3 ms·

This seems to be adding noise in the spatial dimension. However, we know that it's possible to remove added noise using statistical methods, so observers using

This seems to be adding noise in the spatial dimension. However, we know that it's possible to remove added noise using statistical methods, so observers using passive RF monitoring may eventually adapt their algorithms. Ultimately, TEMPEST-like and illumination threats require shielding, and that's expensive in building materials and work. If this became sophisticated enough though, it could be used to simulate false positives, so simulate human presence in a room, throw off the observer or create unreliable evidence. Those are useful counter-surveillance capabilities on their own.

wolverine876 4y ago
> it's possible to remove added noise using statistical methods How do the economics work out on the measures and countermeasures? I would guess that not all noise costs the same to remove.
- nonrandomstring 4y ago
  It's a cat and mouse game as you probably surmise. What the surveillant wants is a clear signal with features corresponding to known information. The surveilee tries to send noise that most closely mimics those features, so the signal is lost in, and cannot be separated from, that noise. The adversaries each try to find a space unknown to the other (much like cryptography - cryptanalysis) (and undiscoverable by the other in a viable timeframe/information set) For example, speech was traditionally though to be well masked by white noise. But modern filter technology makes short work of removing broadband noise even if the signal is fully buried in it. Instead we now use speech-like fragments as an adversarial mask, as close to the speaker's spectrum and timing as possible. In terms of computational cost it's not a big deal. If it _can_ be removed it probably can in real-time by a well equipt agent.
  - transpute 4y ago
    Is there a Metasploit equivalent for wireless cat-and-mouse games? If not, what would it take to start one, e.g. live CD with pre-configured GNU radio code/plugins that is compatible with low-cost and USRP SDRs? An awesome-wifi-sensing list could be a starting point for aggregation of OSS projects.
    - nonrandomstring 4y ago
      I've no doubt you can do all the necessary number crunching in Octave/Matlab to implement things like a time-domain reflectometer - the DSP is well known in domains like seismology for prospecting, artillery ranging and calculating room shape from sound, as with the image source method. I think the hard part for an amateur lab is antenna stuff. I am not an RF engineer, nor have I read the linked papers in detail, but I'm guessing that to do this well you need phased arrays or multiple directed YAGI style elements - because all the methods I know from acoustics use multiple microphones, often closely calibrated etc.
      - transpute 4y ago
        There's 1000+ papers on attackers using Wi-Fi sensing, but almost none on defenses, https://scholar.google.com/scholar?cites=4354757827101869878 https://scholar.google.com/scholar?cites=4354757827101869878 Wi-ESP is an OSS project for Wi-Fi sensing with low-cost ESP32 devices, https://wrlab.github.io/Wi-ESP/ https://wrlab.github.io/Wi-ESP/ & https://academic.oup.com/jcde/article/7/5/644/5837600 https://academic.oup.com/jcde/article/7/5/644/5837600
transpute 4y ago
Counter-measures project, https://github.com/ansresearch/csi-murder/ https://github.com/ansresearch/csi-murder/ > The experimental results obtained in our laboratory show that the considered localization method (first proposed in an MSc thesis) works smoothly regardless of the environment, and that adding random information to the CSI mess up the localization, thus providing the community with a system that preserve location privacy and communication performance at the same time. Have you seen any public code or papers on counter-counter-measures, i.e. noise removal?
- nonrandomstring 4y ago
  Not for this RF application, no. I'm basing my remarks on what I know from audio/acoustics, where noise removal is pretty much grist for the mill in telecoms, forensic acoustics, medical instrumentation, cleaning up recordings etc. Take a look at Wiener and Kalman filters, blind deconvolution, warped polynomials... indeed there's a great many approaches.

wolverine876 4y ago

> it's possible to remove added noise using statistical methods How do the economics work out on the measures and countermeasures? I would guess that not all noise costs the same to remove.

nonrandomstring 4y ago
It's a cat and mouse game as you probably surmise. What the surveillant wants is a clear signal with features corresponding to known information. The surveilee tries to send noise that most closely mimics those features, so the signal is lost in, and cannot be separated from, that noise. The adversaries each try to find a space unknown to the other (much like cryptography - cryptanalysis) (and undiscoverable by the other in a viable timeframe/information set) For example, speech was traditionally though to be well masked by white noise. But modern filter technology makes short work of removing broadband noise even if the signal is fully buried in it. Instead we now use speech-like fragments as an adversarial mask, as close to the speaker's spectrum and timing as possible. In terms of computational cost it's not a big deal. If it _can_ be removed it probably can in real-time by a well equipt agent.
- transpute 4y ago
  Is there a Metasploit equivalent for wireless cat-and-mouse games? If not, what would it take to start one, e.g. live CD with pre-configured GNU radio code/plugins that is compatible with low-cost and USRP SDRs? An awesome-wifi-sensing list could be a starting point for aggregation of OSS projects.
  - nonrandomstring 4y ago
    I've no doubt you can do all the necessary number crunching in Octave/Matlab to implement things like a time-domain reflectometer - the DSP is well known in domains like seismology for prospecting, artillery ranging and calculating room shape from sound, as with the image source method. I think the hard part for an amateur lab is antenna stuff. I am not an RF engineer, nor have I read the linked papers in detail, but I'm guessing that to do this well you need phased arrays or multiple directed YAGI style elements - because all the methods I know from acoustics use multiple microphones, often closely calibrated etc.
    - transpute 4y ago
      There's 1000+ papers on attackers using Wi-Fi sensing, but almost none on defenses, https://scholar.google.com/scholar?cites=4354757827101869878 https://scholar.google.com/scholar?cites=4354757827101869878 Wi-ESP is an OSS project for Wi-Fi sensing with low-cost ESP32 devices, https://wrlab.github.io/Wi-ESP/ https://wrlab.github.io/Wi-ESP/ & https://academic.oup.com/jcde/article/7/5/644/5837600 https://academic.oup.com/jcde/article/7/5/644/5837600

transpute 4y ago

Counter-measures project, https://github.com/ansresearch/csi-murder/ https://github.com/ansresearch/csi-murder/ > The experimental results obtained in our laboratory show that the considered localization method (first proposed in an MSc thesis) works smoothly regardless of the environment, and that adding random information to the CSI mess up the localization, thus providing the community with a system that preserve location privacy and communication performance at the same time. Have you seen any public code or papers on counter-counter-measures, i.e. noise removal?

nonrandomstring 4y ago
Not for this RF application, no. I'm basing my remarks on what I know from audio/acoustics, where noise removal is pretty much grist for the mill in telecoms, forensic acoustics, medical instrumentation, cleaning up recordings etc. Take a look at Wiener and Kalman filters, blind deconvolution, warped polynomials... indeed there's a great many approaches.