Jeremy Martin, Travis Mayberry, Collin Donahue
Lucas Foppe, Lamont Brown, Chadwick Riggins, Erik C. Rye, Dane Brown
2017 · arXiv
MAC address randomization is a privacy technique whereby mobile devices rotate through random hardware addresses in order to prevent observers from singling out their traffic or physical location from other nearby devices. Adoption of this technology, however, has been sporadic and varied across device manufacturers. In this paper, we present the first wide-scale study of MAC address randomization in the wild, including a detailed breakdown of different randomization techniques by operating system, manufacturer, and model of device. We then identify multiple flaws in these implementations which can be exploited to defeat randomization as performed by existing devices. First, we show that devices commonly make improper use of randomization by sending wireless frames with the true, global address when they should be using a randomized address. We move on to extend the passive identification techniques of Vanhoef et al. to effectively defeat randomization in ~96% of Android phones. Finally, we show a method that can be used to track 100% of devices using randomization, regardless of manufacturer, by exploiting a previously unknown flaw in the way existing wireless chipsets handle low-level control frames.
Metadata: arXiv. Abstracts retain their original authors’ rights.
Original HN comments, with labels from simple text rules. A label describes the whole comment and may miss context or irony. Read the discussion to make up your own mind. About the labels
6 selected excerpts · 6 total mentions
On probe requests this can be very often(< second or within 50 frames), especially in the case of IOS. On Android MAC randomisation is implemented only on a handful of specific devices and some vendors dont at all. Mac randomisation is flawed at the least and can still be used to identify an individual in some cases. The paper below lists techniques explored by the US Navy published in 2017. https://arxiv.org/pdf/1703.02874.pdf
Confirmed, however there are/were flaws in MAC randomization, see A Study of MAC Address Randomization in Mobile Devices and When it Fails https://arxiv.org/abs/1703.02874v1. Has it been addressed somehow recently?
Two other issues I'm worried about with iOS: - MAC address tracking (RTS packets thrwart MAC randomization[0], not immediately clear if WiFi is fully off[1]) - All-or-nothing access to photos on the phone (append-only for apps that request it) Discord in particular is bad for the photo permission, as I don't trust China's Tencent with access to all the photos on my phone (which can include lots of frequent location information!), but pasting images doesn't work in the app. I had assumed the "Photos" permission meant "permission to prompt this dialogue" and "permission to save to Camera Roll". [0] https://arxiv.org/pdf/1703.02874v1.pdf [1] https://support.apple.com/en-us/HT208086
The only source for this a could find was an old paper on iOS 8, while this more recent one https://arxiv.org/pdf/1703.02874.pdf seems to suggest the randomisation works as intended for unknown networks...
There are further examples that Apple takes privacy seriously: 1) end-to-end encryption of all iMessages 2) encrypted iCloud content 3) making password management accessible to a lot of people who would not pursue it otherwise (with Keychain) 4) attempting MAC address randomization to prevent WiFi tracking, though from this paper [1] it appears to be broken. Having worked there for a time, in my opinion privacy is deeply ingrained in the company culture. Much easier solutions are avoided if they sacrifice the customer's privacy. Further, it seems many of the decisions are made to minimize the amount of information required at each step to the absolute essentials. These…
concerns permeate internal technical discussions -- it is not just marketing materials. They also have pretty extensive privacy materials on their website [2, 3]. While that may not be useful to the HN crowd, hopefully it makes privacy more accessible to some segment of their customers who actually read it. References: [1] PDF warning: https://arxiv.org/pdf/1703.02874.pdf [2] https://www.apple.com/privacy/approach-to-privacy/ [3] https://support.apple.com/en-us/HT202303
I'm just now learning about all this (I'd heard about stores tracking customers, but thought it only worked with Wifi enabled), but it seems many Android phones don't actually do randomization, and it can be easily fingerprinted even if they do. From a 2017 paper, https://arxiv.org/abs/1703.02874v1 > First, we show that devices commonly make improper use of randomization by sending wireless frames with the true, global address when they should be using a randomized address. We move on to extend the passive identification techniques of Vanhoef et al. to effectively defeat randomization in ~96% of Android phones. Finally, we show a method that can be used to track 100% of…
devices using randomization, regardless of manufacturer, by exploiting a previously unknown flaw in the way existing wireless chipsets handle low-level control frames. and near the end of section 4.2 > Therefore we posit that much less than ∼50% of devices conduct randomization.
More from the same topics.
Luca Beurer-Kellner, Beat Buesser, Ana-Maria Creţu +11
As AI agents powered by Large Language Models (LLMs) become increasingly versatile and capable of addressing a broad spectrum of tasks, ensuring their security has become a critical challenge.
Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi +2
The recent discovery of the Spectre and Meltdown attacks represents a watershed moment not just for the field of Computer Security, but also of Programming Languages.
Ian J. Goodfellow, Jonathon Shlens, Christian Szegedy
Several machine learning models, including neural networks, consistently misclassify adversarial examples---inputs formed by applying small but intentionally worst-case perturbations to examples from the dataset, such that the perturbed input results in the model outputting an incorrect answer with high confidence.
John C. Baez, Mike Stay
In physics, Feynman diagrams are used to reason about quantum processes.