Meeting People Over Wi-Fi: Probe Request Profiling & Tracking
JoshInGeneral demonstrates passively harvesting 802.11 probe requests to build behavioral movement profiles, past network histories, and social graphs.
Summary
The Ambient RF Footprint of Connected Mobile Devices
Smartphones, laptops, and wearables continuously broadcast 802.11 probe requests searching for previously connected SSIDs, leaking persistent location histories.
Passively Harvesting and Parsing Probe Requests
JoshInGeneral details deploying passive monitoring nodes to capture MAC addresses, signal strength (RSSI), and requested network names.
Correlating SSIDs to Build Location and Social Profiles
The speaker demonstrates cross-referencing harvested SSIDs against public Wi-Fi mapping databases (Wiggle.net) to uncover home cities, hotels, and employer locations.
Privacy Mitigations and MAC Address Randomization
The author discusses the evolution of mobile MAC randomization and additional privacy settings necessary to prevent RF tracking.
Related talks
Crypto Village·37 min
Emily Crose
Demonstrates how to use Freedom of Information Act requests to uncover government surveillance programs and public agency technology practices.
Main Stage·40 min
Cooper Quintin · Yomna Nasser
Shows how modifying an inexpensive consumer 4G LTE mobile hotspot allows researchers to capture raw network packets and detect IMSI catcher surveillance.
Main Stage·23 min
Alan Meekins
Investigates fixed-address Bluetooth Low Energy beacons in law enforcement gear, body cameras, and consumer IoT, demonstrating long-term tracking.