What Your Wearable Devices Revealed About You and Possibilities of Non-Cooperative 802.11 Presence Detection During Your Last IPIN Visit

TL;DR

This paper analyzes Wi-Fi probe requests at a conference to assess privacy risks, revealing that many devices can be tracked despite MAC address randomization, highlighting privacy vulnerabilities in wireless protocols.

Contribution

It demonstrates non-cooperative detection of device presence using 802.11 frames without identifying users, showing privacy implications of current device behaviors.

Findings

Many devices do not use MAC randomization.

Devices can be tracked despite MAC randomization.

Significant privacy risks remain in Wi-Fi protocols.

Abstract

The focus on privacy-related measures regarding wireless networks grew in last couple of years. This is especially important with technologies like Wi-Fi or Bluetooth, which are all around us and our smartphones use them not just for connection to the internet or other devices, but for localization purposes as well. In this paper, we analyze and evaluate probe request frames of 802.11 wireless protocol captured during the 11th international conference on Indoor Positioning and Indoor Navigation (IPIN) 2021. We explore the temporal occupancy of the conference space during four days of the conference as well as non-cooperatively track the presence of devices in the proximity of the session rooms using 802.11 management frames, with and without using MAC address randomization. We carried out this analysis without trying to identify/reveal the identity of the users or in any way reverse the MAC address randomization. As a result of the analysis, we detected that there are still many devices not adopting MAC randomization, because either it is not implemented, or users disabled it. In addition, many devices can be easily tracked despite employing MAC randomization.