Xiang Zhang, University of Science and Technology of China; Jie Zhang, CFAR and IHPC, A*STAR; Huan Yan, Guizhou Normal University; Jinyang Huang, Hefei University of Technology; Zehua Ma and Bin Liu, University of Science and Technology of China; Meng Li, Hefei University of Technology; Kejiang Chen, University of Science and Technology of China; Qing Guo, CFAR and IHPC, A*STAR; Tianwei Zhang, Nanyang Technological University; Zhi Liu, The University of Electro-Communications
The growing privacy risks posed by hidden WiFi cameras have prompted increasing interest in their detection and localization. However, existing localization solutions suffer from several limitations, such as requiring substantial user effort, large activity spaces, predefined parameters, and pre-collected training data. In this paper, we present DiffLoc, a novel and low-cost system that localizes hidden WiFi cameras by leveraging the fundamental physical principle of electromagnetic diffraction. When an obstacle passes through the direct path between a transmitter and a receiver, it causes a distinctive signal attenuation pattern. We theoretically analyze the feasibility of using this phenomenon for localization, identifying two critical requirements for building an unbiased diffraction localization model: symmetry and observability. To meet these requirements, DiffLoc introduces a controllable diffraction generation method. By precisely rotating a small metal plate around a passive WiFi receiver (e.g., a Raspberry Pi), the system produces a consistent and predictable diffraction "shadowing" effect. We then construct an unbiased localization model that maps this effect to the azimuth of the hidden camera. Implemented using commercially available off-the-shelf hardware, DiffLoc achieves an average angular error of 14.82° across six diverse environments and eleven different camera models, demonstrating its effectiveness. Code, implementation details, and demo are available at: https://github.com/CamLoPA/DiffLoc.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
author = {Xiang Zhang and Jie Zhang and Huan Yan and Jinyang Huang and Zehua Ma and Bin Liu and Meng Li and Kejiang Chen and Qing Guo and Tianwei Zhang and Zhi Liu},
title = {{DiffLoc}: {WiFi} Hidden Camera Localization Based on Electromagnetic Diffraction},
booktitle = {34th USENIX Security Symposium (USENIX Security 25)},
year = {2025},
isbn = {978-1-939133-52-6},
address = {Seattle, WA},
pages = {6639--6658},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/zhang-xiang},
publisher = {USENIX Association},
month = aug
}