Wardriving, the practice of recording wireless signals with geolocation information while in motion.
The name originated from the 80’s hacker movie “WarGames” where a young hacker, during the internet dial-up area, is trying to find connected computers by randomly calling (wardialing) phone numbers to see if a computer rather than a person is picking up the phone.
Wardriving is commonly associated with collecting Wi-Fi networks and has been around since the early days of Wi-Fi. However, driving is not required, and one can warwalk, -bike, -fly, -bus, etc. Moreover, Wi-Fi is not the only signal that can be collected; technically, any signal can be wardriven, but Wi-Fi (2.4 & 5 GHz) is the most common signal together with Bluetooth. Other examples are GSM cell towers, ADS-B (1090 MHz), and ISM bands (433, 915 MHz [country dependent]) networks such as Meshtastic and Meshcore, IoT networks like Zigbee, and sensors such as tire pressure sensors on cars, and even radiation.
Legality
This is not legal advice, but as far as I am aware, wardriving is legal, but countries like Saudi Arabia are known to have stricter telecommunication laws. Wardriving is only passively listening to wireless signals, which are considered public. However, be aware that wardriving in sensitive areas such as government facilities and embassy might be considered illegal. In general, wardriving is considered an educational hobby, teaching people about radio and networking.
A Wardriving renaissance
Wardriving has recently experienced a renaissance in popularity for three main reasons: open and affordable hardware, gamification, and privacy implications.
Hardware
One used to need a laptop running Linux with Kismet installed, a USB GNSS antenna, and a Wi-Fi adapter that supports monitoring mode. While this is still a powerful combination, and tools like Kismet let’s you go deep into the analysis of a wireless network and see the relationships between access points (AP) and clients, this setup is not very user-friendly. Smartphones come with all the necessary sensors required for wardriving and have the lowest barrier of entry. While Apple does not allow app developers to access the radios on their iPhones directly, on Android, you can download the Wigle or Wardrive Go app and start wardriving (more about Wigle below). Your Android phone can collect information about the Wi-Fi AP it can see, Bluetooth devices, and cell towers in your vacinity. However, you need to change some settings to optimize it for wardriving which impacts your battery life or could impact your privacy.
The rise of the ESP32
“Customizable hardware and open source is truly the gift that keeps on giving.” (Benn Jordan)
ESP32 is an affordable microcontroller that supports Bluetooth and Wi-Fi and was developed to be used in IoT devices. Because of their affordability and open documentation, they have become popular for hardware developers and hackers. People started writing custom firmware, building custom hardware for both wardriving and Wi-Fi pentesting. There are add-on boards for the Flipper Zero which run on ESP32; there are standalone devices like the Marauder running on open hardware and software; and there are devices like the Biscuit Pro which has no screen and is only controlled by an app. Besides wardriving, they often support some low-level Wi-Fi attacks (this is where the legality changes). From this culture of creators and makers came the gamification of wardriving.
Gamification
WDGWars.pl stands for Watch Dogs Go Wars, a combination of the open-world Watch Dog games series and a reference to wardriving. The game is about capturing territory by wardriving, joining teams that then compete against each other. You can gain control of another team’s territory by collecting more Wi-Fi AP within their territory compared to the opposing team. Many of the ESP32 devices support direct uploads to Wigle.net and WDGWars.pl, as they both support the same CSV file format for upload. You can get additional points by submitting data about cell towers you recorded, as well as ADS-B, Meshcore signals, and Flock cameras.
Wardriving as a Privacy tools
The recent backlash to Flock cameras has not gone unnoticed by the wardriving and hardware hacker communities. YouTuber Benn Jorden showcased that Flock cameras have a built-in Wi-Fi and Bluetooth adapter and emit signals that can be listen for.
Coloion Panic developed the OUI-SPY, basically an ESP32 connected to a buzzer that makes auditable sounds when it detects the presence of a Flock camera. Many of the modern, IRL surveillance devices contain Bluetooth and Wi-Fi adapters, making it easy for their users to connect to. Axon police body cameras have a Bluetooth radio; Flock gunshot detectors also have Wi-Fi and Bluetooth; and Ring cameras connect over Wi-Fi. For context, the reason the device is called OUI-SPY is that OUI (Organizationally Unique Identifier) is the first part of a device’s MAC address and is registered to a manufacturer. There are look-up tables, and most wardriving tools tell you who manufactured the device that was detected. However, this is a cat-and-mouse game, and Flock had implemented some countermeasures, making it harder to detect them. OUI-SPY keeps adapting; however, there remains a chance of false positives as well as false negatives. Other manufacturers have not gone so far as Flock, and there are functions on ESP32 devices as well as some Android apps that listen for the OUI of the Meta Ray Ban glasses via BLE. Other devices that can be detected are credit card skimmers, as they like to use a specific development board, and hacking devices such as the Flipper Zero, Wi-Fi pineapple and Ppwnagotchi.
I always recommend supporting the creator and buying an OUI-SPY. However, if that is not in your budget or you live outside the US, you can just buy a SeeedStudio XIAO ESP-S3 and flash the firmware. It does work without the buzzer. There is a fork that lets you control the OUI-SPY via an app. The same applies for the Biscuit DIY, you can buy an XIAO ESP32-C5 and flash the firmware and connect to the app. Using an app with an ESP32 is convenient; however, it does reduce the performance as the built-in radio has to constantly switch between communicating with your phone and listing for other signals. But they are a great and very affordable entry point for privacy and/or wardriving.
Wardriving is a great educational tool, teaching you about signal propagation and about how radio standards such as Wi-Fi work; understanding why an ESP32 can see Wi-Fi APs and clients while your phone only can see APs; exploring what information is transmitted in Wi-Fi probe requests might make you more aware of the information your devices transmit.
To 5 GHz or Not to 5 GHz
Many wardriving-specific devices have begun moving to dual-band configurations, such as the ESP32-C5, which is capable of BLE, 2.4 GHz, and 5 GHz. However, 5 GHz has significantly more channels compared to 2.4 GHz. While this is great for reducing local Wi-Fi congestion, it also means the radio spends more time jumping through different channels, increasing the chance of missing beacon advertisements on the other bands. I would argue that for the detection of surveillance devices, it is preferable to focus solely on 2.4 GHz. Many outdoor devices, like cameras, primarily use 2.4 GHz because it offers better range and penetration compared to 5 GHz, and many other surveillance devices use BLE. By excluding 5 GHz from your scan, more time is spent on 2.4 GHz and BLE, increasing the chance of detecting a device on those bands. We see this reflected in devices like the nyanBox, which has advanced detection capabilities but focuses on 2.4 GHz.
For advanced users, creating a multi-radio cluster means less time spent hopping between channels. Using ESP-NOW, the community has developed wardriving clusters, which are custom rigs that use a dedicated radio for each Wi-Fi channel, eliminating channel hopping entirely.
A word of caution
You want to avoid uploading signals from your personal devices to preserve some level of privacy. While Wigle.net and WDGWars.pl are community-run projects with good privacy defaults and currently no agenda to sell your data, it is good to practice data hygiene. You should add the mac address of your personal devices (phone, router, laptop, etc.) to the ignore list of your wardriver. One of the easiest ways to find them is to scan for 30 seconds at home while turning all your devices on. Then use the log file as a baseline for your ignore list. Some applications may also allow you to set a geofence area within which all devices are being ignored.
Sidenote: Wigle.net
Wigle.net is an amazing resource about wardriving and people have been contributing to it for decades. Thereby creating in valuable resources mapping Wi-Fi density and the adoption of Wi-Fi standards such as WPA2 and WPA3 over time.
DEFON
DEFON is a gold mine for these projects, and there has been some coverage on YouTube.
Naomi Brockwell features the OUI-SPY and other devices in her video about DEFCON: The coolest anti-surveillance tools at Defcon
Ham Radio Crash Course interviewed the creator of the nyanBox during a live stream: Find Them Before They Find You With The Nyan Box!
While drafting this article, DEFCON released the talk by Cyber Tiger (Rayhunter) and Colonel Panic (OUI-Spy) covering similar talking points: DEF CON 34 - ESP32 as counter-surveillance platform - Cybertiger, Colonel Panic, The Wrew
Benn Jordan on the Flock-you: Gadgets For People Who Don’t Trust The Government
Disclamer: If you find any spelling mistakes, you can keep them. No AI was used in the writing of this article