago
    You should be able to see deauth packets in Wireshark, if you are curious, provided you can put your network card in monitor mode.
gregod 8y ago
There is also https://github.com/cyberman54/ESP32-Paxcounter https://github.com/cyberman54/ESP32-Paxcounter "Wifi & Bluetooth driven, LoRaWAN enabled, battery powered mini Paxcounter built on cheap ESP32 LoRa IoT boards"
rmoriz 8y ago
I'm currently monitoring for Wifi probes with a RPI 0W and external Alfa USB adapter. Interestingly, some parcel services use handheld barcode scanners that don't even try to randomize their MAC or hide their name. (German blog post https://blog.rolandmoriz.de/2019/01/08/eine-flasche-metadaten-2-wifi-probes/ https://blog.rolandmoriz.de/2019/01/08/eine-flasche-metadate... )
tzhenghao 8y ago
Sounds like this might just be more reliable than a tally counter [1] :) the future is here [1] - https://en.wikipedia.org/wiki/Tally_counter https://en.wikipedia.org/wiki/Tally_counter
ilovecaching 8y ago
Wrong thread :(
- usmannk 8y ago
  Did you comment on the wrong topic perhaps?
io_io 8y ago
A very common way of measuring traffic volumes is via bluetooth MAC address broadcasts. The Wisconsin DOT even makes the traffic counts derived from this data interactive and public: https://wisdot.maps.arcgis.com/apps/webappviewer/index.html?id=2e12a4f051de4ea9bc865ec6393731f8 https://wisdot.maps.arcgis.com/apps/webappviewer/index.html?...
- zachwill 8y ago
  Wow, had no idea about this. Thanks for sharing!
- acct1771 8y ago
  Interesting....evermore vehicles being BT enabled == traffic's always increasing?! Sounds like great job security for DOTs.
sorenjan 8y ago
It would be fun to connect several receivers and use multilateration to estimate positions and make a heat map over the local area.
guscost 8y ago
Disclaimer: I work at Density (https://www.density.io https://www.density.io) building an anonymous people counter. MAC address tracking is a good simple way to get an approximate number of people: it's very easy to install, it requires only a WiFi antenna, and the data is easy to translate into a count. However, there are privacy and legal concerns which have prompted phone vendors to obfuscate this data. And there can easily be zero (or more than one) broadcasted MAC address per human, even when filtering by OUI. Retailers have been using specialized "people count" technology like infrared break-beams, thermal cameras, and CCTV+CV systems for a long time. CCTV is the most accurate by far, but it's also commonly considered to be an invasive level of surveillance (and rightly so). It's also not particularly accurate in adverse situations. At Density, we looked at (and tried) many of these technologies - but ultimately found them lacking because they were either too invasive or too inaccurate. The device we've built uses a lower-resolution depth-only sensor because it can return extremely accurate results, without having the capability for facial recognition or other analysis techniques that are harmful to privacy. So far the technology is working very well - with an algorithm based on a deep-learning "human classifier" we're seeing accuracy above 99% in many of our deployments. Here's a cool (and in-progress, excuse our dust) summary of some issues that the technology has to navigate: https://faq.density.io/algo/ https://faq.density.io/algo/
- andonisus 8y ago
  The concerns you raise are true in corner cases, but the general use case should be good enough. Your solution also seems to require mounting one of your devices at the entryway of every room for which you wish to monitor occupancy. Seems like it could be costly, especially if doing so requires wiring power up to it.
  - guscost 8y ago
    That is the other side of our approach, yes. Active depth sensing and on-device deep learning means non-trivial power and speed requirements, so the hardware isn't as cheap as we'd like it to be. I'm not up to date with the latest developments on the hardware team, but they're working aggressively on our BOM and we're hoping to take advantage of cheaper and lower-power SIMD/GPU chips in the future. Our current-gen model works with Power over Ethernet, and right now we're most often selling to customers with large/valuable real-estate portfolios because they can get a higher ROI from accurate count data.
xyproto 8y ago
Great, now it's possible to create a "party detector" that will change the music and lights if there are enough people at home or in specific rooms.
- RPLong 8y ago
  Cool concept.
- spiznnx 8y ago
  > if there are enough people people ≥ 3, right? :)
- pbhjpbhj 8y ago
  Get raided by the police ... Clippy: "It looks like you're having a party, I'm switching on the disco lights and music."
  - kkarakk 8y ago
    i've seen twitch streamers get swatted and their viewers start their lights/play "fuck the police" via alexa via paid donation TTS software. this just removes one step in the process
jimmychangas 8y ago
> It may be illegal to monitor networks for MAC addresses, especially on networks that you do not own Isn't it odd that you can't read electromagnetic signals penetrating your walls without your consent?
- mehrdadn 8y ago
  Even collecting water falling on your roof is illegal in some places...
  - asdff 8y ago
    I think that's argued a little differently. Rain you collect from your roof is water removed from a watershed which has an impact on everything living in that environment. You aren't allowed to burn your trash in your yard and pollute the 'public' air either, for example.
    - abraae 8y ago
      Thank you for that explanation. Living on rain water, I have always thought those situations were barking mad, now I get it.
      - maxerickson 8y ago
        In the US it's because the water rights aren't attached to the property, not so much because of the environmental impact. That is, it's a rancher that is gonna get up in your business if you put in a rain barrel, not a cactus.
    - deleted 8y ago
      [deleted]
- adtac 8y ago
  *some electromagnetic signals of a particular frequency, which makes it odder!
- rhacker 8y ago
petercooper 8y ago
To avoid the privacy issues around MAC addresses, etc, is there any way to simply count the number of "variations" of signal in the area? So rather than having to process any data, you base your count on things like signal strength and other indicators of a "unique" signal?
voodoologic 8y ago
You can do this with airodump-ng I'm surprised it hasn't been mentioned. https://www.youtube.com/watch?v=e3XUcg0bhY4 https://www.youtube.com/watch?v=e3XUcg0bhY4
jaimex2 8y ago
Retailers and government do this, sometimes they track you as you move around. Pry-Fi is a great little app if you have an Android phone and root :D https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p... Basically just blasts thousands of MAC addresses into the air flooding their counters and ruining their data.
- pbhjpbhj 8y ago
  Which makes me wonder, how well does Wifi handle DoS via DHCP requests for an IP?
- oda 8y ago
  https://github.com/wi-fi-analyzer/mdk3-master https://github.com/wi-fi-analyzer/mdk3-master might be a better tool for the job
saadalem 8y ago
Do someone have a dataset about how do behave micro/radio waves when they interact with matter ?
zwarag 8y ago
Thats cool. I wanted to do something similar with ESP-8266 to track visitors in a tourist attraction I worked for. But as it turned out it was illegal by law because a law forbids to track people through "electromagnetism". As it turned out it the reason for the law was to not make it possible to track people in their apartments by registering wherever they where watching TV and similar stuff. We never wanted to track an individual person and would have hashed the MAC, nor did we want to get any data from them (phone brand or whatever). We wanted to be sure to not have more than 1000 people in the building (another law) and for security reasons we did not have turnstiles at the exit. At the end we had to use cameras that counted heads...
krick 8y ago
I wonder if there are any studies on how reliable this is, especially in a crowd. This can be very useful, but I see many ways how the assumption of "MAC addresses" = "people" can be broken: * As stated in the docs, not everyone has a phone, they estimate it being 70%, but I wonder how accurate this is in different regions for different crowd sizes and applications (cafe visitors vs a parade) * As stated in the comments, some individuals carry multiple WiFi capable devices and it can be much more than 1 per person * How large can a crowd get, before signals get jammed to a point this method stops being useful? * Many people prefer mobile data and sometimes even don't turn WiFi on So, I mean, it obviously can be used practically, but I struggle to estimate, how much should I believe what the device reads w/o actually seeing the crowd.
adanto6840 8y ago
I've long been curious why McDonalds (and the like) don't have automated license plate readers, similar in concept to people counters (though more invasive I suppose) on their drive-throughs. I'd think they could very quickly & automatically begin collecting data about income, repeat vs new customer, even streamlining the order process by recalling past orders or upselling, etc. It seems like an area that is incredibly ripe for data collection & analysis; I almost wonder if there isn't a business in here, selling this feature-set as as B2B service. For the record, I prefer not to be 'tracked' -- I don't know that I can realistically say it would actually impact my fast-food selections though. The concept does intrigue me nonetheless.
- maxerickson 8y ago
  I feel like fast food needs to stay focused on keeping the food they are serving fresh and on quick service. Those factors should completely swamp anything that can get teased out of reams of data.
- mattthebaker 8y ago
  When I was in China we saw this on many straight stretches of roads. Just watching.
- nexuist 8y ago
  Many people are apprehensive about being linked to their plates, even going as far as blacking them out in selfies etc. Given this apprehension (founded or unfounded), I doubt the increase in business would be worth the trade off in negative PR. I can't begin to imagine what the Wendy's twitter timeline would look like if the news broke that McD was storing your license plate in a database and correlating it with your income. Many of the ideas you suggested (recalling past orders, upselling) can easily be accomplished with existing smartphone technology. I've never used the McD app so I don't know if they utilize location tracking but if they do I can almost guarantee they are already checking to see which locations you visit the most, what you order, when you usually come in, whether you use the drive thru or not, etc. Even without location tracking they can still do all of that if you order online. tl;dr In my opinion they don't do this because they can already collect the data through less invasive means.
propogandist 8y ago
Does this get around MAC anonymization done by iOs and Android? Researchers have shown it can be defeated, but curious if this takes it into consideration
worldexplorer 8y ago
I could think of interesting use. In India currently mini Kumbh Mela(https://en.m.wikipedia.org/wiki/Kumbh_Mela https://en.m.wikipedia.org/wiki/Kumbh_Mela) is going on. Police and organisers can use this technique to estimate and monitor crowd. I bet they are already using sophisticated crowd monitoring techniques (https://tech.economictimes.indiatimes.com/news/technology/kumbh-mela-becomes-a-lab-for-tech-industry-to-study-crowd-management/51804234 https://tech.economictimes.indiatimes.com/news/technology/ku...) but more the merrier.
rainbowzootsuit 8y ago
The arpa-e SENSOR [1] program is working on several technologies for people counting for sake of doing Demand Controlled Ventilation (DCV)[2]. People counting is part of the ASHRAE 62.1 calculation [3] for demand controlled ventilation. Also, simple N>0 occupancy counting is useful for home HVAC system setbacks. I sat in an ASHRAE technical session presentation the other day about the program. All of the technology goals intend for the people count results to be anonymous, and for the technology to be "open source." Cost goals are <$0.06/ft^2 for residential and <0.08$/ft^2 for commercial systems. [1] https://arpa-e.energy.gov/?q=programs/sensor https://arpa-e.energy.gov/?q=programs/sensor [2] https://en.wikipedia.org/wiki/Demand_controlled_ventilation https://en.wikipedia.org/wiki/Demand_controlled_ventilation [3] https://ashrae.iwrapper.com/ViewOnline/Standard_62.1-2016 https://ashrae.iwrapper.com/ViewOnline/Standard_62.1-2016
doggydogs94 8y ago
Do most people have WiFi active on their phones? I usually leave WiFi off (nuisance factor), but maybe that’s just me.

492 points by captn3m0 8y ago

I thought I remembered schollz (the GitHub user that this is under) from something else, and sure enough, I did! They did another interesting thing with wifi that I believe I discovered from hackernews years ago (appears to have evolved somewhat since then): https://github.com/schollz/find3 https://github.com/schollz/find3

macthrow 8y ago

I've been researching and working with this for some years now. There's a lot of stuff that can interfere with the quality/accuracy of the numbers (e.g. MAC randomization). I found out that there's also various ways to circumvent and improve upon those problems.

justsomeguy1981 8y ago
If you have found a way to circumvent the latest iPhone MAC randomisation I would be very very interested to talk to you.

Cynddl 8y ago

Although there is a remark about the potential legal issues in the US, it should also be noted that capturing and storing MAC addresses without explicit consent is not GDPR compliant, and not legal in Europe.

hathawsh 8y ago
Interesting. What if I own a shop and I want to use this technique to graph the number of people near my shop over time? Would I be in the clear if I hash the MAC addresses?
- komali2 8y ago
  The operative word being "collect," the second being "store," what you do between those steps is not really relevant. In other words: no, you probably will not be in the clear. https://iapp.org/news/a/what-the-gdpr-will-mean-for-companies-tracking-location/ https://iapp.org/news/a/what-the-gdpr-will-mean-for-companie...
  - thfuran 8y ago
    Operations before storage don't avoid any legal issues around the collection, but they certainly can obviate legal issues with storing the data. For example, if you 'hashed' them with an algorithm that always yield 0, you'd surely be in the clear as far as the storage goes. Probably you'd still be fine if the output of the hash was 1 bit. I don't know whether you'd still be in the clear for more common hash algorithms.
  - jcoffland 8y ago
    Storing the hash is not the same as storing the actual data.
    - tantalor 8y ago
      The hash of PII is still PII.
eeeeeeeeeeeee 8y ago
Couldn't almost any WiFi router, and thus the user of that router, then be in violation of GDPR simply by logging which MAC addresses attempt to connect to that router? Even connections by accident (selecting the wrong SSID). I know my Netgear router has a history of basically any connection attempts and their MAC address; it does this by default, not sure I can even turn it off. And how would you even present a GDPR notice to the user prior to logging that kind of information?
- matte_black 8y ago
  No one said GDPR was well thought out.
- lccarrasco 8y ago
  Depends if you can argue successfully that a MAC Address is Personal Data or not.
- casylum 8y ago
  Sticker on the window? There is an issue with retailers tracking shoppers movements in a store. FTC take on the issue: https://www.ftc.gov/news-events/blogs/techftc/2015/04/privacy-trade-offs-retail-tracking https://www.ftc.gov/news-events/blogs/techftc/2015/04/privac...
- jhonkola 8y ago
  No. Wifi router needs the MAC address in order to provide a service to the user, thus it is allowed to collect the MAC. GDPR allows collecting personally identifying information if it is necessary for providing the service.
tastroder 8y ago
Would you mind explaining that? I'm pretty certain doing this would get you in trouble with a range of other legislation around the EU and put you in line with similar PR nightmares in the past but I don't really see how MAC addresses alone would be covered by the GDPR (at least not in the text/precedence I'm aware of).
tombrossman 8y ago
Not legal in Europe? That's a bold claim, can you cite any documentation please? I'm in Europe and I know of many local shops, plus at least two pub chains that do this right now. The pub chains are registered with our Information Commissioners office and I am struggling to understand how every one of those people (including the ICO!) could have missed this. I note Bluetooth also uses MAC addresses, so this issue is not limited to WiFi. Spoofing your WiFi MAC on a mobile phone with Bluetooth may not be making you as anonymous as you hope to be.
- Cynddl 8y ago
  The ICO addresses the issue of MAC addresses in: https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data-1-0.pdf https://ico.org.uk/media/for-organisations/guide-to-the-gene... > A business uses Wi-Fi analytics data to count the number of visitors per hour across different retail outlets. It is not necessary to know whether an individual has visited an individual store (or multiple stores) before. > This involves the business processing the Media Access Control (MAC) addresses of mobile devices that broadcast probe requests to its public Wi-Fi hotspots. MAC addresses are intended to be unique to the device (although they can be modified or spoofed using software). > If an individual can be identified from that MAC address, or other information in the possession of the network operator (the business, in this example), then the data is personal data. Indeed, collecting unique MAC addresses, potentially from multiple endpoints, can reveal a lot of personal, sensitive, information (location, trips, time you go to the coffee shop or which hospital you visit, etc.). The only ways to properly collect and store MAC addresses are either using privacy-protecting methods (e.g. cutting the last bits of the MAC address, potentially using bloom filters) or immediately aggregating the collected MAC addresses.

bjoli 8y ago

I did something similar using my jobs open network, a raspberry and nmap. I was able to correlate devices to people, and depending on which floor they were on they had different DHCP IP ranges. I then made a webpage out of it that let me see who was where. People changed devices too often and I was lazy, but if I could have figured out how to get people's hostnames I could probably make the process a lot simpler.

chooseaname 8y ago
Not the least bit creepy.
- bjoli 8y ago
  I know, I know. To my defence it was more to see if it could be done than anything else. I have actually used the very same nmap technique in an argument with a "I have nothing to hide" coworker. It is a great example of how a simple concept like "I can see other devices connected to the network" can be transformed into "I can log who is at work when". This could be done with a $45 device. With $500 I could make something much more nefarious with regular arduinos.
  - brokenmachine 8y ago
    How would the arduinos make it more nefarious?
    - bjoli 8y ago
      Several devices,camera at the entrance, Bluetooth LE, not having to do obvious network monitoring. We have loads of good places to hide them, and I suspect they would go unnoticed for years

louismerlin 8y ago

I wrote a similar program 2+ years ago (it is very rough around the edges). I used ARP-scan to log and monitor the MAC addresses of the people on the network. Had a lot of fun at the time ! https://github.com/louismerlin/spydeer https://github.com/louismerlin/spydeer

jcfrei 8y ago

Thought about this too a while back. If I remember correctly the "issue" (actually I consider it a feature) with most modern smartphones is that they will randomly change their MAC address in order to prevent exactly this kind of tracking.

crankylinuxuser 8y ago
However, if your wifi is on and not connected to an AP, then you will broadcast mgmt frame pings with the correct MAC for all the networks you've been connected to. An enterprising hacker could submit those to wigle and figure out not only uniques, but also tell what geographical part of the world you're from. Nicer hackers share this for public knowledge on HN :-D (edit: really? -1'ed? How is this wrong? Would love to hear from detractors, as this technique is how malls and supermarkets track individual users.)
- walterbell 8y ago
  iOS has sadly made it more difficult to disable WiFi in Control Center (turns back on after fixed time). I wonder if iOS12 Shortcuts could perform geofencing of WiFi.
- rsync 8y ago
  "edit: really? -1'ed? How is this wrong?" No idea. I downvoted you because you complained about your downvotes. Don't interrupt the discussion to meta-discuss the scoring system.
  - crankylinuxuser 8y ago
    You mean, doing what your response is doing. How interesting.
gkfasdfasdf 8y ago
Do you have any idea how often they change? Like if you were only looking counts of distinct MAC addresses, could you shorten the listening window so that an individual phone would have the same address?

electriclove 8y ago

I carry 2 phones and use an iWatch. Will I register as 3 people?

komali2 8y ago
I'm sensing bold new avenues for Citizens United.
- matt4077 8y ago
  “Yes, my plus-one is all of Microsoft. If corporations are people, corporation is person, my friend”
jedberg 8y ago
4 people, since it assumes 70% coverage. :)

renholder 8y ago

I did something similar[1] in C++ (on Windows - I know, I know...) but I feared that the rate of the scan requests could inadvertently cause me to be "interesting": even though I was only storing the IDs in memory - due to GDPR - which, from the wording of another comment[2], sounds like could still land me in trouble. It's interesting (and a bit frightening) to see just how many devices (e.g.: APs, mobile phones, dash cams, etc.) there are discoverable out in the wild. [1] - https://github.com/felsokning/Cpp/blob/master/Public.Cpp.Research/Public.Cpp.Research/WlanObtainBssids.cpp https://github.com/felsokning/Cpp/blob/master/Public.Cpp.Res... [2] - https://news.ycombinator.com/item?id=18932906 https://news.ycombinator.com/item?id=18932906

jasonhong 8y ago

Our research group also had a similar idea to this back in 2006, though looking at laptops (since this was before smartphones really took off). This was also before MAC randomization, as many other posters have pointed out. Here's our research paper if you're interested: http://cmuchimps.org/uploads/publication/paper/86/putting_people_in_their_place_an_anonymous_and_privacy_sensitive_approach_to_collecting_sensed_data_in_location_based_applications.pdf http://cmuchimps.org/uploads/publication/paper/86/putting_pe... Two ideas to consider for next steps, if you're interested. One is to crowdsource the data, to build out a map of places and how busy those places are. You would need to add in a lot of privacy mechanisms though, e.g. only sharing data of mostly public places vs homes. You could also build out a map of interesting places based on this (e.g. we used foursquare data in our past research to build out clusters of places, see http://livehoods.org/ http://livehoods.org/) Another is to estimate how busy a place really is based on traffic, in terms of #people, and #seats or #tables available. This could be especially useful for campuses (where is a good place to study?) or cafes. You might need some crowd-based approach to label ground truth, and it's unclear what the incentive would be. We did consider commercialization back in the day, but never came up with a plausible business model. It's not clear why business owners would want this, and they might even have an incentive to cheat. Though I would definitely say that cities would be interested in this data, e.g. urban planners or depts of public works. They have so little data about what is actually going on in a city. For example, we spoke with people who wanted to know the effects of closing a bridge or closing off a street.

slig 8y ago
> Another is to estimate how busy a place really is based on traffic, in terms of #people, and #seats or #tables available. This could be especially useful for campuses (where is a good place to study?) or cafes. You might need some crowd-based approach to label ground truth, and it's unclear what the incentive would be. Google Maps does that. Search for a popular cafe on your area and you should see the "Popular times" graph with live data.
- copperx 8y ago
  I assume they do that by tracking how many Androids are at a given location; so that doesn't count those who are using iOS. Given Android's dominance though, not counting iOS devices might not be even skew the results significantly.

wstuartcl 8y ago

It would be worthwhile to also scan bluetooth discoverable devices and try to normalize the two for cases where: * you usually see entry and exits of both and can start to map them as "one" user. * you see only wifi entries and exists without corresponding bluetooth (maybe user usually has bluetooth turned off or is out of range of BT capture). * You see only BT with no corresponding wifi (user has discoverable bt but wifi off). The normalization is complicated as wifi/bt range are pretty different (unless you have hardware to extend the pickup for bt) -- but if you deal with a time window slide (and repeat event correlations) it should be possible.

arayh 8y ago

It sounds like a lot of people aren't too familiar with the "people counter". https://en.wikipedia.org/wiki/People_counter https://en.wikipedia.org/wiki/People_counter It's commonly used by some retail and shopping malls to "estimate" traffic and conversion. It's great for determining peak times and visit duration. This kind of technology has been commercialized for some time now.

dpods 8y ago
My wife manages a retail store and they use this tech to track sales conversions by the hour. Gross sales / Number of people walking in the store broken out by hour. Each conversion rate for each hour is tied back to the manager on duty for that hour so they can see how effectively the store is managed. They also take weather into account since that has a strong effect on foot traffic for an outdoor mall.
- jen729w 8y ago
  Forgive me, but that sounds awful. Does she like this system? Genuinely curious if it works or if it just results in a pushy manager trying to get her numbers up?
  - __jal 8y ago
    Metric-driven automated employee tracking is everywhere. If you're a software engineer or similar at a tech company, be aware that you have a very cushy, unmonitored job by most comparisons. It isn't "just" Amazon warehouse employees and other low-paid folks. https://www.buzzfeed.com/jimwaterson/telegraph-workplace-sensors#.akZ8dQxp6V https://www.buzzfeed.com/jimwaterson/telegraph-workplace-sen...
    - politician 8y ago
      Manna is a short story about the future of metric-driven employment culture. http://marshallbrain.com/manna1.htm http://marshallbrain.com/manna1.htm

dom96 8y ago

I did something similar for macOS, my aim was to see how effective deauthing a router is (turns out it's incredibly effective, the readme has more details) and as a side effect the app shows a list of all WiFi traffic. It was a pretty fun project. 1 - https://github.com/dom96/deauther https://github.com/dom96/deauther

msravi 8y ago
The readme doesn't seem to say - how does one install/run it?
- laumars 8y ago
  Looks like it was written in Nim. They will likely have a getting started guide: https://nim-lang.org/ https://nim-lang.org/
- dom96 8y ago
  Uploaded a binary to make the usage a little easier. Haven't used it in a while but should work, give it a try: https://github.com/dom96/deauther/releases/download/v0.1.0/deauther_macosx_0.1.0.zip https://github.com/dom96/deauther/releases/download/v0.1.0/d...
stcredzero 8y ago
I find this interesting, because my old Apple Time Capsule was doing just fine for well over a year, especially when I changed settings to use only 5GHz and eschew all backwards compatibility. But a few months ago, I started having to occasionally reconnect machines on wifi. My wife's machine on the wired network isn't subject to this, either. I wonder if people in my apartment are experimenting with this.
- angott 8y ago
  You should be able to see deauth packets in Wireshark, if you are curious, provided you can put your network card in monitor mode.

gregod 8y ago

There is also https://github.com/cyberman54/ESP32-Paxcounter https://github.com/cyberman54/ESP32-Paxcounter "Wifi & Bluetooth driven, LoRaWAN enabled, battery powered mini Paxcounter built on cheap ESP32 LoRa IoT boards"

rmoriz 8y ago

I'm currently monitoring for Wifi probes with a RPI 0W and external Alfa USB adapter. Interestingly, some parcel services use handheld barcode scanners that don't even try to randomize their MAC or hide their name. (German blog post https://blog.rolandmoriz.de/2019/01/08/eine-flasche-metadaten-2-wifi-probes/ https://blog.rolandmoriz.de/2019/01/08/eine-flasche-metadate... )

tzhenghao 8y ago

Sounds like this might just be more reliable than a tally counter [1] :) the future is here [1] - https://en.wikipedia.org/wiki/Tally_counter https://en.wikipedia.org/wiki/Tally_counter

ilovecaching 8y ago

Wrong thread :(

usmannk 8y ago
Did you comment on the wrong topic perhaps?

io_io 8y ago

A very common way of measuring traffic volumes is via bluetooth MAC address broadcasts. The Wisconsin DOT even makes the traffic counts derived from this data interactive and public: https://wisdot.maps.arcgis.com/apps/webappviewer/index.html?id=2e12a4f051de4ea9bc865ec6393731f8 https://wisdot.maps.arcgis.com/apps/webappviewer/index.html?...

zachwill 8y ago
Wow, had no idea about this. Thanks for sharing!
acct1771 8y ago
Interesting....evermore vehicles being BT enabled == traffic's always increasing?! Sounds like great job security for DOTs.

sorenjan 8y ago

It would be fun to connect several receivers and use multilateration to estimate positions and make a heat map over the local area.

guscost 8y ago

Disclaimer: I work at Density (https://www.density.io https://www.density.io) building an anonymous people counter. MAC address tracking is a good simple way to get an approximate number of people: it's very easy to install, it requires only a WiFi antenna, and the data is easy to translate into a count. However, there are privacy and legal concerns which have prompted phone vendors to obfuscate this data. And there can easily be zero (or more than one) broadcasted MAC address per human, even when filtering by OUI. Retailers have been using specialized "people count" technology like infrared break-beams, thermal cameras, and CCTV+CV systems for a long time. CCTV is the most accurate by far, but it's also commonly considered to be an invasive level of surveillance (and rightly so). It's also not particularly accurate in adverse situations. At Density, we looked at (and tried) many of these technologies - but ultimately found them lacking because they were either too invasive or too inaccurate. The device we've built uses a lower-resolution depth-only sensor because it can return extremely accurate results, without having the capability for facial recognition or other analysis techniques that are harmful to privacy. So far the technology is working very well - with an algorithm based on a deep-learning "human classifier" we're seeing accuracy above 99% in many of our deployments. Here's a cool (and in-progress, excuse our dust) summary of some issues that the technology has to navigate: https://faq.density.io/algo/ https://faq.density.io/algo/

andonisus 8y ago
The concerns you raise are true in corner cases, but the general use case should be good enough. Your solution also seems to require mounting one of your devices at the entryway of every room for which you wish to monitor occupancy. Seems like it could be costly, especially if doing so requires wiring power up to it.
- guscost 8y ago
  That is the other side of our approach, yes. Active depth sensing and on-device deep learning means non-trivial power and speed requirements, so the hardware isn't as cheap as we'd like it to be. I'm not up to date with the latest developments on the hardware team, but they're working aggressively on our BOM and we're hoping to take advantage of cheaper and lower-power SIMD/GPU chips in the future. Our current-gen model works with Power over Ethernet, and right now we're most often selling to customers with large/valuable real-estate portfolios because they can get a higher ROI from accurate count data.

xyproto 8y ago

Great, now it's possible to create a "party detector" that will change the music and lights if there are enough people at home or in specific rooms.

RPLong 8y ago
Cool concept.
spiznnx 8y ago
> if there are enough people people ≥ 3, right? :)
pbhjpbhj 8y ago
Get raided by the police ... Clippy: "It looks like you're having a party, I'm switching on the disco lights and music."
- kkarakk 8y ago
  i've seen twitch streamers get swatted and their viewers start their lights/play "fuck the police" via alexa via paid donation TTS software. this just removes one step in the process

jimmychangas 8y ago

> It may be illegal to monitor networks for MAC addresses, especially on networks that you do not own Isn't it odd that you can't read electromagnetic signals penetrating your walls without your consent?

mehrdadn 8y ago
Even collecting water falling on your roof is illegal in some places...
- asdff 8y ago
  I think that's argued a little differently. Rain you collect from your roof is water removed from a watershed which has an impact on everything living in that environment. You aren't allowed to burn your trash in your yard and pollute the 'public' air either, for example.
  - abraae 8y ago
    Thank you for that explanation. Living on rain water, I have always thought those situations were barking mad, now I get it.
    - maxerickson 8y ago
      In the US it's because the water rights aren't attached to the property, not so much because of the environmental impact. That is, it's a rancher that is gonna get up in your business if you put in a rain barrel, not a cactus.
  - deleted 8y ago
    [deleted]
adtac 8y ago
*some electromagnetic signals of a particular frequency, which makes it odder!
rhacker 8y ago

petercooper 8y ago

To avoid the privacy issues around MAC addresses, etc, is there any way to simply count the number of "variations" of signal in the area? So rather than having to process any data, you base your count on things like signal strength and other indicators of a "unique" signal?

voodoologic 8y ago

You can do this with airodump-ng I'm surprised it hasn't been mentioned. https://www.youtube.com/watch?v=e3XUcg0bhY4 https://www.youtube.com/watch?v=e3XUcg0bhY4

jaimex2 8y ago

Retailers and government do this, sometimes they track you as you move around. Pry-Fi is a great little app if you have an Android phone and root :D https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p... Basically just blasts thousands of MAC addresses into the air flooding their counters and ruining their data.

pbhjpbhj 8y ago
Which makes me wonder, how well does Wifi handle DoS via DHCP requests for an IP?
oda 8y ago
https://github.com/wi-fi-analyzer/mdk3-master https://github.com/wi-fi-analyzer/mdk3-master might be a better tool for the job

saadalem 8y ago

Do someone have a dataset about how do behave micro/radio waves when they interact with matter ?

zwarag 8y ago

Thats cool. I wanted to do something similar with ESP-8266 to track visitors in a tourist attraction I worked for. But as it turned out it was illegal by law because a law forbids to track people through "electromagnetism". As it turned out it the reason for the law was to not make it possible to track people in their apartments by registering wherever they where watching TV and similar stuff. We never wanted to track an individual person and would have hashed the MAC, nor did we want to get any data from them (phone brand or whatever). We wanted to be sure to not have more than 1000 people in the building (another law) and for security reasons we did not have turnstiles at the exit. At the end we had to use cameras that counted heads...

krick 8y ago

I wonder if there are any studies on how reliable this is, especially in a crowd. This can be very useful, but I see many ways how the assumption of "MAC addresses" = "people" can be broken: * As stated in the docs, not everyone has a phone, they estimate it being 70%, but I wonder how accurate this is in different regions for different crowd sizes and applications (cafe visitors vs a parade) * As stated in the comments, some individuals carry multiple WiFi capable devices and it can be much more than 1 per person * How large can a crowd get, before signals get jammed to a point this method stops being useful? * Many people prefer mobile data and sometimes even don't turn WiFi on So, I mean, it obviously can be used practically, but I struggle to estimate, how much should I believe what the device reads w/o actually seeing the crowd.

adanto6840 8y ago

I've long been curious why McDonalds (and the like) don't have automated license plate readers, similar in concept to people counters (though more invasive I suppose) on their drive-throughs. I'd think they could very quickly & automatically begin collecting data about income, repeat vs new customer, even streamlining the order process by recalling past orders or upselling, etc. It seems like an area that is incredibly ripe for data collection & analysis; I almost wonder if there isn't a business in here, selling this feature-set as as B2B service. For the record, I prefer not to be 'tracked' -- I don't know that I can realistically say it would actually impact my fast-food selections though. The concept does intrigue me nonetheless.

maxerickson 8y ago
I feel like fast food needs to stay focused on keeping the food they are serving fresh and on quick service. Those factors should completely swamp anything that can get teased out of reams of data.
mattthebaker 8y ago
When I was in China we saw this on many straight stretches of roads. Just watching.
nexuist 8y ago
Many people are apprehensive about being linked to their plates, even going as far as blacking them out in selfies etc. Given this apprehension (founded or unfounded), I doubt the increase in business would be worth the trade off in negative PR. I can't begin to imagine what the Wendy's twitter timeline would look like if the news broke that McD was storing your license plate in a database and correlating it with your income. Many of the ideas you suggested (recalling past orders, upselling) can easily be accomplished with existing smartphone technology. I've never used the McD app so I don't know if they utilize location tracking but if they do I can almost guarantee they are already checking to see which locations you visit the most, what you order, when you usually come in, whether you use the drive thru or not, etc. Even without location tracking they can still do all of that if you order online. tl;dr In my opinion they don't do this because they can already collect the data through less invasive means.

propogandist 8y ago

Does this get around MAC anonymization done by iOs and Android? Researchers have shown it can be defeated, but curious if this takes it into consideration

worldexplorer 8y ago

I could think of interesting use. In India currently mini Kumbh Mela(https://en.m.wikipedia.org/wiki/Kumbh_Mela https://en.m.wikipedia.org/wiki/Kumbh_Mela) is going on. Police and organisers can use this technique to estimate and monitor crowd. I bet they are already using sophisticated crowd monitoring techniques (https://tech.economictimes.indiatimes.com/news/technology/kumbh-mela-becomes-a-lab-for-tech-industry-to-study-crowd-management/51804234 https://tech.economictimes.indiatimes.com/news/technology/ku...) but more the merrier.

rainbowzootsuit 8y ago

The arpa-e SENSOR [1] program is working on several technologies for people counting for sake of doing Demand Controlled Ventilation (DCV)[2]. People counting is part of the ASHRAE 62.1 calculation [3] for demand controlled ventilation. Also, simple N>0 occupancy counting is useful for home HVAC system setbacks. I sat in an ASHRAE technical session presentation the other day about the program. All of the technology goals intend for the people count results to be anonymous, and for the technology to be "open source." Cost goals are <$0.06/ft^2 for residential and <0.08$/ft^2 for commercial systems. [1] https://arpa-e.energy.gov/?q=programs/sensor https://arpa-e.energy.gov/?q=programs/sensor [2] https://en.wikipedia.org/wiki/Demand_controlled_ventilation https://en.wikipedia.org/wiki/Demand_controlled_ventilation [3] https://ashrae.iwrapper.com/ViewOnline/Standard_62.1-2016 https://ashrae.iwrapper.com/ViewOnline/Standard_62.1-2016

doggydogs94 8y ago

Do most people have WiFi active on their phones? I usually leave WiFi off (nuisance factor), but maybe that’s just me.