On the process of fixing privacy issues in Wi-Fi enabled devices
Résumé
Several practical privacy issues have been uncovered in Wi-Fi technologies since 2016 [20], [23]. Those issues allow an attacker to defeat address randomization, an anti-tracking mechanism, and thus to track users of wireless devices in the physical world. As recently demonstrated by Martin et. al [12], OS developers and vendors are deploying fixes, and the number of vulnerable devices is progressively decreasing. After presenting a comprehensive overview of three active attacks, we conduct a number of experiments to assess whether those issues have been fixed. Using a sample of Wi-Fi enabled devices we found that although some issues have been corrected, some devices remain vulnerable and expose their users to tracking. We analyze the implementation of countermeasures in wpa_supplicant, the software component in charge of Wi-Fi features in Linux and Android. We found that, even if countermeasures have been available for several years in wpa_supplicant, they are still not always included or activated in deployed OS. We discuss the reasons behind this lack of protection.
Origine : Fichiers produits par l'(les) auteur(s)