I Know you were here: Leveraging Probe Request Templates for Identifying Wi-Fi Devices

Identification of Wi-Fi devices through the observation of sent probe requests (PRs) is commonly used for many different use cases. Successful device identification even when MAC address randomization is used poses a risk to privacy but could also assist law enforcement in re-identifying devices of criminals. In this paper, we examine whether MAC de-randomization techniques provide a sufficiently precise way of re-identifying handheld Wi-Fi devices that have previously been observed. In recent research, MAC address de-randomization techniques are adopted for device counting in various use cases. There, distinguishing devices is utilized without the need to specifically identify individual devices or collecting a maximized amount of data. We propose a system that leverages PR finger-printing templates which assist the selection of optimized features for fingerprinting to (re-)identify the target device from an observed anonymity group of devices. This system's performance is evaluated on publicly available as well as newly collected data for modern devices and compared to recently proposed MAC address de-randomization techniques. Using a set of experiments, we demonstrate that modern Wi-Fi devices can be perfectly isolated within the anonymity group of received PRs from nearby modern devices for 75 % of the sampled devices.