Surveillance Monitoring

Relevant source files

The following files were used as context for generating this wiki page:

• app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/SurveillanceScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/SensorCollectionService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/ScannerService.kt

Introduction

Surveillance Monitoring within ShadowCheck Mobile is a comprehensive security subsystem designed to detect, analyze, and alert users to potential electronic surveillance and network-based threats. This module continuously monitors the radio frequency (RF) environment, including WiFi, Bluetooth, and cellular signals, to identify anomalies such as unauthorized access points, signal jamming, or device tracking.

The system operates by correlating real-time sensor data and network discovery events against known threat patterns. It provides a multi-layered defense strategy, ranging from background scanning for "Evil Twins" to real-time monitoring of deauthentication attacks.

Sources: README.md, app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt:41-50

Architecture and Data Flow

The surveillance architecture is divided into three primary layers: Data Collection (Services), Analysis Logic (Detectors), and Presentation (UI).

Data Collection Layer

Data is ingested primarily through foreground services that interface with the Android system's wireless and hardware APIs.

• CompleteScannerService: Orchestrates background scanning of WiFi, BLE, and Cellular networks, ensuring deduplication of sightings every 30 seconds.
• NetworkMonitorService: Monitors active network state changes and captures specific disconnect reason codes.
• SensorCollectionService: Captures environmental metadata from hardware sensors (magnetometer, light, etc.) to aid in physical surveillance detection.

Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt:17-40, app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt:20-30

Surveillance Data Flow

The following diagram illustrates how raw signal data is transformed into actionable threat intelligence.

The diagram shows the pipeline from background services through the database and analysis logic to the end-user interface.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt, app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt

Threat Detection Logic

The system utilizes a heuristic-based approach to classify threats. The detectThreats function periodically evaluates the current RF environment stored in the local database.

Detection Heuristics

Threat Type	Detection Criteria	Severity
Evil Twin	Multiple BSSIDs sharing the same SSID name.	Critical
Unusually Strong Signal	Signal strength exceeding -30 dBm, suggesting close proximity.	High
Open Network	WiFi networks without WPA/WEP encryption (Potential Honeypot).	High
Hidden Network	Network broadcasting without an SSID.	Medium
Deauth Attack	WiFi disconnection with reason codes 6 (DEAUTH_LEAVING) or 7 (DEAUTH_DISASSOC).	High

Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt:133-176, app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt:113-125

Network Analysis Sequence

The NetworkMonitorService specifically tracks deauthentication attacks via system callbacks.

This sequence demonstrates the reactive nature of the monitoring service when a malicious disconnection event occurs.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt:80-100

Implementation Details

Surveillance Detector Model

Threats are represented using a structured data model that includes severity, confidence, and timestamps.

data class Threat(
    val id: String,
    val type: String, // e.g., "Rogue AP", "Evil Twin", "Deauth Attack"
    val severity: String, // "Critical", "High", "Medium", "Low"
    val title: String,
    val description: String,
    val timestamp: Long,
    val bssid: String = "",
    val signalStrength: Int = 0
)

Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt:24-33

Environmental Monitoring

The SensorCollectionService supplements network data by monitoring hardware-level interactions. It registers listeners for a wide array of sensors to detect physical interference or device tampering.

• Key Sensors Monitored: Magnetometer (Magnetic Field), Light, Proximity, and Pressure.
• Metadata Capture: Records manufacturer, model, and SOC manufacturer to identify the specific hardware platform being used for surveillance tasks.

Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/SensorCollectionService.kt:45-65, app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/SensorCollectionService.kt:115-125

Conclusion

Surveillance Monitoring in ShadowCheck Mobile serves as a proactive defense mechanism. By combining background RF scanning with real-time network stack monitoring and hardware sensor analysis, the system provides a comprehensive view of the user's security posture. The automated detection logic categorizes threats by severity, allowing users to differentiate between common network configurations and active security attacks like Evil Twins or deauthentication attempts.