iOS 8 randomises the MAC address while scanning for WiFi networks

If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple.

This is Apple forcing the in-store analytics companies like Euclid to use iBeacon rather than WiFi. With the market share numbers the way they are, though, for all but the highest-end stores what Android does matters more.

It&#x27;s about time. I quite intentionally keep my wifi mode off for this reason until I intend to use a network. No doubt someone is tracking and selling every transmission you make.<p>FWIW, once you read about a PoC of an attack&#x2F;tracking vector on HackaDay, you can be sure it&#x27;s already in production tracking you.<p><a href="http://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408.html" rel="nofollow">http:&#x2F;&#x2F;www.tomsguide.com&#x2F;us&#x2F;how-to-bluesniper-pt1,review-408...</a><p><a href="https://www.schneier.com/blog/archives/2008/04/tracking_vehicl.html" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2008&#x2F;04&#x2F;tracking_vehi...</a>

MAC address ranges are assigned to device manufacturers, I wonder if they&#x27;ll only randomize inside the Apple device range or if they&#x27;ll go outside of it. Analytics companies might start seeing people carrying their sparcstations into the grocery store.

This is interesting. If _I_ did this while trying to find an open network, I&#x27;d probably be described by the FBI man who tries to charge me with unauthorized network access as using countermeasures learned from al Qaeda&#x27;s IT guys. If Apple does it on behalf of users though I&#x27;m sure it would be fine.<p>And yes, I&#x27;ve been involved in a criminal proceeding where the government tried to claim that changing a wifi MAC was evidence of malice.

We learned during the prosecution of Swartz that MAC addresses are the analog of VIN number numbers, and that tampering with them is a sign of ill intent. I await the federal case against Apple or an Apple customer with bated breath.

There&#x27;s a great app for rooted Android devices called Pry-fi that generates random MAC addresses while you&#x27;re not connected to a network.<p>edit: <a href="https://play.google.com/store/apps/details?id=eu.chainfire.pryfi" rel="nofollow">https:&#x2F;&#x2F;play.google.com&#x2F;store&#x2F;apps&#x2F;details?id=eu.chainfire.p...</a>

Many Bluetooth LE devices (including iOS 7) do something similar -- otherwise you&#x27;d be able to track people by all of their BT LE devices which are constantly advertising their existence. They cycle their advertised MAC addresses every 15 minutes or so (and some provide a &quot;random resolvable address&quot; which you can use to find out the physical BT MAC address after pairing for easier reconnection).<p>From my office in downtown Los Altos, I can currently see a FitBit Flex, a FitBit One and a couple of phones -- the randomized MAC address is all that prevents someone bad from tracking them (BTLE scanners&#x2F;phones are cheap!).<p>I guess you could still use the 15 minute MAC to track people through a train station or other semi-public space (to gather metrics on where people are coming from and going to). If you had a lot of antennas then you could circumvent the MAC cycling by linking devices in the same area with the same name and similar RSSI...

Is there something like this available for Linux desktops?

If you&#x27;re wanting to accomplish this on your desktop&#x2F;laptop... check out Arch Linux: <a href="https://wiki.archlinux.org/index.php/MAC_Address_Spoofing" rel="nofollow">https:&#x2F;&#x2F;wiki.archlinux.org&#x2F;index.php&#x2F;MAC_Address_Spoofing</a><p>Every single time my laptop boots up, it randomizes it&#x27;s MAC address.

The FTC held a workshop this spring about location tracking, particularly the retail analytics kind that this is calculated to thwart. I spoke there and was the person on the panel categorically opposed to the tracking (though I placed the blame on the wifi device makers for leaking a tracking identifier, rather than the people taking advantage of the tracking opportunity).<p><a href="http://www.ftc.gov/news-events/events-calendar/2014/02/spring-privacy-series-mobile-device-tracking" rel="nofollow">http:&#x2F;&#x2F;www.ftc.gov&#x2F;news-events&#x2F;events-calendar&#x2F;2014&#x2F;02&#x2F;sprin...</a><p>You can also read the comments that various organizations filed about this:<p><a href="http://www.ftc.gov/policy/public-comments/initiative-516" rel="nofollow">http:&#x2F;&#x2F;www.ftc.gov&#x2F;policy&#x2F;public-comments&#x2F;initiative-516</a>

If only they thought of that a few years ago [1] <a href="http://blog.erratasec.com/2013/01/i-conceal-my-identity-same-way-aaron.html" rel="nofollow">http:&#x2F;&#x2F;blog.erratasec.com&#x2F;2013&#x2F;01&#x2F;i-conceal-my-identity-same...</a><p>I hope all the people with IOS8 won&#x27;t be charged with wire fraud.

I&#x27;ve asked the HostAP mailing list about this as a feature request for wpa_supplicant.[1] From what Jouni Malinen says, it should be relatively straightforward.[2] (I think. I used a poor choice of words in my request.)<p>BTW AFAIK Android uses hostapd&#x2F;wpa_supplicant.<p>Its beyond by technical abilities, but hopefully someone submits some patches. (Or Jouni graciously does the deed. Because he is awesome.) HINT HINT WINK WINK.<p>[1] <a href="http://lists.shmoo.com/pipermail/hostap/2014-June/030405.html" rel="nofollow">http:&#x2F;&#x2F;lists.shmoo.com&#x2F;pipermail&#x2F;hostap&#x2F;2014-June&#x2F;030405.htm...</a><p>[2] <a href="http://lists.shmoo.com/pipermail/hostap/2014-June/030406.html" rel="nofollow">http:&#x2F;&#x2F;lists.shmoo.com&#x2F;pipermail&#x2F;hostap&#x2F;2014-June&#x2F;030406.htm...</a>

I wonder what effects this has on law enforcement. It seems probable that if stores are using systems to track people by WIFI Mac, then law enforcement is probably doing the same. An interesting trade off.<p>Also, does this apply to the other ID being broadcast, the Bluetooth MAC?

I hope it still connects with the real MAC address. Otherwise that could get very problematic.

This will probably throw Ruckus for a loop - <a href="http://www.ruckuswireless.com/products/smart-wireless-services/spot" rel="nofollow">http:&#x2F;&#x2F;www.ruckuswireless.com&#x2F;products&#x2F;smart-wireless-servic...</a>

I don&#x27;t know if anyone does that, but if you are making your access point only discoverable to known devices (i.e. known MAC addresses) then this would be a problem, right?

Has anyone stopped to ask if this is confirmed&#x2F;true? TechCrunch&#x2F;Gizmodo&#x2F;etc... all picked up on this from Frederic&#x27;s tweet but is a tweet really a definitive news source? Apple has been historically taciturn about documenting these things but does anyone have any more docs or sources for this issue?

Depressing that this is not done for OSX as well, but par for the course as iOS remains the focus of apple.

RIP Density [0].<p>[0] - <a href="http://www.density.io/" rel="nofollow">http:&#x2F;&#x2F;www.density.io&#x2F;</a>

I think this is a <i>feature</i> for stores implementing WiFi tracking systems, not a hindrance. If I own a store, I <i>really</i> want to understand traffic patterns. If I can do that without causing a privacy shitstorm, I think that&#x27;s a benefit.

I&#x27;ve got a new iPod touch that I&#x27;ve upgraded to the iOS 8 beta and I&#x27;m still seeing probe requests with the real MAC address. I wonder if this feature isn&#x27;t turned on yet, or if it only works in certain conditions.

Is it randomized using Dual_EC_DRBG? Seriously though, it&#x27;s something that should have been done a long time ago, and for Bluetooth too. Hopefully no iOS8 users get arrested for changing their MAC addresses.

Here is the bug requesting this feature in Firefox OS: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1022444" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1022444</a>

Princeton&#x27;s guest network allows users to join for up to 3 days a month. I guess this change will nullify that restriction. :)

Couldn&#x27;t they just have my device spoof the first smartphone MAC that I see inside the store? That would be a lot more fun.

Great tech, but am I the only one who noticed &quot;administrated&quot;?

they also randomize bluetooth mac address fyi

If only Yosemite would do the same.

What about Bluetooth?