Hacker News Reader

Comment by forcer | Hacker News Reader

That requires being logged to the wi-fi network. The technique that those researchers are proposing does not need that.

No? It requires you to just listen to the network.

But without the wifi key it's gibberish and you can't recognize MAC addresses, right?

Yes, that is true, for modern devices that randomize their MAC addresses. I wasn't up to speed on that. But at least you should be able to see that a device was newly connected to the network. (Due to increased traffic between the two.) If the home WiFi does not have very many devices coming and going, you could probably do pattern matching and learn to fingerprint individual devices. At the very least, you should be able to see that "someone is home".

According to someone at DerbyCon (I know who, but don't have permission to say who), they made the claim that Bluetooth is always on and does not randomize the management frames. And that when phones turn off Bluetooth, they actually just turn off data comms from the BT chip TO the mobile CPU.

Their claim was that BT still responds to mgmt frames even when off, doesnt randomize MAC addresses, and some data can even be sent that will then turn on when the BT is 'turned on'.

I saw demonstrations of it. It, well, scared and awed me.

Is this person planning on releasing their findings soon?

I believe they already have on GH. But I'm unable to find it. It was loud in the lobby when they said what repo it was.

I'll message them via Twitter and ask for the repo to build their device.

No, my understanding is that the MAC address is always visible, even on wifi networks in WPA/WPA2 personal or enterprise mode.

Also, I believe modern phones randomize their MACs when they scan for networks, but use their real MAC when they connect, and that's visible to anyone within listening range.

Btw, most "guest" wifi networks rely on MAC-based access control, using these same publicly visible MAC addresses.. it's an inherent weakness of the wifi standards and I think the main reason why devices can't randomize their MACs when actually connecting.

Reply on news.ycombinator.com