Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Reduce to the MACs -- Privacy Friendly Generic Probe Requests

Johanna Ansohn McDougall, Alessandro Brighente, Anne Kunstmann, Niklas Zapatka, Hannes Federrath

TL;DR

Active Wi‑Fi discovery via probe requests enables device tracking despite MAC address randomisation. The paper proposes generic probe requests that strip Information Elements (IEs) to the bare minimum while preserving the ability to receive probe responses, and evaluates effects on functionality and privacy. Findings show that the SSID and Supported Rates are sufficient for responses, and reducing to only Supported Rates yields $82.55\%$ of devices in a single anonymity set while keeping $TtT$ measurements meaningful; minimisation does not impede connection establishment. This privacy-friendly approach offers a practical, low-overhead enhancement for Wi‑Fi privacy and can complement existing countermeasures against IE-based fingerprinting.

Abstract

Abstract. Since the introduction of active discovery in Wi-Fi networks, users can be tracked via their probe requests. Although manufacturers typically try to conceal Media Access Control (MAC) addresses using MAC address randomisation, probe requests still contain Information Elements (IEs) that facilitate device identification. This paper introduces generic probe requests: By removing all unnecessary information from IEs, the requests become indistinguishable from one another, letting single devices disappear in the largest possible anonymity set. Conducting a comprehensive evaluation, we demonstrate that a large IE set contained within undirected probe requests does not necessarily imply fast connection establishment. Furthermore, we show that minimising IEs to nothing but Supported Rates would enable 82.55% of the devices to share the same anonymity set. Our contributions provide a significant advancement in the pursuit of robust privacy solutions for wireless networks, paving the way for more user anonymity and less surveillance in wireless communication ecosystems.

Reduce to the MACs -- Privacy Friendly Generic Probe Requests

TL;DR

Active Wi‑Fi discovery via probe requests enables device tracking despite MAC address randomisation. The paper proposes generic probe requests that strip Information Elements (IEs) to the bare minimum while preserving the ability to receive probe responses, and evaluates effects on functionality and privacy. Findings show that the SSID and Supported Rates are sufficient for responses, and reducing to only Supported Rates yields of devices in a single anonymity set while keeping measurements meaningful; minimisation does not impede connection establishment. This privacy-friendly approach offers a practical, low-overhead enhancement for Wi‑Fi privacy and can complement existing countermeasures against IE-based fingerprinting.

Abstract

Abstract. Since the introduction of active discovery in Wi-Fi networks, users can be tracked via their probe requests. Although manufacturers typically try to conceal Media Access Control (MAC) addresses using MAC address randomisation, probe requests still contain Information Elements (IEs) that facilitate device identification. This paper introduces generic probe requests: By removing all unnecessary information from IEs, the requests become indistinguishable from one another, letting single devices disappear in the largest possible anonymity set. Conducting a comprehensive evaluation, we demonstrate that a large IE set contained within undirected probe requests does not necessarily imply fast connection establishment. Furthermore, we show that minimising IEs to nothing but Supported Rates would enable 82.55% of the devices to share the same anonymity set. Our contributions provide a significant advancement in the pursuit of robust privacy solutions for wireless networks, paving the way for more user anonymity and less surveillance in wireless communication ecosystems.
Paper Structure (17 sections, 2 figures, 3 tables)

This paper contains 17 sections, 2 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Background
  3. MAC Addresses
  4. Probe Requests
  5. Connection Establishment in Wi-Fi Networks
  6. Time-to-Traffic
  7. Related Work
  8. Attacks
  9. Countermeasures
  10. Attacker Model
  11. Generic Probe Requests
  12. IE Content Analysis
  13. Proposition: Minimisation of IE content
  14. Impact on Functionality
  15. Impact on Privacy: Anonymity Set Determination
  16. ...and 2 more sections

Figures (2)

  • Figure 1: Measurement points in the TtT-metric. Packet 6 is the starting point, the first probe response to the last probe request sent via a randomised address. The endpoint of the metric is the beginning of data transmission in packet 19.
  • Figure 2: The amount of devices contained in the same anonymity set when the IE content is reduced to contain (a) only Supported Rates, (b) Supported Rates and DS Parameters, and (c) Supported Rates, DS Parameters and HT Capabilities.