Midterm: Can a Passive Listener Re-link Randomized Wi-Fi Devices?

On Monday, 26 October, Nils Grob presented the midterm of his Master’s thesis WiFi Relink at the University of Zurich. Nils is a Master’s student at UZH, advised by Bruno Rodrigues, Karim Khamaisi, Katharina O. E. Müller and Burkhard Stiller.

The midterm slides (PDF) are available.

Phones protect their owners from tracking with one main mechanism, MAC address randomization. A device swaps its Wi-Fi address for a fresh random one, so a passive observer should see many unrelated strangers instead of one person moving through a shop or a station. The thesis asks whether that promise holds against a cheap, passive listener in radio range, with no software-defined radio.

The setup. Nils built on a research prototype that already captured channel state and beamforming feedback, and added what it lacked: a MAC-rotation oracle and the feature analysis. Five ESP32-C5 boards with custom firmware play the targets. Each rotates its MAC address every 15 minutes and generates traffic, while a static IP pool records which board is which. Two Raspberry Pi 5 sniffers with an Intel AX210 card listen passively. They capture only what Wi-Fi sends in the clear, above all the beamforming feedback (BFI) that connected devices report to their access point. These frames keep flowing after a device has joined a network, exactly where classic probe-request de-randomization goes blind.

First results. The midterm focused on the hard direction: linking the rotated addresses of the same device back together, not just telling devices apart. In a five-day run with stationary boards, the BFI features already separate same-device pairs that span a MAC rotation from different-device pairs far better than signal strength.

The amplitude of the beamforming matrix reaches an AUC of 0.89, while signal strength alone stays at 0.60 and depends on how the sniffers’ antennas are set up. Only two of the test boards worked in that first run. In the second, eight-day run with all five boards, clustering was almost perfect until the boards were moved to a new location. The per-day feature scores dipped sharply on the day of the move and the clusters split, so the fingerprint is still sensitive to location.

Next steps. Nils will explore timing attacks on the BFI sounding exchange, preprocess the steering matrix beyond plain decoding, and run more experiments.

The work sits on the offensive side, and that is its value. It shows what a passive listener in radio range can learn without ever joining a network, and it points to concrete fixes, such as obfuscating beamforming feedback, that standards bodies and device vendors can adopt.