Security News > 2021 > May > Latest phones are great at thwarting Wi-Fi tracking. Other devices, not so much – study

The boffins' research paper, "Three Years Later: A Study of MAC Address Randomization In Mobile Devices And When It Succeeds," is scheduled to be presented at PETS, the Privacy Enhancing Technologies Symposium, in July, even though it will be four years later than the initial project [PDF].

Written by Naval Academy researchers Ellis Fenske, Dane Brown, Jeremy Martin, Travis Mayberry, Peter Ryan, and Erik Rye, the paper describes the analysis of 160 mobile phones and the extent to which these devices employ MAC address randomization to mitigate tracking vulnerabilities.

With the debut of iOS 8 in September 2014, Apple became the first major vendor to deploy MAC address randomization, only to take a step backward when iOS 10 debuted - it added its own vendor-specific data to network probe broadcasts to extend the Wi-Fi protocol which made iOS 10 devices trackable despite MAC address randomization.

"Although it is widely known that disabling Wi-Fi on Android and iOS devices does not prevent all Wi-Fi interactions, we did not see a significant number of devices transmitting probe requests with Wi-Fi disabled," the paper says.

In general, the Motorola devices fared poorly when compared to other vendors' devices: Of 21 Motorola devices tested, only the 4th Gen Moto Z uses randomization effectively by applying 46-bit randomization in both active and idle states.

"However, Android is fragmented, and some devices remain vulnerable to certain tracking techniques. Interestingly, Android deployed post-association randomization earlier than iOS, though currently the two handle this problem very similarly."

News URL

https://go.theregister.com/feed/www.theregister.com/2021/05/18/wifi_tracking_failures/