Imagine RIT preview: How phones and laptops can be tracked via their radio waves

Learn how a Wi-Fi-connected smartphone or laptop can be tracked without the user’s knowledge at the Imagine RIT: Creativity and Innovation Festival on April 27.

A team of computing security students will demonstrate how the unique properties that exist in the radio waves of a wireless device can allow a third-party to single out, fingerprint and track that specific Wi-Fi device. Visitors to the exhibit, located in the Computer Zone in Golisano Hall atrium, can volunteer to see the unique fingerprint generated from their cell phone and learn how their privacy could be compromised, despite using advanced security protocols.

“We already see applications of similar tracking technologies in stores, theme parks, banks, hotels and other consumer-focused areas,” said Jason Puglisi, a fourth-year computing security major working on the project. “Our main goal is to raise awareness and encourage visitors to consider ways they are already being tracked today.”

At Imagine RIT, visitors can volunteer to connect their wireless devices to a trusted Wi-Fi network, including the secured RIT network. In less than a minute, the student team will use a software-defined radio (SDR) device to sniff encrypted wireless traffic of the user and identify unique properties in the radio waves of a volunteer’s device. Imperfections in the manufacturing process of common wireless devices creates these unique properties. A unique color or image will represent how the volunteer’s device could be easily distinguished from others.

The team notes that they will not be decrypting or recording any data from volunteer devices, associating generated fingerprints with individuals or commercializing the data in any way.

“Our goal is not to create a privacy-compromising scenario, but rather to demonstrate how easily a less-ethical party might create such a scenario,” said Puglisi, who is from Robbinsville, N.J.

The RIT research team showcasing how wireless devices can be tracked via radio waves, includes (from left) Adam Sowden, Ian Stubenbord, Jason Puglisi, Connor Egbert and Assistant Professor Hanif Rahbari.

The exhibit is based on the students’ capstone project, where they are gaining a better understanding of how device characteristics are exposed via their wireless signals and researching future search-and-rescue or military applications. As part of the project, the research team is creating a cheaper, more accessible and more widespread prototype to identify or track mobile wireless devices, compared to existing methods.

The team noted that a main privacy implication in daily routines is the tracking of wireless devices without consumer consent or knowledge–likely for commercial gain. Companies may track visitors who connect to the public Wi-Fi as they navigate a store, or perhaps as they visit different stores around a city. Researchers saw the first instances of this during the 2012 Olympics in London.

“While phone carriers already have other means of localizing every device connected to their networks, we may soon see tracking technologies in the hands of third-party businesses everywhere, no matter how small or large,” said Puglisi.

The project is being presented by Puglisi and fourth-year computing security students Connor Egbert, who is from Parkville, Md.; Ian Stubenbord, who is from East Aurora, N.Y.; and Adam Sowden, who is from West Greenwich, R.I. Advising the team is Hanif Rahbari, an assistant professor of computing security.

While a few fingerprinting prevention and obfuscation techniques have been proposed in academia, they are not yet commercialized. Due to the passive nature of this fingerprinting and broadcast nature of wireless communications, researchers say it could be difficult to prevent radio wave-based tracking in the real-world.

“Among other things, this project aims at developing a prototype of a fingerprinting device, paving the way for future research on prevention and obfuscation techniques,” said Rahbari.

To help solve cybersecurity problems like this and address the critical workforce needs in cybersecurity, RIT has announced the creation of a Global Cybersecurity Institute. The new three-story facility will allow RIT to address the global cybersecurity crisis by conducting groundbreaking research, education and professional training and development. It is expected to open in summer 2020, with new institute director, and will be the first facility of its kind in upstate New York.

To learn more about Imagine RIT and plan your day for April 27, go to rit.edu/imagine.