A Study of MAC Address Randomization in Mobile Devices and When it Fails

Martin, Jérémy E.; Mayberry, Travis; Donahue, Collin; Foppe, Lucas; Brown, Lamont; Riggins, Chadwick; Rye, Erik C.; Brown, Dane

doi:10.48550/arxiv.1703.02874

Cited by 4 publications

(8 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…design flaws the effect of randomization can be reversed in various ways. In this paper we implemented our own version of MAC address de-randomization based on techniques presented in by others [12,7]. We de-randomized our data set and calculated the uniqueness values for the data set again, and compared the uniqueness distribution to our earlier results.…”

Section: Discussionmentioning

confidence: 99%

“…While a MAC address would be the obvious choice for a primary identification handle for tracking, randomization of the address has not been able to obfuscate entities completely. Studies have shown that MAC address randomization can be reversed [12,7] and that it is not that effective.…”

Section: Reverse Randomizationmentioning

confidence: 99%

“…For this paper we implemented de-randomization methods described by Vanhoef et al [12] and Martin et al [7]. These methods are; i) sequence control (SC) continuity, ii) information element (IE) fingerprinting, iii) locally/globally administered OUIs, and iv) PNL matching.…”

Section: Reverse Randomizationmentioning

confidence: 99%

“…A popular countermeasure against tracking is MAC address randomization [5,11], which has already made its way to recent mobile operating systems (Android 6.0 and iOS 8). However, several studies [12,7,8] have shown that MAC address randomization can be reversed.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Quantifying the Information Leak in IEEE 802.11 Network Discovery

Waltari¹,

Kangasharju²

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Wi-Fi is often the easiest and most affordable way to get a device connected. When a device connects to any Wi-Fi network its identifier (SSID) is stored in the device. These SSIDs are sometimes intentionally exposed to the outside world during periodic network discovery routines. In this paper we quantify the information leak that is present in the current network discovery protocol. Our collected data shows how common it is for a device to leak information and what can be derived from the names of networks a user has connected to in the past. We introduce a way to measure the uniqueness of an entity, which is based on the set of leaked SSID names. We apply previously proposed methods of MAC address randomization reversal on our data and evaluate entity uniqueness. We show how unique SSID names backfire against attempts to obfuscate user devices. Finally we evaluate an existing alternative network discovery scheme that does not leak information.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Reverse Randomizationmentioning

confidence: 99%

Section: Reverse Randomizationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Quantifying the Information Leak in IEEE 802.11 Network Discovery

Waltari¹,

Kangasharju²

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…In fact, usually 802.11 network devices have a fixed MAC address, which means that, even concealing more human-related attributes, an attacker can still track devices as they move around. This was a key motivation for MAC address randomization in mobile devices, such as smartphones [20].…”

Section: Privacy Enhancementmentioning

confidence: 99%

Integration of the Captive Portal paradigm with the 802.1X architecture

Marques,

Zúquete,

Barraca

2019

Preprint

View full text Add to dashboard Cite

In a scenario where hotspot wireless networks are increasingly being used, and given the amount of sensitive information exchanged on Internet interactions, there is the need to implement security mechanisms that guarantee data confidentiality and integrity in such networks, as well as the authenticity of the hotspot providers.However, many hotspots today use Captive Portals, which rely on authentication through Web pages (thus, an application-level authentication approach) instead of a link-layer approach. The consequence of this is that there is no security in the wireless link to the hotspot (it has to be provided at upper protocol layers), and is cumbersome to manage wireless access profiles (we need special applications or browsers' add-ons to do that).This work exposes the weaknesses of the Captive Portals' paradigm, which does not follow a unique nor standard approach, and describes a solution that intends to suppress them, based on the 802.1X architecture. This solution uses a new EAP-compliant protocol that is able to integrate an HTTP-based registration or authentication with a Captive Portal within the 802.1X authentication framework.

show abstract

What Your Wearable Devices Revealed About You and Possibilities of Non-Cooperative 802.11 Presence Detection During Your Last IPIN Visit

Bravenec

Torres-Sospedra

Gould

et al. 2022

2022 IEEE 12th International Conference on Indoor Positioning and Indoor Navigation (IPIN)

View full text Add to dashboard Cite

This paper focuses on the creation of a new, publicly available Wi-Fi probe request dataset. Probe requests belong to the family of management frames used by the 802.11 (Wi-Fi) protocol. As the situation changes year by year, and technology improves probe request studies are necessary to be done on up-to-date data. We provide a month-long probe request capture in an office environment, including work days, weekends, and holidays consisting of over 1 400 000 probe requests. We provide a description of all the important aspects of the dataset. Apart from the raw packet capture we also provide a Radio Map (RM) of the office to ensure the users of the dataset have all the possible information about the environment. To protect privacy, user information in the dataset is anonymized. This anonymization is done in a way that protects the privacy of users while preserving the ability to analyze the dataset to almost the same level as raw data. Furthermore, we showcase several possible use cases for the dataset, like presence detection, temporal Received Signal Strength Indicator (RSSI) stability, and privacy protection evaluation.

show abstract

A Study of MAC Address Randomization in Mobile Devices and When it Fails

Cited by 4 publications

References 0 publications

Quantifying the Information Leak in IEEE 802.11 Network Discovery

Quantifying the Information Leak in IEEE 802.11 Network Discovery

Integration of the Captive Portal paradigm with the 802.1X architecture

What Your Wearable Devices Revealed About You and Possibilities of Non-Cooperative 802.11 Presence Detection During Your Last IPIN Visit

Contact Info

Product

Resources

About