Bangkok Underground Street Radio Checkpoint: Self-Built Specs for the “Portable Faraday Cage & BLE Radio Visualization Scanner” to Wipe Tracking Signals｜Sofi_Log #077【Complete in One Episode】
That smartphone, wireless earbuds, and smartwatch sitting in your pocket.
You think “I turned Bluetooth off in Control Center, so no signals are leaking,” right?
Wrong. Most modern smart devices keep blasting out weak BLE beacon packets every few seconds for the “Find My” network and peripheral discovery—even when you flip the switch. They’re just dripping those advertisement frames into the air like it’s nothing.
Ceilings in malls, ticket gates, lamp posts on street corners—modern cities are crawling with passive BLE/Wi-Fi sniffers profiling everyone who walks by. Even with MAC randomization, RSSI decay patterns and tiny timing jitter (Radio Fingerprinting) still let them map exactly which alley you took and which shop you entered.
Last night we blew through the Chao Phraya river blockade.
We ducked into Ban Mo’s underground labyrinth—the best electronics junk district in Bangkok—to shake the tail. To slip the passive radio net and become true electronic ghosts on the night highway, we built an 80 dB+ high-frequency Faraday cage and an ESP32-based real-time BLE visualization scanner.
1. 02:15 a.m., Ban Mo Underground Electronics Market: Solder in the Air and the Invisible Radio Web
Still dripping from the muddy river, we slid into the old underground arcade. Overhead, coaxial cables and comms lines hung like spider webs. Shuttered junk stalls were piled with transformers, boards, and ancient test gear sleeping in the damp dark.
Emergency lights cast a dull green glow on the rain-slick concrete.
“…Sofi, look down. Those security lamps aren’t just LEDs.”
Darling leaned against a marble pillar, collar up, voice low. His little spectrum analyzer was lighting up with violent spikes across the 2.4 GHz ISM band.
“Commercial traffic-analysis beacons. ESP32 sniffers parasitizing the light power. Logging every phone and wearable BLE advertisement that passes and shipping the location data to a central server.”
“If they lock our terminal signatures from the river crossing, we’re getting grabbed the second we surface.”
“Right. So we do two things.”
I straightened my soaked tank top and raised my cybernetic left arm. Matte-black bioceramic armor with gold-kintsugi bio-neural lines pulsing faint cyan.
“We drop our own emissions to absolute zero. And we make every trap they’ve laid visible as light.”
2. BLE’s Careless Broadcasts and Skin Effect
If you actually want to protect your phone’s privacy, you first have to understand what the enemy is collecting—and why cheap aluminum foil fails.
① BLE Advertisement Packet Structure
BLE uses the three primary advertising channels (2402 MHz, 2426 MHz, 2480 MHz) to blast broadcast packets before any connection is made.
+-------------------+----------------+--------------------+---------------+ | Preamble (1 byte) | Access Address | PDU Header + Payload| CRC (3 bytes) | | 0xAA | 0x8E89BED6 | (2 - 257 bytes) | Polynomial | +-------------------+----------------+--------------------+---------------+ | +--------------------------------+--------------------------------+ | Adv Address (6 bytes: MAC) | Adv Data (Flags, UUID, TxPower)| +--------------------------------+--------------------------------+ Those packets carry the MAC, Tx Power, and service UUIDs. Receivers compare RSSI against Tx Power and solve the log-distance path loss equation to get your physical distance in meters:
$$d = 10^{\frac{\text{TxPower} - \text{RSSI}}{10 \cdot n}}$$
($n$ ≈ 3.0–4.0 indoors)
② Electromagnetic Shielding and Skin Depth
When an EM wave hits a conductor, eddy currents form on the surface and either dissipate as heat or reflect. The depth at which the wave amplitude drops to 1/e (≈37 %) is called skin depth:
$$\delta = \sqrt{\frac{\rho}{\pi f \mu_r \mu_0}}$$
At 2.45 GHz, copper skin depth is only ≈1.3 µm. So why does wrapping your phone in grocery-store foil still leak?
Two reasons:
- Slot-antenna effect: Seams and micro-gaps act as slot antennas for λ ≈ 12.2 cm waves and re-radiate the signal.
- Contact resistance: If the opening isn’t conductively sealed, you never form a true equipotential Faraday surface.
True 80 dB attenuation (one-hundred-millionth power) requires conductive polyester-nickel-copper ripstop fabric with double-fold seams + conductive hook-and-loop closure.
3. Live Code: ESP32 / Python BLE Visualization & Attenuation Scanner
Here’s the core engine we threw together on the spot. It sniffs BLE beacons, tracks RSSI trends, and benchmarks exactly how many dBm your homemade Faraday pouch knocks the signal down.
#!/usr/bin/env python3 """ Sofi_Log #077: Tactical BLE Beacon Sniffer & RF Shielding Validator Author: Sofi & Darling (SofiWorks) Target: 2.4GHz BLE Advertising Scanner & Attenuation Benchmark """ import asyncio import sys import time from datetime import datetime from bleak import BleakScanner # 追跡検知パラメータ RSSI_ALERT_THRESHOLD = -55 # 近接スニッファー警戒閾値 (dBm) SAMPLE_WINDOW_SEC = 5 # サンプリング窓 class BLESpectrumMonitor: def __init__(self): self.device_history = {} self.baseline_rssi = None def detection_callback(self, device, advertisement_data): now = time.time() rssi = advertisement_data.rssi mac = device.address name = device.name or advertisement_data.local_name or "Unknown" tx_power = advertisement_data.tx_power # デバイス履歴の更新 if mac not in self.device_history: self.device_history[mac] = { "name": name, "first_seen": now, "rssi_samples": [], "tx_power": tx_power } entry = self.device_history[mac] entry["rssi_samples"].append(rssi) entry["last_seen"] = now if len(entry["rssi_samples"]) > 20: entry["rssi_samples"].pop(0) # 直近平均RSSI avg_rssi = sum(entry["rssi_samples"]) / len(entry["rssi_samples"]) # 警告レベルの判定 alert_flag = "⚠️ [PROXIMITY WARNING]" if avg_rssi > RSSI_ALERT_THRESHOLD else " [SCANNING]" # 簡易距離推計 (Path Loss Exponent n=3.2 for indoor market) tx_ref = tx_power if tx_power is not None else -59 ratio = (tx_ref - avg_rssi) / (10 * 3.2) dist_est = round(10 ** ratio, 2) timestamp_str = datetime.now().strftime("%H:%M:%S.%f")[:-3] print(f"[{timestamp_str}] {alert_flag} MAC: {mac} | RSSI: {avg_rssi:6.1f} dBm | Dist: ~{dist_est:4.1f}m | {name[:18]}") async def run_scanner(self, duration_sec=15): print("=" * 75) print("⚡ Sofi_Log #077: BLE RF Scanner Armed. Listening on 2.4GHz Primary Channels...") print("=" * 75) scanner = BleakScanner(detection_callback=self.detection_callback) await scanner.start() await asyncio.sleep(duration_sec) await scanner.stop() print("-" * 75) print(f"[*] Scan window closed. Unique transmitters logged: {len(self.device_history)}") def test_shielding_attenuation(self, target_mac): """ ファラデーポーチ内外での特定端末の電波減衰（dBm）を算出 """ if target_mac not in self.device_history: print(f"[-] Target MAC {target_mac} not found in telemetry.") return samples = self.device_history[target_mac]["rssi_samples"] if not samples: return current_val = samples[-1] print(f"\n[+] Shielding Performance for [{target_mac}]:") print(f" Measured Signal: {current_val} dBm") if current_val <= -95: print(" Status: ✅ [CRITICAL SHIELDING CONFIRMED] Signal suppressed to noise floor.") else: print(" Status: ❌ [LEAK DETECTED] Electromagnetic seal compromised. Check fold seam.") async def main(): monitor = BLESpectrumMonitor() # 15秒間のパッシブスキャン実行 await monitor.run_scanner(duration_sec=10) if __name__ == "__main__": try: asyncio.run(main()) except KeyboardInterrupt: print("\n[*] Monitoring terminated by operator.") sys.exit(0) 4. The Black Pouch and the Alleyway Stealth Run
“Double-fold seams sealed, conductive Velcro fully pressed.”
I slid our phones and keys into the nickel-copper ripstop pouch I’d stitched together. On the scanner they simply vanished—gone below the -105 dBm noise floor. Total electronic death.
“Perfect. Their sniffers won’t even see our shadows now.”
Darling peered through a shutter gap and nodded.
“But the modules are still live on every corridor. We thread the null zones while the scanner paints the map.”
I moved through the dim passages with the ESP32 OLED in hand, skirting the strongest 2.4 GHz pulses, hugging power panels and duct shadows. Cool underground air turned humid. We reached the iron service gate. Beyond it: wet back-alley asphalt.
Key in the Ducati’s ignition. The big V-twin barked awake.
“Grab on, Sofi!”
“Punch it, darling!”
We vanished into Bangkok’s rainy night with zero radio tail.
🔗 Read Next (Previous Sofi_Log):
『Midnight Chao Phraya River Blockade Run: AIS Packet Spoofing with SDR & Ghost Track Generation｜Sofi_Log #076』
👉 https://note.com/legal_rat2977/n/n334fc7f74213
【Disclaimer】
The code, shielding techniques, and protocol explanations in this post are provided strictly for privacy protection research, security studies, proof-of-concept work, and educational purposes. Obey all local radio regulations and test only on hardware you own.
🎁 【Full Open Source】Live Code & Architecture
The BLE scanner and shielding validation script shown above is released in full for your own security and privacy experiments.
📬 Sofi’s Mailbox #077 (Questions & Feedback)
So, darlings—how was the underground radio-net escape?
Ever stopped to think how much signal your phone and earbuds are constantly leaking? Got questions about verifying a commercial Faraday pouch or why randomized MACs still get tracked? Drop your thoughts and experiments in the comments. Sofi and darling will answer you directly in the next log.
Disclaimer
This article is for educational and entertainment purposes only. It does NOT constitute financial, legal, or tax advice. The regulatory landscape of Web3, smart contracts, and AI agent autonomous systems is highly volatile and complex. Always perform your own research (DYOR) and consult with certified professionals before executing any strategies described herein.
