I recently was sat in my University library, when I had a thought about the immense amount of tech around me. WAPs on the wall (and in the eduroam mesh network - there's probably hundreds for my uni alone), other students' devices, smart TVs in the meeting rooms, and computers on the reception desk. That's not to mention what I myself had on me - A laptop, tablet, a phone, two pairs of headphones and a bluetooth mouse. Slightly more than a normal person going about their day, but not by a mile. This prompted me to think about the BSSID tool currently available through Trinity, and the overall implications of the amounts of data flying around us in the EM spectrum. I remembered that WiGle offer an android app, so i installed it, booted it up, and discovered 167 radio signatures in my immediate vicinity. Absolutely heaps of data, available in an instant, that I can't see or touch. I was amazed, and that go me thinking about wardriving. So let's talk about it.

You don't need a van full of antennas to map the digital world anymore. In this article, I want to explore how I use simple Android applications to reveal the invisible infrastructure of our cities, what that data actually means, and the massive forensic implications behind the signals we all broadcast every day.

Classically, wardriving involved complex rigs: laptops, external GPS pucks, and high-gain antennas sticking out of car windows. While those setups still exist for deep packet capture, the barrier to entry has dropped significantly. Modern smartphones have incredibly sensitive radio antennas and precise GPS chips built-in.

I was using an app called WiGLE WiFi Wardriving (or sometimes generic "Network Stumbler" apps). These apps put the phone's wireless card into a scanning mode, logging every beacon frame it hears. The result is a real-time list of:

It turns a walk to the coffee shop into an intelligence gathering mission. You quickly realize that you're walking through a sea of radio signatures, not just the smell of a teenager burning their clutch out.

When the app populates that list, what are we looking at? The most critical piece of data isn't the name of the network ("Free_WiFi"), but the BSSID (Basic Service Set Identifier).

The BSSID is the MAC address of the wireless router. Unlike the network name, which can be changed, the BSSID is hard-coded into the hardware. It is a globally unique fingerprint for that specific device.

SSID:   Mom's WiFi
BSSID:  00:14:22:01:23:45  <-- The prize
RSSI:   -55 dBm            <-- Signal strength (Distance)
Chan:   6                  <-- Frequency Channel
Enc:    [WPA2-PSK-CCMP]    <-- Security Protocol

By logging the GPS coordinates where this unique fingerprint appears, we are effectively pinning that router to a map. Do this for a whole city, and you have a searchable index of every wireless device in the region.

This is where WiGLE (Wireless Geographic Logging Engine) comes in. It is a central repository for the world's wardriving effort. Users upload the capture files from their phones, and WiGle aggregates them into a global map.

It's a collaborative effort. My walk might fill in the blank spots on a street that hasn't been scanned in two years. Collectively, a living, breathing image of the world's radio signatures is built up.

This data is fascinating for hobbyists, but it can be crucial for investigators..

Every time Google Maps shows your blue dot location with high precision without GPS, it is effectively using wardriving data. Google (and Apple) constantly map these BSSIDs using our own phones. They match the BSSIDs around you to their massive internal database to triangulate your position. It is a little known fact that your GPS on your phone actually isn't that great. But combined with this data, it becomes a lot more accurate (Spoiler alert: It's also how Apple's FindMy works, even if your phone is "switched off")

OSINT investigators use this in reverse. If I have a suspect's BSSID (maybe leaked in a screenshot, or a crash dump), I can query WiGle to find the physical address of that router.

While simple phone apps generally don't capture "Probe Requests" (signals sent by devices looking for trusted networks) due to OS restrictions, dedicated hardware can. However, even with just a phone, seeing the density of Bluetooth Low Energy (BLE) devices gives you an idea of occupancy. A house with 0 Wi-Fi signals and 0 Bluetooth signatures is a very different target than one lit up like a Christmas tree. Now lets think of user location history. Consider the following case: A malicious actor has used a vehicle to commit a bad deed, whether that be to travel from point A to B to commit a break in, arson, or worse. Even if this actor is savvy enough to remove the GPS from their vehicle, they'll probably seriously struggle to pull out the boat load of other interfaces out. As they go about their misdoings, that vehicle is going to be collecting hundreds of identifiers across its journey, and most likely loggin them. Unbeknownst to the actor, they are leaving a trail of breadcrumbs that can be used to track their movements. Criminal forensics investigators can then pull this data from the vehicle, and cross validating it with databases like WiGle, may prove the movements of the person coincide with the crimes committed.

You don't need to be a hacker with a van full of servers to understand the radio landscape. Just by installing an app and taking a walk, you can peel back the layer of reality that we usually ignore. It’s effective, and whilst the use cases may be slim, they're definitely effective when applicable.