The non-random (burned-in) MAC was used for both broadcast and specific SSIDs. If anyone is interested I can send them the .pcap file.
Eric J. Kenny Network & Security Engineer Marist College 3399 North Rd. Poughkeepsie, NY 12601 845.575.3820 -----The EDUCAUSE Wireless Issues Constituent Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> wrote: -----To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU From: Frank Sweetser Sent by: The EDUCAUSE Wireless Issues Constituent Group Listserv Date: 06/10/2014 07:18PM Subject: Re: [WIRELESS-LAN] iOS8 and randomized mac addresses Did you see the non-random MAC address in broadcast SSID probe requests, or only in SSID specific ones? My impression is that the randomization would only be performed in broadcast probes. Frank Sweetser fs at wpi.edu | For every problem, there is a solution that Manager of Network Operations | is simple, elegant, and wrong. Worcester Polytechnic Institute | - HL Mencken On 6/10/2014 9:12 AM, Eric Kenny wrote: > I can confirm that my iPhone 5s with iOS 8 beta does NOT randomize the MAC > address in probe requests. This was determined by capturing and analyzing the > probe request frames. > > Thanks, > > Eric J. Kenny > > Network & Security Engineer > > Marist College > > 3399 North Rd. > > Poughkeepsie, NY 12601 > > 845.575.3820 > > *From:*The EDUCAUSE Wireless Issues Constituent Group Listserv > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> [mailto:The EDUCAUSE Wireless Issues > Constituent Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>] *On Behalf Of > *Frank Sweetser <f...@wpi.edu> > *Sent:* Tuesday, June 10, 2014 9:03 AM > *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU > *Subject:* Re: [WIRELESS-LAN] iOS8 and randomized mac addresses > > > From what I can tell, they're only randomizing the MAC address on probe > requests. It appears to still use the burned in MAC address for association > and all subsequent traffic. > > That said, I'd love for someone with an iOS 8 device and a suitable wireless > sniffer rig to confirm this guess =) > > Frank Sweetser fs at wpi.edu | For every problem, there is a solution that > Manager of Network Operations | is simple, elegant, and wrong. > Worcester Polytechnic Institute | - HL Mencken > > On 06/10/2014 08:54 AM, Lee H Badman wrote: > > ​For historical tracking, could be pretty rough especially when > individual > > users have multiple devices. > > > > > > *Lee H. Badman* > > Network Architect/Wireless TME > > ITS, Syracuse University > > 315.443.3003 > > > ------------------------------------------------------------------------------ > > *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv > > on behalf of Eric Kenny > > > > *Sent:* Monday, June 9, 2014 2:27 PM > > *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU > <mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> > > *Subject:* Re: [WIRELESS-LAN] iOS8 and randomized mac addresses > > > > I h ave the first beta of iOS 8 installed on my iPhone 5s and it does not > > appear to randomize the MAC address, nor are there any visible settings to > > enable/disable that "feature." Since the MAC address remains the same while > > associated to a wireless network it should not pose any issues. The > original > > source in the article indicates that iOS 8 will only randomize the MAC > while > > scanning for available networks. > > > > Thanks, > > > > Eric J. Kenny > > > > Network & Security Engineer > > > > Marist College > > > > 3399 North Rd. > > > > Poughkeepsie, NY 12601 > > > > 845.575.3820 > > > > *From:*The EDUCAUSE Wireless Issues Constituent Group Listserv > > [mailto:The EDUCAUSE Wireless Issues > > Constituent Group Listserv ] *On Behalf Of > > *Rick Coloccia, Jr. > > *Sent:* Monday, June 9, 2014 11:06 AM > > *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU <ma > ilto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> > > *Subject:* [WIRELESS-LAN] iOS8 and randomized mac addresses > > > > Just saw this: > > > > > http://www.theverge.com/2014/6/9/5792970/ios-8-strikes-an-unexpected-blow-against-location-tracking > > > > > It wasn't touted onstage, but a new iOS 8 feature is set to cause havoc for > > location trackers, and score a major win for privacy. As spotted by > Frederic > > Jacobs <https://twitter.com/FredericJacobs/status/475601665836744704>, the > > changes have to do with the MAC address used to identify devices wi! th in > > networks. When iOS 8 devices look for a connection, they randomize that > > address, effectively disguising any trace of the real dev ice until it > decides > > to connect to a network. > > > > > > Any guesses as to how this will impact wpa2 auth or location tracking with > an > > MSE? (We're a Cisco wireless network with three 5508s in HA config running > > current 7.6 code.) > > > > Looking forward to your thoughts... > > > > -Rick > > > > > > -- > > > > Rick Coloccia, Jr. > > > > Network Manager > > > > State University of NY College at Geneseo > > > > 1 College Circle, 119 South Hall > > > > Geneseo, NY 14454 > > > > V: 585-245-5577 > > > > F: 585-245-5579 > > > > ********** Participation and subscription information for this EDUCAUSE > > Constituent Group discussion list can be found at > > http://www.educause.edu/groups/ <http://%21%20//%20www.educause.e > du/groups/ <http://%21%20/%20www.educause.edu/groups/>>. > > > > ********** Participation and subscription information for this EDUCAUSE > > Constituent Group discussion list can be found at > > http://www.educause.edu/groups/. <http://www.educause.edu/groups/> > > > > ********** Participation and subscription information for this EDUCAUSE > > Constituent Group discussion list can be found at > > http://www.educause.edu/groups/. <http://www.educause.edu/groups/> > > > > ********** > Participation and subscription information for this EDUCAUSE Constituent Group > discussion list can be found at http://www.educause.edu/groups/. > <http://www.educause.edu/groups/> > > ********** Participation and subscription information for this EDUCAUSE > Constituent Group discussion list can be found at > http://www.educause.edu/groups/. > ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
