Wi-Fi sniffing lets researchers take social snapshots of crowds

Researchers at Italy's Sapienza – Università di Roma have used Wi-Fi probe requests from smartphones to take a social snapshot of large gatherings of people.

The researchers, in a paper (PDF) submitted to Internet Measurement Conference 2013, spent three months collecting the probes emitted by smartphones and other Wi-Fi-enabled devices as they seek a wireless network to connect to. Over three months they collected more than 11 million probes from close to 165,000 individual devices.

Wi-Fi client devices can seek a wireless network to connect to through active or passive scanning for 'beacons' broadcast by access points. Smartphones typically use active scanning, which means they switch on their wireless radio for a brief period to send a probe request and receive information about networks within range. The operating systems of wireless devices can include a preferred network list (PNL), which incorporates some of the SSIDs of Wi-Fi networks the device has previously successfully connected to, and some devices will include this information in their probe requests.

Intercepting probe requests is a trivial exercise, with the researchers using a handful of notebooks and a wireless antenna. Ascertaining the vendor of a wireless client was a simple case of matching the first three bytes of a device's MAC address to the IEEE Public OUI list.

The research revealed disparities in the devices which incorporated PNLs in their probe requests. In the device breakdown, BlackBerry devices were found to most commonly disclose part of their PNL; 92 per cent of the devices revealed a portion of their PNL, followed by HTC (55 per cent), Sony (35 per cent), Apple (35 per cent), Samsung (31 per cent) and Nokia (13 per cent).

Having sniffed SSIDs of networks devices had previously connected to, the researchers – Marco V. Barbera, Alessandro Epasto, Alessandro Mei, Vasile C. Perta, and Julinda Stefa – were able to conduct statistical analyses of the networks' names.

"We can regard the PNL of a device as a list of significant places visited by the user—significant enough that the user spent some time to connect to the access point. Therefore, the fact that two users share one or more SSIDs in the PNL of their devices should intuitively provide some information on the existence of a social relationship between the two," the paper states.

The researchers were able to compare network SSIDs by language, giving an indication of the international composition of a crowd, as well as by device brand, which can be used as an indication of the socioeconomic status of a group.

For example, the higher penetration of Apple devices at a meeting of the conservative Popolo della Lib-ertà compared to a meeting of the progressive Movimento Cinque Stelle is a good indication of the relative wealth of their respective constituencies.

However, the paper states there room for more research in area; for example, mapping SSIDs in devices' PNL in a particular area to a crowdsourced geographic database of network names, which may lay bare in even more depth the social connections of a crowd, such as whether they work together.