Wi-Fi told me everything about you Mathieu Cunche INSA-Lyon CITI, - - PowerPoint PPT Presentation

▶
wi fi told me everything about you
SMART_READER_LITE
LIVE PREVIEW

Wi-Fi told me everything about you Mathieu Cunche INSA-Lyon CITI, - - PowerPoint PPT Presentation

Apr 07, 2023 472 likes •854 views

Wi-Fi told me everything about you Mathieu Cunche INSA-Lyon CITI, INRIA-Privatics 6 mars 2014 M. Cunche (INSA-Lyon / INRIA ) Wi-Fi told me everything about you 6 mars 2014 1 / 37 Wi-Fi networking IEEE 802.11 standard Specifications for MAC

slide-1
SLIDE 1

Wi-Fi told me everything about you

Mathieu Cunche

INSA-Lyon CITI, INRIA-Privatics

6 mars 2014

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 1 / 37

slide-2
SLIDE 2

Wi-Fi networking

IEEE 802.11 standard

Specifications for MAC and Physical layers

Information transmitted by frames

Data: upper layer datagrams Management: beacon, probe request/response, ... Control: acknowledgement, ready to send, ...

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 2 / 37

slide-3
SLIDE 3

802.11 frame

Address fields contain MAC addresses (src., dest., ...) MAC address: a unique identifier allocated to a network interface

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 3 / 37

slide-4
SLIDE 4

Wi-Fi service discovery I

Discover surrounding APs and Networks

Passive mode: Wi-Fi Beacons Active mode: Probe requests and Probe Responses Probe requests contain an SSID field to specify the searched network

Active is less costly in energy

Preferred mode for mobile devices

Passive Active

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 4 / 37

slide-5
SLIDE 5

Active service discovery

Information available in cleartext (headers are not encrypted) Broadcasted: dest. Addr. = FF:FF:FF:FF:FF:FF

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 5 / 37

slide-6
SLIDE 6

Active service discovery

Probing frequency

Depends on model, OS version, ... Several cycles per minutes (every 20/30 secs)

5000 10000 15000 20000 25000 30000 35000 40000 50 100 150 200 250 Nb occurence Delta frame (seconds)

Figure: Delta between probes of a Samsung phone.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 6 / 37

slide-7
SLIDE 7

Wi-Fi Fingerprint

Wi-Fi Fingerprint = List of SSIDs broadcasted by a device

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 7 / 37

slide-8
SLIDE 8

Monitoring probe requests

What about encryption (WPA,WPA2, ...)?

Only payload of DATA frames are is encrypted Header are not encrypted Management and Control frame are not encrypted (Probe Requests)

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 8 / 37

slide-9
SLIDE 9

Monitoring probe requests (Demo.)

Wi-Fi interface supporting monitoring mode Traffic capture and analysis tools

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 9 / 37

slide-10
SLIDE 10

Personal information from SSIDs

SSIDs: name of the previously connected networks

Stored in the Configured Network List (CNL) Observed up to 80 configured networks !

SSIDs: personal data Travel history GPS coordinates Social links

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 10 / 37

slide-11
SLIDE 11

Personal information found in SSIDs

Link with a company/university/organisation

INRIA-interne, INSA-INVITE, GlobalCorp Ltd.

Attended conferences

WiSec14, PETs, CCS

Visited places (hotel, restaurant, coffee-shop, airport)

Hilton-NY WiFi, Aloha Hotel WiFi, Brasserie de l’Est, Sydney-airport-WiFi

Individual’s identity

Marc Dupont’s iPhone, Bob Fhisher’s Network

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 11 / 37

slide-12
SLIDE 12

Precise geolocation information

From SSIDs to precise geolocation1

1Ben Greenstein et al. “Can ferris bueller still have his day off? protecting privacy in

an era of wireless devices”. In: In HotOS XI. 2007.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 12 / 37

slide-13
SLIDE 13

Precise geolocation information

WiGLE: Wireless Geographic Logging Engine: Making maps of wireless networks since 2001

SSID, BSSID, channel, security, GPS coordinates, ...

Other databases exist (CIA, Google, Apple, ...)

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 13 / 37

slide-14
SLIDE 14

Inferring social links I

Hypothesis: similarity between Wi-Fi fingerprint can betray social links

People tends to share their Wi-Fi network with people who are close

The experiment: ”I know who you will meet this evening”2

A wild dataset: fingerprints of 8000+ devices A control dataset: fingerprint with 30 existing social links

2Mathieu Cunche, Mohamed-Ali Kaafar, and Roksana Boreli. “Linking wireless

devices using information contained in Wi-Fi probe requests”. In: Pervasive and Mobile Computing (2013), pp. –.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 14 / 37

slide-15
SLIDE 15

Inferring social links I

Frequency of SSIDs

Some are frequent (ex. NETGEAR) Other are rare (ex. Freebox YTC689)

2 4 6 8 10 12 14 T O M I Z O N E @ S y d n e y F e r r i e s N E T G E A R D L I N K l i n k s y s A p p l e S t

  • r

e C i t y R a i l _ W i F i _ T r i a l M c D

  • n

a l d ’ s F R E E W i F i u n i w i d e C a f e S c r e e n _ F r e e _ W i F i u s y d T e l s t r a C B D d e f a u l t W I R E L E S S B

  • i

n g

  • H
  • t

s p

  • t

b e l k i n 5 4 g Fraction of device (%)

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 15 / 37

slide-16
SLIDE 16

Inferring social links I

Quantifying the similarity between fingerprints

Metric considering size and rarity of the intersection

Cosine-IDF and Jaccard index

Cosine-idf(X, Y ) =

  • x∈X∩Y

idfx 2

  • x∈X

idfx 2

  • y∈Y

idfy 2 J(X, Y ) = |X ∩ Y |

|X ∪ Y |

where idfx : inverse document frequency of x

Adamic, modified Adamic

Adamic(X, Y ) =

  • x∈X∩Y

1 log fx

Psim-q(X, Y ) =

  • x∈X∩Y

1 f q

x where fx : document frequency of x

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 16 / 37

slide-17
SLIDE 17

Inferring social links I

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 . 1 . 2 . 3 . 4 . 5 . 6 . 7 . 8 . 9 1 TPR FPR cosine_idf jaccard adamic Psim-3

Performances: detects 80% of social links with less than 8% of error.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 17 / 37

slide-18
SLIDE 18

The end of broadcasted SSIDs ?

The good news: Broadcast Probe Requests

SSID field is left empty AP must responds to all Broadcast Probe Requests Adopted by major vendors to reduce privacy risks

The bad news: Hidden Wi-Fi networks

Hidden: not broadcasting beacons Probing with SSID is the only way to discover Device continuously broadcast SSID of the network

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 18 / 37

slide-19
SLIDE 19

A short parenthesis on RFID

Privacy concerns over RFID Chip embedded in goods (clothes) A combination of RFIDs can constitute a unique ID

”How would you like it if, for instance, one day you realized your underwear was reporting on your whereabouts?” – US Senator Bowen on RFID chips. 2003.

3

3http://digitalcourage.de/

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 19 / 37

slide-20
SLIDE 20

Wi-Fi tracking

Wi-Fi enabled smartphone: portable personal beacon

Broadcast a unique ID Several 10s meters range

Wi-Fi tracking system4

Set of sensors collect Wi-Fi signal Detect and track Wi-Fi devices and their owners

  • 4A. B. M. Musa and Jakob Eriksson. “Tracking unmodified smartphones using

Wi-Fi monitors”. In: Proceedings of the 10th ACM Conference on Embedded Network Sensor Systems. 2012.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 20 / 37

slide-21
SLIDE 21

Wi-Fi tracking: applications

Road monitoring

Measure point-to-point travel time Detect traffic jam

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 21 / 37

slide-22
SLIDE 22

Wi-Fi tracking: applications

Retail, shopping center monitoring Physical analytics

Similar to Web Analytics Frequency and length of visit, number of visitor, peak hour ....

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 22 / 37

slide-23
SLIDE 23

Wi-Fi tracking: applications

Trajectory reconstruction

Triangulation based on signal strength

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 23 / 37

slide-24
SLIDE 24

Wi-Fi tracking: applications

Illustration: monitoring Dx3 20145

5Credits: Aislelabs

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 24 / 37

slide-25
SLIDE 25

Wi-Fi tracking: applications

Current state of Wi-Fi tracking (in the US)

More than 12 tracker companies: Euclid, Navizon, ... Major retailers are getting involved 50 millions individual tracked by Euclid in less than 5 months of activity

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 25 / 37

slide-26
SLIDE 26

Wi-Fi tracking: privacy

Privacy concerns ”People have a fundamental right to privacy, and I think neglecting to ask consumers for their permission to track them violates that right” – Senator Al Franken

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 26 / 37

slide-27
SLIDE 27

Wi-Fi tracking: privacy

Response to privacy concerns

MAC addr. does not contain personal information User notification Opt-out mechanisms MAC addr. is ”anonymized” (Hash function)

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 27 / 37

slide-28
SLIDE 28

Wi-Fi tracking: privacy

The MAC address: not a personal information ?

Unique identifier Collected by mobile applications The missing link between physical and online profile

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 28 / 37

slide-29
SLIDE 29

Wi-Fi tracking: privacy

Opt-Out mechanism

By default your activity is recorded Opt-Out service: enter your MAC address

Is this a good idea to give out your MAC addr. ? Can your grand-mother find her MAC addr. ?

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 29 / 37

slide-30
SLIDE 30

Wi-Fi tracking: privacy

The failure of hash-based anonymization of MAC addr.

Trackers: Don’t worry we don’t store the MAC in clear Irreversible operation: hashing, scrambling, .... Can be de-anonymized6

In ∼ 1 day using high-end GPU In a handful of seconds by exploiting skewed MAC addr. distribution.

200 400 600 800 0.0 0.2 0.4 0.6 0.8 1.0 rank Fn(x)

  • 6Mathieu Cunche, Levent Demir, and C´

edric Lauradoux. “Anomymization for Small Domains: the case of MAC address”. In: Atelier sur la Protection de la Vie Priv´ ee - APVP 2013. June 2013.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 30 / 37

slide-31
SLIDE 31

Wi-Fi tracking: privacy

How to obtain the MAC addr. of an individual ?

Without a physical access

Beacon replay attack

Home/work locations uniqueness

Stalker attack

Simply follow the target in the streets

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 31 / 37

slide-32
SLIDE 32

Wi-Fi tracking

London’s Wi-Fi bins

Detect individuals via Wi-Fi Display targeted advertisement on screen Based on a user profile: consuming habits, gender, ...

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 32 / 37

slide-33
SLIDE 33

Wi-Fi tracking

Figure: Seen at La Vall´ ee Village shopping center (near Paris).

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 33 / 37

slide-34
SLIDE 34

Wi-Fi tracking: privacy

Other field of application7

Surveillance: CIA, NSA, GCHQ, ... Surveillance: private (stalkers) Triggered ”events”

7Mathieu Cunche. “I know your MAC Address: Targeted tracking of individual using

Wi-Fi”. In: International Symposium on Research in Grey-Hat Hacking - GreHack. Grenoble, France, Nov. 2013.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 34 / 37

slide-35
SLIDE 35

Countermeasures (short-term)

Geofencing

Wi-Fi only activated in trusted places (home, office, ...) Apps: Wi-Fi Matic8 and AVG Privacy Fix9

MAC address Spoofing

Periodically change MAC address to a random value

10

8https://play.google.com/store/apps/details?id=org.cprados.wificellmanager 9https://play.google.com/store/apps/details?id=com.avg.privacyfix

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 35 / 37

slide-36
SLIDE 36

Countermeasures (long-term)

Significant modification of the 802.11 protocols11

Encrypt/obfuscate all identifiers in the 802.11 protocol Issues with retro-compatibility Not before several years (decades ?)

11Janne Lindqvist et al. “Privacy-preserving 802.11 access-point discovery”. In:

WiSec ’09. 2009.

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 36 / 37

slide-37
SLIDE 37

Questions ?

Figure: Artist’s interpretation12.

12credit P. Treimany

  • M. Cunche (INSA-Lyon / INRIA )

Wi-Fi told me everything about you 6 mars 2014 37 / 37