Maluta Privacy Scanner Privacy Scanner

Privacy Scanner — WiFi Surveillance Device Detector

Defensive security tool that scans the local WiFi network to detect hidden cameras, microphones, and surveillance devices in rental accommodations (Airbnb, Booking, VRBO, etc.).

Overview

Airbnb's policy prohibits ALL indoor cameras and recording devices, even if disclosed and even if turned off. This tool helps guests verify compliance by scanning the WiFi network for surveillance equipment.

The scanner runs 7 phases: host discovery → manufacturer identification → port scanning → service discovery → deep inspection → risk classification → report generation.

What it detects:

• IP cameras from known surveillance manufacturers (Hikvision, Dahua, EZVIZ, Amcrest, etc.)
• Consumer cameras (Wyze, Blink, Arlo, Nest, Ring, Foscam, Yi, Eufy)
• Hidden cameras using generic IoT chipsets (ESP32, Realtek, MediaTek)
• RTSP streaming services, camera web interfaces, vendor-specific protocols
• ONVIF-compatible devices, mDNS-advertising cameras, UPnP media devices

What it CANNOT detect:

• Cameras on a separate VLAN or wired-only network
• Cellular-connected cameras (4G/LTE)
• Cameras powered off or in standby
• Devices using MAC address randomization
• Local-storage cameras not connected to any network
• Audio-only recording devices

Workflow

Step 1: Check Prerequisites

CRITICAL: nmap is mandatory on all platforms. Python 3.8+ is required for the cross-platform scanner.

Install per platform:

• Linux (Arch): sudo pacman -S nmap python arp-scan avahi
• Linux (Debian): sudo apt install nmap python3 arp-scan avahi-utils
• macOS: brew install nmap python arp-scan
• Windows: Install nmap from https://nmap.org/download (includes Npcap), Python from https://python.org

Python packages (optional, improve detection):

pip install python-nmap zeroconf requests

Step 2: Run the Scanner

Cross-platform (recommended) — works on Linux, macOS, and Windows:

# Linux / macOS
sudo python3 scripts/scan.py

# Windows (Admin PowerShell)
python scripts\scan.py

Linux-only — bash version (full feature parity):

sudo bash scripts/scan.sh

Common flags (same for both scan.py and scan.sh):

# Quick scan (~2-3 minutes)
sudo python3 scripts/scan.py --quick

# Report in English or Spanish (default: Portuguese)
sudo python3 scripts/scan.py --lang en
sudo python3 scripts/scan.py --lang es

# Specify interface/subnet manually
sudo python3 scripts/scan.py --interface wlan0 --subnet 192.168.1.0/24

CRITICAL: Run with sudo (Linux/macOS) or as Administrator (Windows). ARP scanning and SYN port scanning require elevated privileges. Without them, the scanner falls back to less reliable methods.

Step 4: Interpret Results

The scanner classifies every device into risk levels:

Step 5: Take Action (if threats found)

For CRITICAL or HIGH findings:

1. Do NOT disconnect or tamper with the device
2. Photograph the device and its location
3. Save the scan report (terminal output + HTML file in ./privacy-scan-results/)
4. Contact Airbnb: App → Your Trips → Get Help → Report a safety concern
5. Airbnb Emergency: +1-855-424-7262
6. If you feel unsafe, leave the property
7. Consider contacting local law enforcement

Scanning Phases

Phases 4-5 are skipped in --quick mode.

Risk Classification Matrix

Critical Rules

• CRITICAL: Always run with sudo. ARP scans and SYN scans require root.
• CRITICAL: Never skip Phase 2 (OUI analysis). Manufacturer ID is the strongest signal.
• CRITICAL: Scan ALL devices, not just flagged ones. Cameras often use generic chipset MACs.
• CRITICAL: Use -T4 timing (aggressive but safe). Do NOT use -T5 — IoT devices may crash.
• CRITICAL: Always mention scan limitations in the report. This is not a comprehensive physical sweep.
• CRITICAL: Do NOT advise the user to disconnect or tamper with found devices — this could destroy evidence.

Common Pitfalls

❌ WRONG: Scanning only devices with suspicious OUI ✅ CORRECT: Scan ALL devices — cheap cameras use generic Espressif/Realtek MACs

❌ WRONG: Trusting only OUI lookup for device identification ✅ CORRECT: Correlate OUI + ports + HTTP fingerprint + mDNS for accurate classification

❌ WRONG: Only checking port 554 for cameras ✅ CORRECT: Check ALL camera ports including vendor-specific (37777, 34567, 8000, 9000, etc.)

❌ WRONG: Ignoring mDNS services ✅ CORRECT: Many cameras announce _rtsp._tcp or _camera._tcp via Bonjour

❌ WRONG: Concluding "no cameras" after a clean scan ✅ CORRECT: State that the WiFi scan was clean BUT cameras could exist on other networks, wired, or offline

Camera-Specific Ports

554     - RTSP (primary camera streaming)
8554    - RTSP alternate
80/443  - HTTP/HTTPS (camera web UI)
8080    - HTTP alternate (very common on cameras)
8443    - HTTPS alternate
8000    - Hikvision ISAPI/SDK
8200    - Hikvision web alternate
37777   - Dahua proprietary protocol
34567   - XMEye/Chinese NVR protocol
34599   - XMEye alternate
9000    - Reolink proprietary
3702    - ONVIF WS-Discovery
1935    - RTMP streaming
5000    - Synology/QNAP Surveillance Station
6667    - RTSP alternate
8899    - HTTP camera alternate
7070    - Streaming alternate
9527    - Chinese camera debug port

Reference Files

• reference/oui-database.md — Curated camera manufacturer MAC prefixes (3 tiers)
• reference/ports-services.md — Camera ports, HTTP keywords, RTSP paths, mDNS services
• reference/device-signatures.md — HTTP headers, HTML titles, mDNS hostnames, UPnP patterns

Output

The scanner produces:

1. Terminal output — Color-coded, real-time progress with risk-classified device list
2. HTML report — Saved to ./privacy-scan-results/privacy-scan-YYYYMMDD-HHMMSS.html
   • Dark security-themed UI with interactive device cards
   • Language switcher (PT/EN/ES) — works offline, no reload needed
   • Copy-to-clipboard for IP/MAC addresses
   • Print-friendly mode
3. Raw data — Saved to ./privacy-scan-results/raw-data-YYYYMMDD-HHMMSS/

Rental Platform Policies

Major short-term rental platforms prohibit indoor surveillance cameras:

Source: maluta/privacy-scanner — distributed by TomeVault.