802.11 user fingerprinting

ABSTRACT

The ubiquity of 802.11 devices and networks enables anyone to track our every move with alarming ease. Each 802.11 device transmits a globally unique and persistent MAC address and thus is trivially identifiable. In response, recent research has proposed replacing such identifiers with pseudonyms (i.e., temporary, unlinkable names). In this paper, we demonstrate that pseudonyms are insufficient to prevent tracking of 802.11 devices because implicit identifiers, or identifying characteristics of 802.11 traffic, can identify many users with high accuracy. For example, even without unique names and addresses, we estimate that an adversary can identify 64% of users with 90% accuracy when they spend a day at a busy hot spot. We present an automated procedure based on four previously unrecognized implicit identifiers that can identify users in three real 802.11 traces even when pseudonyms and encryption are employed. We find that the majority of users can be identified using our techniques, but our ability to identify users is not uniform; some users are not easily identifiable. Nonetheless, we show that even a single implicit identifier is sufficient to distinguish many users. Therefore, we argue that design considerations beyond eliminating explicit identifiers (i.e., unique names and addresses), must be addressed in order to prevent user tracking in wireless networks.

REFERENCES

• 1: Big boss is watching. CNET News.com, Sept. 2004. http://news.com. com/Big+boss+is+watching/2100-1036_3-5379953.html.
• 2: Wireless location tracking draws privacy questions. CNET News.com, May 2006. http://news.com.com/Wireless+location+tracking+draws+privacy+questions/2100-1028_3-6072992.html.
• 3: Wi-fi hacking, with a handheld PDA. ZDNet, Feb. 2007. http://blogs.zdnet.com/security/?p=19.
• 4: Martín Abadi , Cédric Fournet, Private authentication, Theoretical Computer Science, v.322 n.3, p.427-476, 6 September 2004 [doi>10.1016/j.tcs.2003.12.023]
• 5: Aditya Akella , Glenn Judd , Srinivasan Seshan , Peter Steenkiste, Self-management in chaotic wireless deployments, Proceedings of the 11th annual international conference on Mobile computing and networking, August 28-September 02, 2005, Cologne, Germany [doi>10.1145/1080829.1080849]
• 6: BAHL, P., AND PADMANABHAN, V. N. RADAR: An in-building RF-based user location and tracking system. In INFOCOM (2000).
• 7: Alastair R. Beresford , Frank Stajano, Location Privacy in Pervasive Computing, IEEE Pervasive Computing, v.2 n.1, p.46-55, January 2003 [doi>10.1109/MPRV.2003.1186725]
• 8: BISSIAS, G., LIBERATORE, M., JENSEN, D., AND LEVINE, B. N. Privacy vulnerabilities in encrypted http streams. In Proc. Privacy Enhancing Technologies Workshop (2005).
• 9: BRESLAU, L., CAO, P., FAN, L., PHILLIPS, G., AND SHENKER, S. Web caching and Zipf-like distributions: Evidence and implications. In INFOCOM (1999).
• 10: Yu-Chung Cheng , John Bellardo , Péter Benkö , Alex C. Snoeren , Geoffrey M. Voelker , Stefan Savage, Jigsaw: solving the puzzle of enterprise 802.11 analysis, ACM SIGCOMM Computer Communication Review, v.36 n.4, October 2006
• 11: Jason Franklin , Damon McCoy , Parisa Tabriz , Vicentiu Neagoe , Jamie Van Randwyk , Douglas Sicker, Passive data link layer 802.11 wireless device driver fingerprinting, Proceedings of the 15th conference on USENIX Security Symposium, p.12-12, July 31-August 04, 2006, Vancouver, B.C., Canada
• 12: FYODOR. Nmap network security scanner. http://insecure.org/nmap/.
• 13: Simson L. Garfinkel , Ari Juels , Ravi Pappu, RFID Privacy: An Overview of Problems and Proposed Solutions, IEEE Security and Privacy, v.3 n.3, p.34-43, May 2005 [doi>10.1109/MSP.2005.78]
• 14: Marco Gruteser , Dirk Grunwald, Enhancing location privacy in wireless LAN through disposable interface identifiers: a quantitative analysis, Mobile Networks and Applications, v.10 n.3, p.315-325, June 2005 [doi>10.1007/s11036-005-6425-1]
• 15: HAVERINEN, H., AND SALOWEY, J. Extensible authentication protocol method for global system for mobile communications (GSM) subscriber identity modules (EAP-SIM), 2006. IETF RFC 4186. http://www.ietf.org/rfc/rfc4186.txt.
• 16: IEEE 802.11i-2004 amendment to IEEE std 802.11, 2004.
• 17: IETF geographic location/privacy working group charter. http://www.ietf.org/html.charters/geopriv-charter.html.
• 18: Tao Jiang , Helen J. Wang , Yih-Chun Hu, Preserving location privacy in wireless lans, Proceedings of the 5th international conference on Mobile systems, applications and services, June 11-13, 2007, San Juan, Puerto Rico [doi>10.1145/1247660.1247689]
• 19: Thomas Karagiannis , Andre Broido , Michalis Faloutsos , Kc claffy, Transport layer identification of P2P traffic, Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, October 25-27, 2004, Taormina, Sicily, Italy [doi>10.1145/1028788.1028804]
• 20: Thomas Karagiannis , Konstantina Papagiannaki , Michalis Faloutsos, BLINC: multilevel traffic classification in the dark, ACM SIGCOMM Computer Communication Review, v.35 n.4, October 2005
• 21: Tadayoshi Kohno , Andre Broido , K. C. Claffy, Remote Physical Device Fingerprinting, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.211-225, May 08-11, 2005 [doi>10.1109/SP.2005.18]
• 22: Location privacy protection act of 2001. U.S. Senate bill.
• 23: MICROSOFT. Wireless Client Update for Windows XP with service pack 2, http://support.microsoft.com/kb/917021.
• 24: Fabian Monrose , Aviel Rubin, Authentication via keystroke dynamics, Proceedings of the 4th ACM conference on Computer and communications security, p.48-56, April 01-04, 1997, Zurich, Switzerland [doi>10.1145/266420.266434]
• 25: Andrew W. Moore , Denis Zuev, Internet traffic classification using bayesian analysis techniques, ACM SIGMETRICS Performance Evaluation Review, v.33 n.1, June 2005
• 26: MORRIS, R. http://pdos.csail.mit.edu/~rtm/.
• 27: MUNIWIRELESS. http://www.muniwireless.com/.
• 28: p0f. http://freshmeat.net/projects/p0f/.
• 29: PADMANABHAN, B., AND YANG, Y. Clickprints on the web: Are there signatures in web browsing data? http://knowledge.wharton.upenn.edu/papers/1323.pdf, 2006.
• 30: R DEVELOPMENT CORE TEAM. R: A Language and Environment for Statistical Computing, 2006. http://www.R-project.org.
• 31: RODRIG, M., REIS, C., MAHAJAN, R., WETHERALL, D., ZAHORJAN, J., AND LAZOWSKA, E. CRAWDAD data set uw/sigcomm2004 (v. 2006-10-17). http://crawdad.cs.dartmouth.edu/meta.php?name=uw/sigcomm2004, Oct. 2006.
• 32: Roofnet. http://pdos.csail.mit.edu/roofnet/.
• 33: Dawn Xiaodong Song , David Wagner , Xuqing Tian, Timing analysis of keystrokes and timing attacks on SSH, Proceedings of the 10th conference on USENIX Security Symposium, p.25-25, August 13-17, 2001, Washington, D.C.
• 34: Qixiang Sun , Daniel R. Simon , Yi-Min Wang , Wilf Russell , Venkata N. Padmanabhan , Lili Qiu, Statistical Identification of Encrypted Web Browsing Traffic, Proceedings of the 2002 IEEE Symposium on Security and Privacy, p.19, May 12-15, 2002
• 35: Ping Tao , Algis Rudys , Andrew M. Ladd , Dan S. Wallach, Wireless LAN location-sensing for security applications, Proceedings of the 2nd ACM workshop on Wireless security, September 19-19, 2003, San Diego, CA, USA [doi>10.1145/941311.941314]
• 36: Linda Tauscher , Saul Greenberg, How people revisit web pages: empirical findings and implications for the design of history systems, International Journal of Human-Computer Studies, v.47 n.1, p.97-137, July 1997 [doi>10.1006/ijhc.1997.0125]
• 37: tcpdump. http://www.tcpdump.org/.
• 38: C. J. Van Rijsbergen, Information Retrieval, Butterworth-Heinemann, Newton, MA, 1979
• 39: WIGLE. http://www.wigle.net/.
• 40: Wireless privacy protection act of 2005. U.S. House bill.
• 41: WONG, F.-L., AND STAJANO, F. Location privacy in bluetooth. In ESAS (2005).
• 42: Charles V. Wright , Fabian Monrose , Gerald M. Masson, On Inferring Application Protocol Behaviors in Encrypted Network Traffic, The Journal of Machine Learning Research, 7, p.2745-2769, 12/1/2006
• 43: Sebastian Zander , Thuy Nguyen , Grenville Armitage, Automated Traffic Classification and Application Identification using Machine Learning, Proceedings of the The IEEE Conference on Local Computer Networks 30th Anniversary, p.250-257, November 15-17, 2005 [doi>10.1109/LCN.2005.35]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.1 Network Architecture and Design

General Terms:
Measurement, Security

Keywords:
802.11, anonymity, privacy, wireless