State of MAC address randomization

tldr: I went to DragonCon, a conference of 85,000 people, so sniff WiFi packets and test how many phones now uses MAC address randomization. Almost all iPhones nowadays do, but it seems only a third of Android phones do.


Ten years ago at BlackHat, we presented the "data seepage" problem, how the broadcasts from your devices allow you to be tracked. Among the things we highlighted was how WiFi probes looking to connect to access-points expose the unique hardware address burned into the phone, the MAC address. This hardware address is unique to your phone, shared by no other device in the world. Evildoers, such as the NSA or GRU, could install passive listening devices in airports and train-stations around the world in order to track your movements. This could be done with $25 devices sprinkled around a few thousand places -- within the budget of not only a police state, but also the average hacker.

In 2014, with the release of iOS 8, Apple addressed this problem by randomizing the MAC address. Every time you restart your phone, it picks a new, random, hardware address for connecting to WiFi. This causes a few problems: every time you restart your iOS devices, your home network sees a completely new device, which can fill up your router's connection table. Since that table usually has at least 100 entries, this shouldn't be a problem for your home, but corporations and other owners of big networks saw their connection tables suddenly get big with iOS 8.

In 2015, Google added the feature to Android as well. However, even though most Android phones today support this feature in theory, it's usually not enabled.


Recently, I went to DragonCon in order to test out how well this works. DragonCon is a huge sci-fi/fantasy conference in Atlanta in August, second to San Diego's ComicCon in popularity. It's spread across several neighboring hotels in the downtown area. A lot of the traffic funnels through the Marriot Marquis hotel, which has a large open area where, from above, you can see thousands of people at a time.

And, with a laptop, see their broadcast packets.

So I went up on a higher floor and setup my laptop in order to capture "probe" broadcasts coming from phones, in order to record the hardware MAC addresses. I've done this in years past, before address randomization, in order to record the popularity of iPhones. The first three bytes of an old-style, non-randomized address, identifies the manufacturer. This time, I should see a lot fewer manufacturer IDs, and mostly just random addresses instead.

I recorded 9,095 unique probes over a couple hours. I'm not sure exactly how long -- my laptop would go to sleep occasionally because of lack of activity on the keyboard. I should probably setup a Raspberry Pi somewhere next year to get a more consistent result.

A quick summary of the results are:

The 9,000 devices were split almost evenly between Apple and Android. Almost all of the Apple devices randomized their addresses. About a third of the Android devices randomized. (This assumes Android only randomizes the final 3 bytes of the address, and that Apple randomizes all 6 bytes -- my assumption may be wrong).

A table of the major results are below. A little explanation:

• The first item in the table is the number of phones that randomized the full 6 bytes of the MAC address. I'm guessing these are either mostly or all Apple iOS devices. They are nearly half of the total, or 4498 out of 9095 unique probes.
• The second number is those that randomized the final 3 bytes of the MAC address, but left the first three bytes identifying themselves as Android devices. I'm guessing this represents all the Android devices that randomize. My guesses may be wrong, maybe some Androids randomize the full 6 bytes, which would get them counted in the first number.
• The following numbers are phones from major Android manufacturers like Motorola, LG, HTC, Huawei, OnePlus, ZTE. Remember: the first 3 bytes of an un-randomized address identifies who made it. There are roughly 2500 of these devices.
• There is a count for 309 Apple devices. These are either older iOS devices pre iOS 8, or which have turned off the feature (some corporations demand this), or which are actually MacBooks instead of phones.
• The vendor of the access-points that Marriot uses is "Ruckus". There have a lot of access-points in the hotel.
• The "TCT mobile" entry is actually BlackBerry. Apparently, BlackBerry stopped making phones and instead just licenses the software/brand to other hardware makers. If you buy a BlackBerry from the phone store, it's likely going to be a TCT phone instead.
• I'm assuming the "Amazon" devices are Kindle ebooks.
• Lastly, I'd like to point out the two records for "Ford". I was capturing while walking out of the building, I think I got a few cars driving by.

(random)  4498 (Android)  1562 Samsung  646 Motorola  579 Murata  505 LG  412 Apple  309 HTC-phone  226 Huawei  66 Ruckus  60 OnePlus Tec  40 ZTE  23 TCT mobile  20 Amazon Tech  19 Nintendo  17 Intel  14 Microsoft  9 -hp-  8 BLU Product  8 Kyocera  8 AsusTek  6 Yulong Comp  6 Lite-On  4 Sony Mobile  4 Z-COM, INC.  4 ARRIS Group  2 AzureWave  2 Barnes&Nobl  2 Canon  2 Ford Motor  2 Foxconn  2 Google, Inc  2 Motorola (W  2 Sonos, Inc.  2 SparkLAN Co  2 Wi2Wi, Inc  2 Xiaomi Comm  2 Alps Electr  1 Askey  1 BlackBerry  1 Chi Mei Com  1 Clover Netw  1 CNet Techno  1 eSSys Co.,L  1 GoPro  1 InPro Comm  1 JJPlus Corp  1 Private  1 Quanta  1 Raspberry P  1 Roku, Inc.  1 Sonim Techn  1 Texas Instr  1 TP-LINK TEC  1 Vizio, Inc  1