# A Novel Covert Channel for IEEE 802.11 Networks Utilizing MAC Address Randomization
## 1 Introduction  
As time has progressed, there has been a significant proliferation in the number of mobile devices connected to the Internet. Wireless local area networks (WLANs) are the predominant solution to guarantee Internet connection for those devices. WLANs constitute a fundamental infrastructure for building smart cities, enabling the Internet of Things (IoT), machine-to-machine (M2M) communication, and network traffic offloading from cellular networks, such as LTE and 5G. A forecast anticipates that there will be approximately 628 million public Wi-Fi hotspots by 2023 compared to 169 million hotspots in 2018 [1]. The IEEE 802.11 standard [2] defines the protocols for the physical (PHY) layer and medium access control (MAC) layer for a WLANs, commercially known as Wi-Fi. The PHY describes techniques to regulate transmission rates, while the MAC specifies the procedures for channel access control and frame formats. An access point (AP) bridges client stations (STAs) to the Internet within a WLAN. The STAs associated with an AP form the basic service set (BSS), and before joining the BSS, an unassociated STA has to discover the network by scanning the wireless channel. The standard defines two methods for channel scanning. The first method is passive scanning, where the STA listens to beacon frames transmitted by the AP on the channel. However, passive scanning is disadvantaged due to the longer beacon interval, typically 100 milliseconds (ms). If an STA has a short beacon timeout, it may miss beacons, prolonging the scanning process. The second scanning method is active scanning, in which the STA broadcasts probe request (PR) frames and waits for probe responses from the AP. The STA sends PR frames using its unique global MAC address in plaintext, revealing its presence and identity within a specific geographical area. This information can be processed by anyone with a device capable of collecting WLAN traffic, potentially without the user's consent, and based on the user location pattern, third parties might use the information for various purposes, such as creatinga user profile [3, 4]. Wi-Fi networks are susceptible to various security threats, including unauthorized access, data interception, network spoofing, and malicious attacks targeting vulnerabilities in routers, bridges and client devices [5, 6]. To conceal the device identity and enhance user privacy, modern Wi-Fi devices use disposable random MAC during the scanning process [7]. One particularity of the IEEE 802.11 standard is that devices share the transmission channel [8, 9]. Each device can detect when the channel is busy. As a result, there are no hidden or secret data transmissions. However, devices can create covert channels to conceal their transmissions from other devices. A covert channel is a communication channel that operates without interfering with normal network operations, enabling secret data transmission between two endpoints. Covert channels in IEEE 802.11 are implemented in both the PHY and MAC layers by leveraging specific features of each layer. The primary objective of implementing covert channels in WLANs is to enhance data protection and privacy, providing additional security for sensitive information. This article comprehensively analyzes an IEEE 802.11 covert channel that utilizes MAC address randomization. The study aims to assess the performance of this covert channel and introduces a transmission technique to mitigate the effect of external traffic on it. The research contributions of this study are multi-faceted:  
* Updated analysis of MAC address randomization--We provide an up-to-date analysis of MAC address randomization and its significance in the context of covert channels. This analysis offers a comprehensive understanding of the technique's relevance and implications. * Novel approach to IEEE 802.11 covert channel--We propose and implement a novel approach for covert channels by integrating MAC address randomization within the PR frame.