Slashdot Mirror
MAC Address Randomization Flaws Leave Android and iOS Phones Open To Tracking (theregister.co.uk)
New submitter cryptizard writes: Modern Android and iOS versions include a technology called MAC address randomization to prevent passive tracking of users as they move from location to location. Unfortunately, researchers have revealed that this technology is implemented sporadically by device manufacturers and is often deployed with significant flaws that allow it to be easily defeated. A research paper [published by U.S. Naval Academy researchers] highlights a number of flaws in both Android and iOS that allow an adversary to track users even when their phones are using randomized MAC addresses. Most significantly, they demonstrate that a flaw in the way wireless chipsets handle low-level control messages can be exploited to track 100% of devices, regardless of manufacturer or operating system.
"Every 802.11 radio on a mobile device possesses a 48-bit link-layer MAC address that is a globally unique identifier for that specific WiFi device."
Uh, no. That address is assumed to be unique and identifies a specific WiFi radio/client. There is no enforcement for uniqueness, and indeed you can spoof your MAC address.
Assuming the MAC is a unique identifier is always a Bad Idea.
This is physical tracking the randomization is supposed to prevent, not web tracking. It is supposed to prevent law enforcement, or Disneyland, or whoever, from placing a bunch of wifi sniffing devices around the area they wish to track, listening for probes, and tracking your location without you knowing it.
The Daddy casts sleep on the Baby. The Baby resists!
Oh, and to follow up, the devices revert to their hardwired address once they join a network or bluetooth pairs.
The Daddy casts sleep on the Baby. The Baby resists!
Yes, this is why I have 17 different phones. One for home, one for the office, one for the mall, one for the coffee shop, one for Amazon, one for Twitter, etc. It's great because I never see ads that are targeted to me. The only problem is that I'd like to visit my friend in San Fransisco but I can't do it until I get another phone.
And that's why real world experience always trumps what you're taught out of a book. Yes, in theory, all physical addresses are unique. But in practice this has really never been the case. In the mid-2000s I remember tracking down an issue with two brand-name (3Com) NICs having identical MAC addresses.
On a large wired LAN, duplicate MACs can cause issues. Beyond Layer 2, it shouldn't make one lick of difference whether your physical address is unique or not. Of course if you spoof your MAC, you're probably using the MAC of another device, somewhere, out in the wild. But unless they're on the same physical segment (or for cases of large scale DHCP and static leasing, the same LAN) no one will ever know. Any network admin worth their salt already knows that address can very well be duplicated and should have taken steps to mitigate any issues it might cause.
Or are you under the impression that somehow MAC addresses are important to TCP/IP routing on the open internet? Because trust me, it doesn't matter at that level. That's what TCP/IP is for!
I believe this is referring to the passive tracking of unassociated WLAN clients by rogue elements. Once you're associated with an AP and on the open internet, all bets are off because as you said, there are about 1000 better ways to track you at that point other than your MAC address.
Location services turn the wifi radio back on in short blips even in airplane mode or with wifi off, long enough for their active tracking attack to work. Whether the response to the active attack can be quelched by device firmware alterations is not examined in the paper... it could very well be a silicon-encoded behavior to conserve power. Whether said location services include the e911 function is also not explicitly addressed. Whether this fact is a violation of airline policies is also beyond the scope of this paper.
Someone had to do it.