# A Novel Covert Channel for IEEE 802.11 Networks Utilizing MAC Address Randomization
## 3 MAC Address Randomization
### User Information Disclosure through MAC Address  
Figure 2 presents the format of the PR frame, which allows a STA to discover a proper BSS. This frame consists of a header and a body section. Of particular interest within the header is the source address (SA), which reveals the globally unique MAC address  
Figure 1: MAC address format. of the device. It is important to note that the MAC address goes beyond identifying the device's vendor. It can potentially reveal an individual's identity, posing privacy concerns. Moreover, the MAC address enables data collection for various purposes, which we address in this research by highlighting the most prevalent cases. The experiments conducted in [18] reveal concerning findings regarding the frequency of Wi-Fi device probing and the disclosure of their unique identifiers. The study demonstrates that devices send PRs at a high rate, increasing the number of PRs as the device recognizes more SSIDs. Interestingly, devices continue broadcasting PRs even when connected to a specific BSS. The study concludes that some devices generate approximately 55 PRs per hour. Studies have shown that malicious third parties can exploit the broadcast of user device unique identifiers to collect data, build user profiles, and track individuals across multiple locations with precision. These activities occur without the users' endorsement or consent as highlighted in [19; 20; 21]. The work presented in [4] introduces two attacks designed to track individuals by linking them to their MAC addresses. The first attack is known as the beacon replay attack. In this attack, the adversary collects SSIDs from a specific geographic area, such as residential neighborhoods, and replicates them by broadcasting fake beacons in different locations, such as workplaces or stadiums. The goal is to bait devices to send probe requests revealing their MAC addresses. This method assumes that the likelihood of two individuals sharing the same MAC address, residing at the same home address, working at the same place, or attending the same event is significantly low. The second attack is called the stalker replay attack. As the name implies, once the target has been identified, the attacker follows the target for a specific duration, collecting Wi-Fi data emitted by their devices. The collected data are then analyzed, and the MAC address with the highest frequency during this period is considered the victim's MAC address. The study [22] introduces a novel model for estimating the presence of individuals within a scanning area. The model utilizes a specialized tool called Sherlock [23] to capture probe requests (PRs) transmitted by mobile devices. The model can detect and track the user's arrival, presence, and departure from the monitored area by analyzing the PR parameters. The detection process begins by identifying the first probe request from a user's device. To confirm the user's presence, the monitor waits for subsequent probe requests with the same source MAC address within a specified time window of \(A_{\mathcal{T}}\) slots. The system confirms the user's presence if additional probe requests are received within this time window. On the other hand, if no probe request is detected from the user's device after the designated time slot, the system considers it a potential departure. Confirmation of departure is made after a defined period of \(D_{\mathcal{T}}\) slots elapses without detecting any further probe requests from the user's MAC address. The article [24] presents a comprehensive system designed to collect, store, and analyze PR frames to estimate crowd density and track user movements in indoor environments. The system comprises specialized software on dedicated hardware that monitors the WLAN and cloud-based services that facilitate data collection, storage, and analysis. The system also includes a dashboard to visualize and present the analyzed data. By capturing and analyzing PRs, the system can calculate crowd density within the monitored area.