So many people here will go though great lengths to protect themselves from fingerprinting and snooping. However, one thing tends to get overlooked is DHCP and other layer 3 holes. When your device requests an IP it sends over a significant amount of data. DHCP fingerprinting is very similar to browser fingerprinting but unlike the browser there does not seem to be a lot of resources to defend against it. You would need to make changes to the underlying OS components to spoof it.
What are everyone’s thoughts on this? Did we miss the obvious?
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 1 user online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.96K Posts
- 74.6K Comments
- Modlog
Hostname, platform, OS version, software versions and other data are all sent.
Most commercial wireless networking software can fingerprint a device with a decent certainly
See the link
I used to provide commercial end-user support for a network intelligence product that used as much metadata as possible to help classify endpoints, shuffling them off to the right captive portals for the right segment based on that data.
I can tell you that the things you’re saying are transmitted in a DHCP request/offer are just not. If they were, my job would’ve been a LOT easier. The only information you can count on are a MAC address.
I can’t view that link you shared, but I’ve viewed my share of packet captures diagnosing misidentified endpoints. Not only does a DHCP request/offer not include other metadata, it can’t. There’s no place for OS metrics. Clients just ask for any address, or ask to renew one they think they can use. That only requires a MAC and an IP address.
I suppose DHCP option flags could maybe lead to some kind of data gathering, but that’s usually sent by the server,not the client.
I think, at the end of the day, fighting so that random actors can’t find out who manufactured my WiFi radio just isn’t up there on my list of “worth its” to worry about.
They are watching DHCP Discover option 55. The device tells the server what options it expects to receive, and different vendors and device ask for different options or ask for them in a different order, and they are fingerprinting that.
Cisco also describes the tactic: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116235-configure-ise-00.html
The fingerprints are viewable at https://github.com/karottc/fingerbank/blob/master/dhcp_fingerprints.conf - it is more specific than a mac vendor but not extremely anti-privacy, anybody watching firewall logs will know an iPhone connected pretty easily too.
Okay, I do recall that our software had a feature that could classify on "DHCP requested options’, but it was low-fidelity, unreliable. Ultimately, the software works best with known devices, and isn’t very good at reliably classing unknowns.
As you say, just the first few seconds of actual traffic from a device is so rich in terms of ID characteristics compared to DHCP.