WiFi Relink: Analysis of Plaintext WiFi Side-channels for Unique Device Identification

MAC address randomization is meant to make one phone look like many unrelated strangers to a passive observer. This Master’s thesis at the University of Zurich tests whether a low-cost listener, a Raspberry Pi 5 with an off-the-shelf Intel AX210 card and no software-defined radio, can still re-link a device’s rotating addresses by fusing the side-channels Wi-Fi sends in plaintext, including beamforming feedback from devices that are already connected.

The core is a set of ground-truth controls: a two-receiver capture that separates transmitter identity from receiver artefacts, a scripted rotation oracle on five ESP32-C5 boards that measures true cross-rotation re-linking, and a same-model test that checks whether the fingerprint identifies a unit or only its model. The evaluation covers device count, multi-day drift and deployed defenses, and the thesis closes with countermeasures such as beamforming-feedback obfuscation.

The midterm was presented on 26 October 2026: slides (PDF) and news post.