WaveDigger: Dig into wireless signals to discover their physical locations

https://github.com/christianrowlands/wavedigger

Comments

lumaSep 24, 2026, 6:00 PM
Looks like an open version of SkyHook from way back in 2003: https://en.wikipedia.org/wiki/Skyhook_Wireless

For a while they had a paid program, I had a Windows Mobile app I could run with an external GPS dongle that would record wifi APs and location, upload to skyhook, who would occasionally cut me a check for my trouble. I made tens of dollars!

MashimoSep 24, 2026, 7:53 PM
Ohhh, there was money to be made with war driving? I just got points on a German bb forum.
newtwentysixSep 25, 2026, 5:26 AM
Wow! That reminded me of an interesting article in NYT about Skyhook wirless.

https://www.nytimes.com/2009/06/01/technology/start-ups/01lo...

drnick1Sep 24, 2026, 5:26 PM
I started rotating my BSSID weekly after I learned Apple and Google abused it to track the location of people and devices.

Permanent hardware or software IDs, such as the Windows GUID or machine-id on Linux (systemd) are inevitably abused for surveillance sooner or later.

S0undSep 24, 2026, 5:42 PM
You have all the good intentions, but since no one else does this around your location, I don't think you're achieving anything.
XorNotSep 24, 2026, 10:12 PM
The same physical location showing a different SSID every week but the surrounding ones not changing would be deanonymizing you much more aggressively.

People mostly don't change SSIDs or even move networking hardware - e.g. AirBnBs.

Edit: and also are you still carrying a smart phone while doing this? The device which has GPS and a cloud internet connection?

astrangeSep 24, 2026, 9:15 PM
You mean, they used it so people trying to use their maps apps didn't have to wait several minutes for a cold GPS fix?
gpmSep 25, 2026, 12:58 AM
> wait several minutes for a cold GPS fix

My phone doesn't take several minutes to get a GPS fix even when I'm in the middle of nowhere well beyond the range of cell towers let alone wifi routers...

I understand that in theory it could if it had no clue what time it was either for some reason... but in practice we're talking seconds (though more than 2) not minutes.

Fabricio20Sep 25, 2026, 1:18 AM
I feel like that's not a true cold GPS signal! Though I'm not arguing the parents scenario is realistic either. I got a GPS module for a drone I was building and it took 20 minutes to get a proper GPS lock from cold!!! I was sitting there watching betaflight doing it's thing wondering why the heck it takes so long when there's so many satellites in view!
gpmSep 25, 2026, 1:27 AM
You're right that it's not a true cold GPS signal. I've connected to the network in the last 180 days (and thus have information on satellite information), I have a rough clock (time within 20s or so). The phone probably assumes it's closeish to where it last turned on. Etc.

It is the realistic scenario that people would face without using WiFi routers or cell towers though. True cold fixes aren't something phones need to deal with basically ever.

15155Sep 25, 2026, 8:54 AM
It doesn't need to be a cold GPS signal, it only needs to be one that doesn't track you. Your drone doesn't have access to the internet to do the almanac and ephemeris download, that's the difference.

Aiding the fix by obtaining data from a faster unidirectional source (instead of satellite to device, it's just internet to device) doesn't reveal anything private, unlike mass-capture of WiFi (B)SSIDs.

Also, I would look into the quality of the GPS radio and antenna you are using - $95 u-blox modules will get an RTK-quality fix without outside assistance in minutes.

05Sep 25, 2026, 9:11 AM
20minutes just means a shitty module or lots of ~1.3ghz noise (e.g. from dji o3/o4 or gopro cpu), although bad input filtering and gps located near an antenna could saturate the amplifier even with antenna on a different frequency. 1min is typical for cold fixes but you can make it faster by uploading ephemeris/cache using AssistNow (valid for about a month).
skinfaxiSep 24, 2026, 8:58 PM
How do you coordinate across all of your devices?
anigbrowlSep 24, 2026, 6:12 PM
Isn't this just wha WIGLE does?
jcimsSep 24, 2026, 6:46 PM
Basically except it's using an Apple service for the backend.

Which will likely get cut off at some point.

mcculleySep 24, 2026, 7:46 PM
Why would it be cut off? Doesn’t Apple use this on devices?
RockRobotRockSep 25, 2026, 11:11 PM
They can always add some obfuscation/hardware attestation bullshit to make it harder to scrape.
OptionOfTSep 25, 2026, 6:00 PM
Apple says you can opt out of this collection by appending _nomap to the SSID:

https://support.apple.com/en-us/102515

> The owner of a Wi-Fi access point can opt it out of Apple's Location Services by changing the access point's SSID (name) to end with "_nomap." For example, "Access_Point" would be changed to "Access_Point_nomap."

bryancoxwellSep 25, 2026, 1:04 AM
Worth noting that the coordinates for cell towers returned by the WLOC API are coarse enough to be just about useless for locating towers. For APs it’s much better but still not great.
imageticSep 25, 2026, 6:08 PM
I had an an interference issue with a logitech mouse on my desk so I asked Pi to take a look. Next thing I knew I'm in the macOS sdk measuring all the wireless devices at my desk. That was the coolest experience to date. I could see everything in our house in RF.
totetsuSep 24, 2026, 11:17 PM
This talk seems to give a good introduction to bssid https://www.youtube.com/watch?v=hlbjUvkoyBA
oulipoSep 24, 2026, 4:45 PM
Interesting, wondering why Apple doesn't restrict the queries to its server using a certificate that would be pinned on the devices, etc, so at least you would need a legit iPhone/Mac to be able to do a query?
mcculleySep 24, 2026, 7:56 PM
Are you imagining some certificate unique to each device? What would prevent someone copying it?
oulipoSep 25, 2026, 8:58 PM
This is quite common, you add the private key to some secure hardware module, so that only that device can sign using the certificate, and then use TLS to connect
mcculleySep 25, 2026, 10:52 PM
I get that this is how iMessage works, as I understand it. I am wondering what tradeoffs make Apple decide to use the Secure Enclave versus more mundane certificate infrastructure and how they would make it hard for us to get at this with a debugger if they chose that route.
BobbyTables2Sep 25, 2026, 2:43 AM
I don’t think Apple would have much trouble burying a certificate and key in a IOS device that would be very hard to access.
doublerabbitSep 24, 2026, 4:13 PM
Cool. This'll go nicely with my hackslab and tinfoil hat upgrade.
4d4mSep 26, 2026, 10:34 PM
This is awesome
WorseIsBetterSep 25, 2026, 9:37 AM
[dead]