35 ms·

iOS 8 randomises the MAC address while scanning for WiFi networks

442 points by DavidChouinard 12y ago

qq66 12y ago
This is Apple forcing the in-store analytics companies like Euclid to use iBeacon rather than WiFi. With the market share numbers the way they are, though, for all but the highest-end stores what Android does matters more.
- tehwebguy 12y ago
  Yeah, I would guess that you'd get a pretty good sample without any iOS8 devices included. It's still a good thing IMO.
- Fizzadar 12y ago
  Despite this it does allow apple to enable customers to choose by turning bluetooth on/off, and not forcing them to disable wifi to avoid tracking (am I a minority that have bluetooth off by default?).
- bbatsell 12y ago
  I feel like this comment might give a mistaken impression, so I'd like to clarify. Simply rolling out iBeacons does not replicate the copious data that one can currently get by monitoring WiFi probe requests. iBeacons, as designed, broadcast packets at a set rate using Bluetooth LE, and devices scan for those broadcasts. There is no two-way communication, and no probe requests from client devices. In order for a company to use information from an iBeacon installation, they must have software running on the client scanning for unique iBeacon UUIDs, optionally filtered by "major" and "minor" uint16s to represent separate locations and nodes. Apple limits iOS apps to scanning for 20 UUIDs at any given time. If the user does not have software that in some way scans for and does something with data from a particular iBeacon UUID, then the implementer gets no information. Thus, iBeacons move control over location and identity data from third parties to users. If a user installs, say, a Target iOS app, it can now scan for an iBeacon UUID that Target generates and can roll out across the country. Only once the user has made that affirmative choice can Target acquire information about that user or device.
  - djb_hackernews 12y ago
    > iBeacons, as currently designed, broadcast packets at a set rate using Bluetooth LE, and devices scan for those broadcasts. It is possible that iBeacons will provide the copious amounts of data themselves, and this is the first step to that end, as the parent points out.
  - egli 12y ago
    It is also worth noting that apps are only given access to scan for beacons if they have location services enabled. To be tracked using iBeacon, you have to download an app that scans for the correct UUID and have location services enabled for that app.
- abalone 12y ago
  No. iBeacons broadcast their own presence only and cannot be used for surreptitious user tracking. The only way an iBeacon could be used to track is in concert with an app running on the user's phone that communicates back to the business, letting them know you're near the beacon. In other words the user has to opt in to tracking, which is how it should be.
- rsynnott 12y ago
  Using iBeacon wouldn't really be a solution for this, unless the store could depend on a significant proportion of users both installing their app and clicking the "yes, you can talk to iBeacons" option when it first runs. For most stores this won't be the case.
michaelmior 12y ago
I hope it still connects with the real MAC address. Otherwise that could get very problematic.
- Karunamon 12y ago
  Why is that? The only good use that comes to mind is MAC filtering, and that's easily defeated anyways.
  - 0x0 12y ago
    DHCP with static (reserved) IP addresses comes to mind.
    - ams6110 12y ago
      Yes, I do this at home because it resolves the problem of a duplicate IP addresses on the network caused by a device assuming it still has the same IP address (Apple devices seems to do this in particular) while meanwhile another one has taken it.
      - craigyk 12y ago
        What? IME Apple devices are extremely polite about refusing/deactivating IP addresses that are already in use.
        ams6110 12y ago
        My experience is I get home, open my laptop, and it seems to by default assume it has the same IP as last time it was on my home network. Meanwhile my kid's 2DS game is using that IP, and I have a few minutes of chaos. I just assign fixed IPs to all the regularly connected devices and I don't encounter that.
        rsynnott 12y ago
        Are you sure this isn't a router problem? A number of routers have an issue where they occasionally drop their table of DHCP allocations and just start again; this mostly only manifests when a new device connects.
brunnsbe 12y ago
If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.
- pmorici 12y ago
  What stops them from switching to tracking via the hardware address of the cellular radio?
  - gnu8 12y ago
    The needed radio hardware would be more of an engineering and procurement challenge for the typical two-bit analytics startup than wifi radios.
  - shaggyfrog 12y ago
    You can only get that kind of information (e.g. IMEI) if you use IOKit, and you can't submit to the App Store if your app uses IOKit if you're not a part of the MFi (Made for iOS) program, i.e. a hardware manufacturer. Edit: I'm really getting confused with downvoting on HN. How exactly is this comment poor?
    - lbotos 12y ago
      Correct me if I'm wrong, but $tracking_co would just need to get their instore-tracker5000 approved by apple and then they are back to their old ways? I know that may not be cheap/easy for them, but still reasonably within reach.
      - sharth 12y ago
        Wouldn't you also need to install their application? The previous technology used builtin features (wifi scanning).
twistedpair 12y ago
It's about time. I quite intentionally keep my wifi mode off for this reason until I intend to use a network. No doubt someone is tracking and selling every transmission you make. FWIW, once you read about a PoC of an attack/tracking vector on HackaDay, you can be sure it's already in production tracking you. http://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408.html http://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408... https://www.schneier.com/blog/archives/2008/04/tracking_vehicl.html https://www.schneier.com/blog/archives/2008/04/tracking_vehi...
- twistedpair 12y ago
  For the click averse, the above links are * BlueTooth Sniper Rifle * Tracking people by air pressure chips in car tires
therobotking 12y ago
There's a great app for rooted Android devices called Pry-fi that generates random MAC addresses while you're not connected to a network. edit: https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p...
- RexRollman 12y ago
  OpenBSD's ifconfig has a flag that will cause the NIC to use a random MAC address, assuming your card allows for it.
- andor 12y ago
  Thanks for the tip! In reaction to the iOS news, the developer of Pry-Fi wrote this post about the state of the application: https://plus.google.com/+Chainfire/posts/Y4fjP6cH45v https://plus.google.com/+Chainfire/posts/Y4fjP6cH45v Since the phone-specific Wifi stacks/drivers seem to be the main compatibility problem, I guess MAC randomization could be implemented as a Cyanogenmod feature on the device level.
A_COMPUTER 12y ago
MAC address ranges are assigned to device manufacturers, I wonder if they'll only randomize inside the Apple device range or if they'll go outside of it. Analytics companies might start seeing people carrying their sparcstations into the grocery store.
- yuubi 12y ago
  Globally administered MAC address ranges are assigned to manufacturers. The slide said "random, "locally* administered" addresses, which aren't assigned that way. There's a bit in the first octet to distinguish them; see https://en.wikipedia.org/wiki/Ethernet_address#Address_details https://en.wikipedia.org/wiki/Ethernet_address#Address_detai... .
  - maguirre 12y ago
    excuse my ignorance but does that mean if one is to use a locally administered address a device is free to take whatever they please? What would be advantage of paying to the IEEE for a universally administered block?
    - yuubi 12y ago
      > does that mean if one is to use a locally administered address a device is free to take whatever they please? I think those have traditionally been set by network admins, not randomly chosen by devices, but pretty much: nobody apart from local admin coordinates addresses with the local bit set. > What would be advantage of paying to the IEEE for a universally administered block? The promise that no device built by other legit companies will have an address from that assigned block, so customers won't have to worry about MAC address conflicts, provided they use only widgets from those who honor the assignment scheme.
      - eli 12y ago
        Legit devices have had duplicate Mac addresses even though they're not supposed to. In practice a totally random MAC is probably safer than the one assigned to a cheap network card.
captn3m0 12y ago
Is there something like this available for Linux desktops?
- tombrossman 12y ago
  There is a package called macchanger which is said to have the ability to spoof a random MAC address at each reboot. I have a new laptop with Ubuntu 14.04 freshly installed and I can't get it to work though. It's not a high priority but I would like to have this working soon. I used to do this about ten years ago on a laptop running XP and whatever program I was using worked flawlessly. I'm thinking it should be even easier in Linux but haven't found an 'it just works' solution yet.
  - kyboren 12y ago
    IME the most reliable way to do this is with a udev rule. Here's my setup (Fedora, so YMMV). /etc/udev/rules.d/51-macchanger.sh: SUBSYSTEM=="net", ACTION=="add", DRIVERS=="iwlwifi", RUN+="/usr/local/bin/change-mac.sh wlp0s1" /usr/local/bin/change-mac.sh: #!/bin/bash ( if [ "$#" != "1" ] then echo "mac changer script must be given iface name as argument: $@" echo "Using default of wlp0s1 instead." iface="wlp0s1" else iface=$1 fi /usr/sbin/ifconfig $iface down /bin/macchanger -r -b $iface #change to any random MAC address /usr/sbin/ifconfig $iface up ) >/var/log/change-mac Note that you would need to specify the correct interface name in the udev rule (or figure out a way to get it dynamically--I never bothered). This also only works for Intel WiFi cards that use the iwlwifi driver; other cards with different drivers need their udev rule changed appropriately.
yuubi 12y ago
We learned during the prosecution of Swartz that MAC addresses are the analog of VIN number numbers, and that tampering with them is a sign of ill intent. I await the federal case against Apple or an Apple customer with bated breath.
- TazeTSchnitzel 12y ago
  >VIN number numbers PNS syndrome plus one?!
  - pbhjpbhj 12y ago
    What number numbers in VIN number numbers convinces you to number it as a number of numbers that numbers highly enough to be PNS syndrome?
- wmf 12y ago
  It's only a sign of ill intent if nobody does it. If everybody does it (because it's on by default) then it's normal.
- harryh 12y ago
  You're ignoring the drastic differences in context between Swartz's actions and Apples. Context matters.
IBM 12y ago
It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple.
- nitrogen 12y ago
  It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple. It's difficult to reconcile this claim with their participation in PRISM et. al., previous long-term storage of cell tower locations, ownership of a mobile ad network, and wanton abuse of the patent system to stifle competition.
  - viscanti 12y ago
    > and wanton abuse of the patent system to stifle competition. Use (or abuse) of the patent system seems entirely orthogonal to privacy/security.
    - nitrogen 12y ago
      But definitely contradicts a "good citizen/respects you" persona.
      - goldfeld 12y ago
        Big corps would be hard pressed to be "good citizens" or bear anything resembling respectfulness. They're a multitude of individuals with often conflicting interests who are all given the general direction of going for profit. Maybe an exception could be a big company where a founder who really puts his grand vision/values above anything else is still in control, which is not the case (or has ever been for Apple.)
        nitrogen 12y ago
nitrogen 12y ago
Is it randomized using Dual_EC_DRBG? Seriously though, it's something that should have been done a long time ago, and for Bluetooth too. Hopefully no iOS8 users get arrested for changing their MAC addresses.
i_am_ralpht 12y ago
Many Bluetooth LE devices (including iOS 7) do something similar -- otherwise you'd be able to track people by all of their BT LE devices which are constantly advertising their existence. They cycle their advertised MAC addresses every 15 minutes or so (and some provide a "random resolvable address" which you can use to find out the physical BT MAC address after pairing for easier reconnection). From my office in downtown Los Altos, I can currently see a FitBit Flex, a FitBit One and a couple of phones -- the randomized MAC address is all that prevents someone bad from tracking them (BTLE scanners/phones are cheap!). I guess you could still use the 15 minute MAC to track people through a train station or other semi-public space (to gather metrics on where people are coming from and going to). If you had a lot of antennas then you could circumvent the MAC cycling by linking devices in the same area with the same name and similar RSSI...
- stephen_g 12y ago
  Yeah, our road authority uses anonomised Bluetooth tracking to calculate performance measures for particular routes (Automated numberplate recognition cameras are also used sometimes). With Bluetooth, not just phones, but a lot of car stereos advertise their MACs.
antman 12y ago
If only they thought of that a few years ago [1] http://blog.erratasec.com/2013/01/i-conceal-my-identity-same-way-aaron.html http://blog.erratasec.com/2013/01/i-conceal-my-identity-same... I hope all the people with IOS8 won't be charged with wire fraud.
snowplay 12y ago
If only Yosemite would do the same.
- bluedino 12y ago
  You can do it with spoofmac - http://feross.org/spoofmac/ http://feross.org/spoofmac/ It should be easy to wrap some Applescript around it to make it automatic.
jonemo 12y ago
I don't know if anyone does that, but if you are making your access point only discoverable to known devices (i.e. known MAC addresses) then this would be a problem, right?
- rsynnott 12y ago
  I think that's rare enough now that strong encryption is readily available for wireless, but yes, it would be a problem.
ashah 12y ago
they also randomize bluetooth mac address fyi
esbranson 12y ago
I've asked the HostAP mailing list about this as a feature request for wpa_supplicant.[1] From what Jouni Malinen says, it should be relatively straightforward.[2] (I think. I used a poor choice of words in my request.) BTW AFAIK Android uses hostapd/wpa_supplicant. Its beyond by technical abilities, but hopefully someone submits some patches. (Or Jouni graciously does the deed. Because he is awesome.) HINT HINT WINK WINK. [1] http://lists.shmoo.com/pipermail/hostap/2014-June/030405.html http://lists.shmoo.com/pipermail/hostap/2014-June/030405.htm... [2] http://lists.shmoo.com/pipermail/hostap/2014-June/030406.html http://lists.shmoo.com/pipermail/hostap/2014-June/030406.htm...
benmarks 12y ago
Great tech, but am I the only one who noticed "administrated"?
savrajsingh 12y ago
Princeton's guest network allows users to join for up to 3 days a month. I guess this change will nullify that restriction. :)
- Robadob 12y ago
  Once connected the devices will use their actual mac address (else how would mac address filtering work with iphones?), so nothing will be different to usual. But generally yes changing a mac-address can avoid limitation restrictions like this.
thrownaway2424 12y ago
This is interesting. If _I_ did this while trying to find an open network, I'd probably be described by the FBI man who tries to charge me with unauthorized network access as using countermeasures learned from al Qaeda's IT guys. If Apple does it on behalf of users though I'm sure it would be fine. And yes, I've been involved in a criminal proceeding where the government tried to claim that changing a wifi MAC was evidence of malice.
- octo_t 12y ago
  well changing the MAC can be evidence for this: imagine you get banned from your university network for breaking the terms of use (lets say torrenting) - you change your MAC address so you can get back on the network. you know you've been banned and you've made the conscious decision to bypass the security of the network.
Scoundreller 12y ago
Couldn't they just have my device spoof the first smartphone MAC that I see inside the store? That would be a lot more fun.
sirdogealot 12y ago
If you're wanting to accomplish this on your desktop/laptop... check out Arch Linux: https://wiki.archlinux.org/index.php/MAC_Address_Spoofing https://wiki.archlinux.org/index.php/MAC_Address_Spoofing Every single time my laptop boots up, it randomizes it's MAC address.
zaroth 12y ago
I think this is a feature for stores implementing WiFi tracking systems, not a hindrance. If I own a store, I really want to understand traffic patterns. If I can do that without causing a privacy shitstorm, I think that's a benefit.
- nolite 12y ago
  You can't understand patterns from random data. Am I missing something you're seeing?
  - jackcarter 12y ago
    They can still understand when anonymous shoppers arrive and when they leave. However, I think zaroth is underestimating how much more useful it is to track an individual shopper's visits over time.
    - nolite 12y ago
      If the devices now send a random address for each probe request, you can't even do that anymore... all you'll have is a database full of single requests for a ton of random macaddress
  - zaroth 12y ago
    Traffic analysis and some statistical methods should give you a lot of interesting data. Yes it's not individualized long-term tracking, but you can figure out when and where people are visiting, and I think even tease out how long people spend at each point, even if the MAC is randomized for each request.
- jonknee 12y ago
  They can use their extensive existing network of closed circuit video cameras to identify traffic patterns. Unless they want to tie customers to profiles (e.g. MAC to a credit card transaction) the resulting data would be the same. Cameras are even better at this because it counts everyone, smartphone owning or not.
infra178 12y ago
What about Bluetooth?
ColinDabritz 12y ago
I wonder what effects this has on law enforcement. It seems probable that if stores are using systems to track people by WIFI Mac, then law enforcement is probably doing the same. An interesting trade off. Also, does this apply to the other ID being broadcast, the Bluetooth MAC?
- bengali3 12y ago
  Im thinking this wont affect LEOs as they go through cell towers which is not wifi or bt. see: https://www.aclu.org/blog/national-security-technology-and-liberty/us-marshals-seize-local-cops-cell-phone-tracking-files https://www.aclu.org/blog/national-security-technology-and-l...
rsync 12y ago
Depressing that this is not done for OSX as well, but par for the course as iOS remains the focus of apple.
Solok 12y ago
I've got a new iPod touch that I've upgraded to the iOS 8 beta and I'm still seeing probe requests with the real MAC address. I wonder if this feature isn't turned on yet, or if it only works in certain conditions.
stove 12y ago
Has anyone stopped to ask if this is confirmed/true? TechCrunch/Gizmodo/etc... all picked up on this from Frederic's tweet but is a tweet really a definitive news source? Apple has been historically taciturn about documenting these things but does anyone have any more docs or sources for this issue?
elwell 12y ago
RIP Density [0]. [0] - http://www.density.io/ http://www.density.io/
circa 12y ago
This will probably throw Ruckus for a loop - http://www.ruckuswireless.com/products/smart-wireless-services/spot http://www.ruckuswireless.com/products/smart-wireless-servic...
cpeterso 12y ago
Here is the bug requesting this feature in Firefox OS: https://bugzilla.mozilla.org/show_bug.cgi?id=1022444 https://bugzilla.mozilla.org/show_bug.cgi?id=1022444
schoen 12y ago
The FTC held a workshop this spring about location tracking, particularly the retail analytics kind that this is calculated to thwart. I spoke there and was the person on the panel categorically opposed to the tracking (though I placed the blame on the wifi device makers for leaking a tracking identifier, rather than the people taking advantage of the tracking opportunity). http://www.ftc.gov/news-events/events-calendar/2014/02/spring-privacy-series-mobile-device-tracking http://www.ftc.gov/news-events/events-calendar/2014/02/sprin... You can also read the comments that various organizations filed about this: http://www.ftc.gov/policy/public-comments/initiative-516 http://www.ftc.gov/policy/public-comments/initiative-516

442 points by DavidChouinard 12y ago

qq66 12y ago

This is Apple forcing the in-store analytics companies like Euclid to use iBeacon rather than WiFi. With the market share numbers the way they are, though, for all but the highest-end stores what Android does matters more.

tehwebguy 12y ago
Yeah, I would guess that you'd get a pretty good sample without any iOS8 devices included. It's still a good thing IMO.
Fizzadar 12y ago
Despite this it does allow apple to enable customers to choose by turning bluetooth on/off, and not forcing them to disable wifi to avoid tracking (am I a minority that have bluetooth off by default?).
bbatsell 12y ago
I feel like this comment might give a mistaken impression, so I'd like to clarify. Simply rolling out iBeacons does not replicate the copious data that one can currently get by monitoring WiFi probe requests. iBeacons, as designed, broadcast packets at a set rate using Bluetooth LE, and devices scan for those broadcasts. There is no two-way communication, and no probe requests from client devices. In order for a company to use information from an iBeacon installation, they must have software running on the client scanning for unique iBeacon UUIDs, optionally filtered by "major" and "minor" uint16s to represent separate locations and nodes. Apple limits iOS apps to scanning for 20 UUIDs at any given time. If the user does not have software that in some way scans for and does something with data from a particular iBeacon UUID, then the implementer gets no information. Thus, iBeacons move control over location and identity data from third parties to users. If a user installs, say, a Target iOS app, it can now scan for an iBeacon UUID that Target generates and can roll out across the country. Only once the user has made that affirmative choice can Target acquire information about that user or device.
- djb_hackernews 12y ago
  > iBeacons, as currently designed, broadcast packets at a set rate using Bluetooth LE, and devices scan for those broadcasts. It is possible that iBeacons will provide the copious amounts of data themselves, and this is the first step to that end, as the parent points out.
- egli 12y ago
  It is also worth noting that apps are only given access to scan for beacons if they have location services enabled. To be tracked using iBeacon, you have to download an app that scans for the correct UUID and have location services enabled for that app.
abalone 12y ago
No. iBeacons broadcast their own presence only and cannot be used for surreptitious user tracking. The only way an iBeacon could be used to track is in concert with an app running on the user's phone that communicates back to the business, letting them know you're near the beacon. In other words the user has to opt in to tracking, which is how it should be.
rsynnott 12y ago
Using iBeacon wouldn't really be a solution for this, unless the store could depend on a significant proportion of users both installing their app and clicking the "yes, you can talk to iBeacons" option when it first runs. For most stores this won't be the case.

michaelmior 12y ago

I hope it still connects with the real MAC address. Otherwise that could get very problematic.

Karunamon 12y ago
Why is that? The only good use that comes to mind is MAC filtering, and that's easily defeated anyways.
- 0x0 12y ago
  DHCP with static (reserved) IP addresses comes to mind.
  - ams6110 12y ago
    Yes, I do this at home because it resolves the problem of a duplicate IP addresses on the network caused by a device assuming it still has the same IP address (Apple devices seems to do this in particular) while meanwhile another one has taken it.
    - craigyk 12y ago
      What? IME Apple devices are extremely polite about refusing/deactivating IP addresses that are already in use.
      - ams6110 12y ago
        My experience is I get home, open my laptop, and it seems to by default assume it has the same IP as last time it was on my home network. Meanwhile my kid's 2DS game is using that IP, and I have a few minutes of chaos. I just assign fixed IPs to all the regularly connected devices and I don't encounter that.
        rsynnott 12y ago
        Are you sure this isn't a router problem? A number of routers have an issue where they occasionally drop their table of DHCP allocations and just start again; this mostly only manifests when a new device connects.

brunnsbe 12y ago

If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

pmorici 12y ago
What stops them from switching to tracking via the hardware address of the cellular radio?
- gnu8 12y ago
  The needed radio hardware would be more of an engineering and procurement challenge for the typical two-bit analytics startup than wifi radios.
- shaggyfrog 12y ago
  You can only get that kind of information (e.g. IMEI) if you use IOKit, and you can't submit to the App Store if your app uses IOKit if you're not a part of the MFi (Made for iOS) program, i.e. a hardware manufacturer. Edit: I'm really getting confused with downvoting on HN. How exactly is this comment poor?
  - lbotos 12y ago
    Correct me if I'm wrong, but $tracking_co would just need to get their instore-tracker5000 approved by apple and then they are back to their old ways? I know that may not be cheap/easy for them, but still reasonably within reach.
    - sharth 12y ago
      Wouldn't you also need to install their application? The previous technology used builtin features (wifi scanning).

twistedpair 12y ago

It's about time. I quite intentionally keep my wifi mode off for this reason until I intend to use a network. No doubt someone is tracking and selling every transmission you make. FWIW, once you read about a PoC of an attack/tracking vector on HackaDay, you can be sure it's already in production tracking you. http://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408.html http://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408... https://www.schneier.com/blog/archives/2008/04/tracking_vehicl.html https://www.schneier.com/blog/archives/2008/04/tracking_vehi...

twistedpair 12y ago
For the click averse, the above links are * BlueTooth Sniper Rifle * Tracking people by air pressure chips in car tires

therobotking 12y ago

There's a great app for rooted Android devices called Pry-fi that generates random MAC addresses while you're not connected to a network. edit: https://play.google.com/store/apps/details?id=eu.chainfire.pryfi https://play.google.com/store/apps/details?id=eu.chainfire.p...

RexRollman 12y ago
OpenBSD's ifconfig has a flag that will cause the NIC to use a random MAC address, assuming your card allows for it.
andor 12y ago
Thanks for the tip! In reaction to the iOS news, the developer of Pry-Fi wrote this post about the state of the application: https://plus.google.com/+Chainfire/posts/Y4fjP6cH45v https://plus.google.com/+Chainfire/posts/Y4fjP6cH45v Since the phone-specific Wifi stacks/drivers seem to be the main compatibility problem, I guess MAC randomization could be implemented as a Cyanogenmod feature on the device level.

A_COMPUTER 12y ago

MAC address ranges are assigned to device manufacturers, I wonder if they'll only randomize inside the Apple device range or if they'll go outside of it. Analytics companies might start seeing people carrying their sparcstations into the grocery store.

yuubi 12y ago
Globally administered MAC address ranges are assigned to manufacturers. The slide said "random, "locally* administered" addresses, which aren't assigned that way. There's a bit in the first octet to distinguish them; see https://en.wikipedia.org/wiki/Ethernet_address#Address_details https://en.wikipedia.org/wiki/Ethernet_address#Address_detai... .
- maguirre 12y ago
  excuse my ignorance but does that mean if one is to use a locally administered address a device is free to take whatever they please? What would be advantage of paying to the IEEE for a universally administered block?
  - yuubi 12y ago
    > does that mean if one is to use a locally administered address a device is free to take whatever they please? I think those have traditionally been set by network admins, not randomly chosen by devices, but pretty much: nobody apart from local admin coordinates addresses with the local bit set. > What would be advantage of paying to the IEEE for a universally administered block? The promise that no device built by other legit companies will have an address from that assigned block, so customers won't have to worry about MAC address conflicts, provided they use only widgets from those who honor the assignment scheme.
    - eli 12y ago
      Legit devices have had duplicate Mac addresses even though they're not supposed to. In practice a totally random MAC is probably safer than the one assigned to a cheap network card.

captn3m0 12y ago

Is there something like this available for Linux desktops?

tombrossman 12y ago
There is a package called macchanger which is said to have the ability to spoof a random MAC address at each reboot. I have a new laptop with Ubuntu 14.04 freshly installed and I can't get it to work though. It's not a high priority but I would like to have this working soon. I used to do this about ten years ago on a laptop running XP and whatever program I was using worked flawlessly. I'm thinking it should be even easier in Linux but haven't found an 'it just works' solution yet.
- kyboren 12y ago
  IME the most reliable way to do this is with a udev rule. Here's my setup (Fedora, so YMMV). /etc/udev/rules.d/51-macchanger.sh: SUBSYSTEM=="net", ACTION=="add", DRIVERS=="iwlwifi", RUN+="/usr/local/bin/change-mac.sh wlp0s1" /usr/local/bin/change-mac.sh: #!/bin/bash ( if [ "$#" != "1" ] then echo "mac changer script must be given iface name as argument: $@" echo "Using default of wlp0s1 instead." iface="wlp0s1" else iface=$1 fi /usr/sbin/ifconfig $iface down /bin/macchanger -r -b $iface #change to any random MAC address /usr/sbin/ifconfig $iface up ) >/var/log/change-mac Note that you would need to specify the correct interface name in the udev rule (or figure out a way to get it dynamically--I never bothered). This also only works for Intel WiFi cards that use the iwlwifi driver; other cards with different drivers need their udev rule changed appropriately.

yuubi 12y ago

We learned during the prosecution of Swartz that MAC addresses are the analog of VIN number numbers, and that tampering with them is a sign of ill intent. I await the federal case against Apple or an Apple customer with bated breath.

TazeTSchnitzel 12y ago
>VIN number numbers PNS syndrome plus one?!
- pbhjpbhj 12y ago
  What number numbers in VIN number numbers convinces you to number it as a number of numbers that numbers highly enough to be PNS syndrome?
wmf 12y ago
It's only a sign of ill intent if nobody does it. If everybody does it (because it's on by default) then it's normal.
harryh 12y ago
You're ignoring the drastic differences in context between Swartz's actions and Apples. Context matters.

IBM 12y ago

It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple.

nitrogen 12y ago
It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple. It's difficult to reconcile this claim with their participation in PRISM et. al., previous long-term storage of cell tower locations, ownership of a mobile ad network, and wanton abuse of the patent system to stifle competition.
- viscanti 12y ago
  > and wanton abuse of the patent system to stifle competition. Use (or abuse) of the patent system seems entirely orthogonal to privacy/security.
  - nitrogen 12y ago
    But definitely contradicts a "good citizen/respects you" persona.
    - goldfeld 12y ago
      Big corps would be hard pressed to be "good citizens" or bear anything resembling respectfulness. They're a multitude of individuals with often conflicting interests who are all given the general direction of going for profit. Maybe an exception could be a big company where a founder who really puts his grand vision/values above anything else is still in control, which is not the case (or has ever been for Apple.)
      - nitrogen 12y ago

nitrogen 12y ago

Is it randomized using Dual_EC_DRBG? Seriously though, it's something that should have been done a long time ago, and for Bluetooth too. Hopefully no iOS8 users get arrested for changing their MAC addresses.

i_am_ralpht 12y ago

Many Bluetooth LE devices (including iOS 7) do something similar -- otherwise you'd be able to track people by all of their BT LE devices which are constantly advertising their existence. They cycle their advertised MAC addresses every 15 minutes or so (and some provide a "random resolvable address" which you can use to find out the physical BT MAC address after pairing for easier reconnection). From my office in downtown Los Altos, I can currently see a FitBit Flex, a FitBit One and a couple of phones -- the randomized MAC address is all that prevents someone bad from tracking them (BTLE scanners/phones are cheap!). I guess you could still use the 15 minute MAC to track people through a train station or other semi-public space (to gather metrics on where people are coming from and going to). If you had a lot of antennas then you could circumvent the MAC cycling by linking devices in the same area with the same name and similar RSSI...

stephen_g 12y ago
Yeah, our road authority uses anonomised Bluetooth tracking to calculate performance measures for particular routes (Automated numberplate recognition cameras are also used sometimes). With Bluetooth, not just phones, but a lot of car stereos advertise their MACs.

antman 12y ago

If only they thought of that a few years ago [1] http://blog.erratasec.com/2013/01/i-conceal-my-identity-same-way-aaron.html http://blog.erratasec.com/2013/01/i-conceal-my-identity-same... I hope all the people with IOS8 won't be charged with wire fraud.

snowplay 12y ago

If only Yosemite would do the same.

bluedino 12y ago
You can do it with spoofmac - http://feross.org/spoofmac/ http://feross.org/spoofmac/ It should be easy to wrap some Applescript around it to make it automatic.

jonemo 12y ago

I don't know if anyone does that, but if you are making your access point only discoverable to known devices (i.e. known MAC addresses) then this would be a problem, right?

rsynnott 12y ago
I think that's rare enough now that strong encryption is readily available for wireless, but yes, it would be a problem.

ashah 12y ago

they also randomize bluetooth mac address fyi

esbranson 12y ago

I've asked the HostAP mailing list about this as a feature request for wpa_supplicant.[1] From what Jouni Malinen says, it should be relatively straightforward.[2] (I think. I used a poor choice of words in my request.) BTW AFAIK Android uses hostapd/wpa_supplicant. Its beyond by technical abilities, but hopefully someone submits some patches. (Or Jouni graciously does the deed. Because he is awesome.) HINT HINT WINK WINK. [1] http://lists.shmoo.com/pipermail/hostap/2014-June/030405.html http://lists.shmoo.com/pipermail/hostap/2014-June/030405.htm... [2] http://lists.shmoo.com/pipermail/hostap/2014-June/030406.html http://lists.shmoo.com/pipermail/hostap/2014-June/030406.htm...

benmarks 12y ago

Great tech, but am I the only one who noticed "administrated"?

savrajsingh 12y ago

Princeton's guest network allows users to join for up to 3 days a month. I guess this change will nullify that restriction. :)

Robadob 12y ago
Once connected the devices will use their actual mac address (else how would mac address filtering work with iphones?), so nothing will be different to usual. But generally yes changing a mac-address can avoid limitation restrictions like this.

thrownaway2424 12y ago

This is interesting. If _I_ did this while trying to find an open network, I'd probably be described by the FBI man who tries to charge me with unauthorized network access as using countermeasures learned from al Qaeda's IT guys. If Apple does it on behalf of users though I'm sure it would be fine. And yes, I've been involved in a criminal proceeding where the government tried to claim that changing a wifi MAC was evidence of malice.

octo_t 12y ago
well changing the MAC can be evidence for this: imagine you get banned from your university network for breaking the terms of use (lets say torrenting) - you change your MAC address so you can get back on the network. you know you've been banned and you've made the conscious decision to bypass the security of the network.

Scoundreller 12y ago

Couldn't they just have my device spoof the first smartphone MAC that I see inside the store? That would be a lot more fun.

sirdogealot 12y ago

If you're wanting to accomplish this on your desktop/laptop... check out Arch Linux: https://wiki.archlinux.org/index.php/MAC_Address_Spoofing https://wiki.archlinux.org/index.php/MAC_Address_Spoofing Every single time my laptop boots up, it randomizes it's MAC address.

zaroth 12y ago

I think this is a feature for stores implementing WiFi tracking systems, not a hindrance. If I own a store, I really want to understand traffic patterns. If I can do that without causing a privacy shitstorm, I think that's a benefit.

nolite 12y ago
You can't understand patterns from random data. Am I missing something you're seeing?
- jackcarter 12y ago
  They can still understand when anonymous shoppers arrive and when they leave. However, I think zaroth is underestimating how much more useful it is to track an individual shopper's visits over time.
  - nolite 12y ago
    If the devices now send a random address for each probe request, you can't even do that anymore... all you'll have is a database full of single requests for a ton of random macaddress
- zaroth 12y ago
  Traffic analysis and some statistical methods should give you a lot of interesting data. Yes it's not individualized long-term tracking, but you can figure out when and where people are visiting, and I think even tease out how long people spend at each point, even if the MAC is randomized for each request.
jonknee 12y ago
They can use their extensive existing network of closed circuit video cameras to identify traffic patterns. Unless they want to tie customers to profiles (e.g. MAC to a credit card transaction) the resulting data would be the same. Cameras are even better at this because it counts everyone, smartphone owning or not.

infra178 12y ago

What about Bluetooth?

ColinDabritz 12y ago

I wonder what effects this has on law enforcement. It seems probable that if stores are using systems to track people by WIFI Mac, then law enforcement is probably doing the same. An interesting trade off. Also, does this apply to the other ID being broadcast, the Bluetooth MAC?

bengali3 12y ago
Im thinking this wont affect LEOs as they go through cell towers which is not wifi or bt. see: https://www.aclu.org/blog/national-security-technology-and-liberty/us-marshals-seize-local-cops-cell-phone-tracking-files https://www.aclu.org/blog/national-security-technology-and-l...

rsync 12y ago

Depressing that this is not done for OSX as well, but par for the course as iOS remains the focus of apple.

Solok 12y ago

I've got a new iPod touch that I've upgraded to the iOS 8 beta and I'm still seeing probe requests with the real MAC address. I wonder if this feature isn't turned on yet, or if it only works in certain conditions.

stove 12y ago

Has anyone stopped to ask if this is confirmed/true? TechCrunch/Gizmodo/etc... all picked up on this from Frederic's tweet but is a tweet really a definitive news source? Apple has been historically taciturn about documenting these things but does anyone have any more docs or sources for this issue?

elwell 12y ago

RIP Density [0]. [0] - http://www.density.io/ http://www.density.io/

circa 12y ago

This will probably throw Ruckus for a loop - http://www.ruckuswireless.com/products/smart-wireless-services/spot http://www.ruckuswireless.com/products/smart-wireless-servic...

cpeterso 12y ago

Here is the bug requesting this feature in Firefox OS: https://bugzilla.mozilla.org/show_bug.cgi?id=1022444 https://bugzilla.mozilla.org/show_bug.cgi?id=1022444

schoen 12y ago

The FTC held a workshop this spring about location tracking, particularly the retail analytics kind that this is calculated to thwart. I spoke there and was the person on the panel categorically opposed to the tracking (though I placed the blame on the wifi device makers for leaking a tracking identifier, rather than the people taking advantage of the tracking opportunity). http://www.ftc.gov/news-events/events-calendar/2014/02/spring-privacy-series-mobile-device-tracking http://www.ftc.gov/news-events/events-calendar/2014/02/sprin... You can also read the comments that various organizations filed about this: http://www.ftc.gov/policy/public-comments/initiative-516 http://www.ftc.gov/policy/public-comments/initiative-516