Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms

Mathy Vanhoef 1 Célestin Matte 2, 3 Mathieu Cunche 2, 3 Leonardo Cardoso 4, 2 Frank Piessens 1
3 PRIVATICS - Privacy Models, Architectures and Tools for the Information Society
Inria Grenoble - Rhône-Alpes, CITI - CITI Centre of Innovation in Telecommunications and Integration of services
4 SOCRATE - Software and Cognitive radio for telecommunications
Inria Grenoble - Rhône-Alpes, UCBL - Université Claude Bernard Lyon 1, CITI - CITI Centre of Innovation in Telecommunications and Integration of services
Abstract : We present several novel techniques to track (unassociated) mobile devices by abusing features of the Wi-Fi standard. This shows that using random MAC addresses, on its own, does not guarantee privacy. First, we show that information elements in probe requests can be used to fingerprint devices. We then combine these fingerprints with incremental sequence numbers, to create a tracking algorithm that does not rely on unique identifiers such as MAC addresses. Based on real-world datasets, we demonstrate that our algorithm can correctly track as much as 50% of devices for at least 20 minutes. We also show that commodity Wi-Fi devices use predictable scrambler seeds. These can be used to improve the performance of our tracking algorithm. Finally, we present two attacks that reveal the real MAC address of a device, even if MAC address randomization is used. In the first one, we create fake hotspots to induce clients to connect using their real MAC address. The second technique relies on the new 802.11u standard, commonly referred to as Hotspot 2.0, where we show that Linux and Windows send Access Network Query Protocol (ANQP) requests using their real MAC address.
Type de document :
Communication dans un congrès
ACM AsiaCCS, May 2016, Xi'an, China. 2016, <10.1145/2897845.2897883>
Liste complète des métadonnées


https://hal.inria.fr/hal-01282900
Contributeur : Célestin Matte <>
Soumis le : vendredi 10 juin 2016 - 17:19:50
Dernière modification le : mardi 14 juin 2016 - 01:09:12

Fichier

asiaccs2016.pdf
Fichiers éditeurs autorisés sur une archive ouverte

Identifiants

Collections

Citation

Mathy Vanhoef, Célestin Matte, Mathieu Cunche, Leonardo Cardoso, Frank Piessens. Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms. ACM AsiaCCS, May 2016, Xi'an, China. 2016, <10.1145/2897845.2897883>. <hal-01282900>

Partager

Métriques

Consultations de
la notice

617

Téléchargements du document

463