SSID Oracle Attack on Undisclosed Wi‐Fi Preferred Network Lists

Abstract

User's location privacy concerns have been further raised by today's Wi-Fi technology omnipresence. Preferred Network Lists (PNLs) are a particularly interesting source of private location information, as devices are storing a list of previously used hotspots. Privacy implications of a disclosed PNL have been covered by numerous papers, mostly focusing on passive monitoring attacks. Nowadays, however, more and more devices no longer transmit their PNL in clear, thus mitigating passive attacks. Hidden PNLs are still vulnerable against active attacks whereby an attacker mounts a fake SSID hotspot set to one likely contained within targeted PNL. If the targeted device has this SSID in the corresponding PNL, it will automatically initiate a connection with the fake hotspot thus disclosing this information to the attacker. By iterating through different SSIDs (from a predefined dictionary) the attacker can eventually reveal a big part of the hidden PNL. Considering user mobility, executing active attacks usually has to be done within a short opportunity window, while targeting nontrivial SSIDs from user's PNL. The existing work on active attacks against hidden PNLs often neglects both of these challenges. In this paper we propose a simple mathematical model for analyzing active SSID dictionary attacks, allowing us to optimize the effectiveness of the attack under the above constraints (limited window of opportunity and targeting nontrivial SSIDs). Additionally, we showcase an example method for building an effective SSID dictionary using top-N recommender algorithm and validate our model through simulations and extensive real-life tests.

On WPA2-Enterprise Privacy in High Education and Science

“…is indicates that linking username, hence a person, with MAC address can further help adversary in disclosing user whereabouts [22,23]. A large number of research papers highlight the risk of privacy violation by analyzing Wi-Fi probes and MAC address along with encrypted and unencrypted traffic [4,[23][24][25][26][27][28][29]. Recently, vendor manufacturers started to use MAC randomization to prevent such privacy leaks.…”

An Improved Dictionary Cracking Scheme Based on Multiple GPUs for Wi-Fi Network

“…Wi-Fi signals are typically password-protected, but it can also be turned on so that all devices in the range are connected. This technology improves the interoperability of wireless network devices based on the IEEE 802.11 standard [3][4][5][6]. In 2014, the number of public Wi-Fi hotspots exceeded 50 million which is an 80% increase over 2013 [7][8][9][10].…”