Wi-Fi User Profiling via Access Point Honeynets

Until recently Wi-Fi-based user profiling and passive surveillance of the public was straight forward and caused therefore huge privacy concerns. Here Wi-Fi probe request bursts transmitted by a user device, e.g. a mobile phone, were sorted by the device's static MAC address and linked across location and time, therefore giving a detailed location and movement profile of the device's user. To combat this, device manufacturers introduced MAC address randomization in 2014, whereby a device changes its MAC address to a random value between transmissions of probe requests. Devices also switched to a more passive form of scanning for known networks, in which they wait for a beacon frame from a saved network rather than broadcasting the SSID of the network and awaiting a response. While both mechanisms reduce the attack surface and make it harder to track users, it does not fully solve the problem. This paper presents an access point honeypot system that works around both enhancements, therefore allowing tracking and profiling of the public with little effort or expense.