3 ms·
BTW you don't need rocket science to find out who is back home in your neighborhood, or the other room etc. As most people carry phones in pockets/bags so it is
by imhoguy 8y ago
BTW you don't need rocket science to find out who is back home in your neighborhood, or the other room etc. As most people carry phones in pockets/bags so it is enough to just log clients' MAC addresses in WiFi promiscuous mode and then correlate them.
- doikor 8y agoAt least with iPhones if they are not joining the networks but just scanning the MAC addresses are random.
- imhoguy 8y agoConfirmed, however there are/were flaws in MAC randomization, see A Study of MAC Address Randomization in Mobile Devices and When it Fails https://arxiv.org/abs/1703.02874v1 https://arxiv.org/abs/1703.02874v1. Has it been addressed somehow recently?
- JustSomeNobody 8y agoUse a directional antenna and aim it at various houses looking for an uptick random MAC addresses.
- chupasaurus 8y agoWhy not just ye old triangulation?
- forcer 8y agoThat requires being logged to the wi-fi network. The technique that those researchers are proposing does not need that.
- jacobush 8y agoNo? It requires you to just listen to the network.
- mrtbld 8y agoBut without the wifi key it's gibberish and you can't recognize MAC addresses, right?
- jacobush 8y agoYes, that is true, for modern devices that randomize their MAC addresses. I wasn't up to speed on that. But at least you should be able to see that a device was newly connected to the network. (Due to increased traffic between the two.) If the home WiFi does not have very many devices coming and going, you could probably do pattern matching and learn to fingerprint individual devices. At the very least, you should be able to see that "someone is home".
- crankylinuxuser 8y agoAccording to someone at DerbyCon (I know who, but don't have permission to say who), they made the claim that Bluetooth is always on and does not randomize the management frames. And that when phones turn off Bluetooth, they actually just turn off data comms from the BT chip TO the mobile CPU. Their claim was that BT still responds to mgmt frames even when off, doesnt randomize MAC addresses, and some data can even be sent that will then turn on when the BT is 'turned on'. I saw demonstrations of it. It, well, scared and awed me.
- 14 8y agoIs this person planning on releasing their findings soon?
- crankylinuxuser 8y agoI believe they already have on GH. But I'm unable to find it. It was loud in the lobby when they said what repo it was. I'll message them via Twitter and ask for the repo to build their device.
- packet_nerd 8y ago