this post was submitted on 04 Jul 2024
4 points (59.1% liked)

Privacy

32096 readers
712 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
4
Privacy concerns with DHCP (DHCP fingerprinting) (lemmy.zip)
submitted 4 months ago* (last edited 4 months ago) by possiblylinux127@lemmy.zip to c/privacy@lemmy.ml
44 comments fedilink hide all child comments
 

So many people here will go though great lengths to protect themselves from fingerprinting and snooping. However, one thing tends to get overlooked is DHCP and other layer 3 holes. When your device requests an IP it sends over a significant amount of data. DHCP fingerprinting is very similar to browser fingerprinting but unlike the browser there does not seem to be a lot of resources to defend against it. You would need to make changes to the underlying OS components to spoof it.

What are everyone's thoughts on this? Did we miss the obvious?

https://www.arubanetworks.com/vrd/AOSDHCPFPAppNote/wwhelp/wwhimpl/common/html/wwhelp.htm#href=Chap2.html&single=true

all 45 comments
sorted by: hot top controversial new old
[–] irq0@infosec.pub 12 points 4 months ago (2 children)

I feel like I'm missing something here...

Who's going to be fingerprinting DHCP messages on your home network?

Outside of that, fingerprinting or tracking any DHCP info would be the least of my concerns. You have 0 control over any data the moment your devices connect to a public network. What use is DHCP info when you can person-in-the middle all the traffic anyway?

And anyway, what info are you concerned about? Having had a VERY quick browse of RFC2131 the worst thing would be "leaking" the device MAC address which can be discovered via several other means anyway

[–] Max_P@lemmy.max-p.me 5 points 4 months ago (3 children)

I guess the hostname could be used to defeat MAC randomization if you use public WiFi like hotels, airports and coffee shops. You could probably identify repeat users if you cared enough.

But then your worry should be the security cameras not the WiFi, because that's what's gonna tie you personally to your device connecting.

[–] 14th_cylon@lemm.ee 3 points 4 months ago* (last edited 4 months ago) (2 children)

Your router always knows your Mac address, no matter how you got your ip assigned. And yes, you can use it to identify the client - that is why it is there. This whole post is nonsense written by someone who doesn't really understand what dhcp is or how it works. Long story short, don't look for privacy on local Ethernet segment :D

[–] Max_P@lemmy.max-p.me 2 points 4 months ago (2 children)

Most modern operating systems randomize the MAC. DHCP does have extra fields such as the device's hostname that can be used to counter that.

But as I said, that's unlikely to be the weakest link. If you don't trust the network you're also likely in a public environment where people can just see you anyway.

[–] user134450 4 points 4 months ago (2 children)

Most modern operating systems randomize the MAC.

[citation needed]
having the option to randomize the MAC is not the same as actually doing that. There are also a few downsides to random MACs, like captive portals not remembering you on public WiFis.

[–] Redjard@lemmy.dbzer0.com 2 points 4 months ago

The default on android is to give every wifi network its own random but static mac.

[–] delirious_owl@discuss.online 1 points 4 months ago

Captive portals not remembering you between sessions is a huge bonus for captive portals with time limits.

[–] 14th_cylon@lemm.ee 1 points 4 months ago (2 children)

Most modern operating systems randomize the MAC.

that doesn't seem to be uniform behaviour. but i think we agree on the merit. if you are this paranoid, you just don't use networks where you don't have control over the local segment.

[admin@MikroTik] > ip arp print 
Flags: X - disabled, I - invalid, H - DHCP, D - dynamic, P - published, C - complete 
 #    ADDRESS         MAC-ADDRESS       INTERFACE                                                    
 0 DC 192.168.88.160  A2:35:xx:xx:xx:xx bridge                                                       
 1 DC 192.168.88.159  F4:60:xx:xx:xx:xx bridge                                                       
 2 DC 192.168.0.1     44:32:xx:xx:xx:xx ether1                                                       
 3 DC 192.168.88.168  18:3D:xx:xx:xx:xx bridge                                                       
 4 DC 192.168.88.156  70:BB:xx:xx:xx:xx bridge

[–] ReversalHatchery@beehaw.org 1 points 4 months ago (1 children)

you just don't use networks where you don't have control over the local segment.

Easier said than done. Sometimes it's not an option.

[–] 14th_cylon@lemm.ee 1 points 4 months ago

there is always an option. unless you are pressured by lets say some state authority or your employee, in which case your identity is probably well known and they don't really need to spy on you through dhcp.

[–] ReversalHatchery@beehaw.org 1 points 4 months ago (1 children)

Long story short, don't look for privacy on local Ethernet segment :D

You seem to be forgetting that a lot of people use portable devices on other networks than their home one.

[–] 14th_cylon@lemm.ee 1 points 4 months ago

i am not forgetting anything. using your portable device on network other than your own is your free choice and if you are such control freak that you are afraid of being spied on through dhcp, you probably should not do that.

[–] delirious_owl@discuss.online 1 points 4 months ago

Wear a mask and sunglasses so you just blend in.

[–] possiblylinux127@lemmy.zip -1 points 4 months ago (1 children)

See the linked page

[–] Bitrot@lemmy.sdf.org 2 points 4 months ago

You need to say more than that about what your concern is, especially on devices configured for Mac randomization and other privacy features.

Aruba is looking at the dhcp traffic and inferring information about the device. The device is not sending all of this data.

[–] possiblylinux127@lemmy.zip 0 points 4 months ago (1 children)

You can't easily man in the middle https with encrypted DNS

[–] delirious_owl@discuss.online 1 points 4 months ago (1 children)

Why would encrypted DNS help here? HTTP(S) uses IPs

[–] possiblylinux127@lemmy.zip 0 points 4 months ago

IPs are arbitrary

[–] anamethatisnt@lemmy.world 7 points 4 months ago (2 children)

I mean the only interesting data sent is the mac address, android phones spoofs that by default, using a separate mac adress for every network and on a debian based distro you can use https://packages.debian.org/stable/net/macchanger if you wanna spoof it when using your computer in the networks owned by others.

[–] wildbus8979@sh.itjust.works 4 points 4 months ago

The hostname is also sent out, so generic hostnames or a hostname randomizer at boot is also useful.

[–] possiblylinux127@lemmy.zip 0 points 4 months ago* (last edited 4 months ago) (1 children)

Hostname, platform, OS version, software versions and other data are all sent.

Most commercial wireless networking software can fingerprint a device with a decent certainly

See the link

[–] s38b35M5@lemmy.world 4 points 4 months ago (1 children)

I used to provide commercial end-user support for a network intelligence product that used as much metadata as possible to help classify endpoints, shuffling them off to the right captive portals for the right segment based on that data.

I can tell you that the things you're saying are transmitted in a DHCP request/offer are just not. If they were, my job would've been a LOT easier. The only information you can count on are a MAC address.

I can't view that link you shared, but I've viewed my share of packet captures diagnosing misidentified endpoints. Not only does a DHCP request/offer not include other metadata, it can't. There's no place for OS metrics. Clients just ask for any address, or ask to renew one they think they can use. That only requires a MAC and an IP address.

I suppose DHCP option flags could maybe lead to some kind of data gathering, but that's usually sent by the server,not the client.

I think, at the end of the day, fighting so that random actors can't find out who manufactured my WiFi radio just isn't up there on my list of "worth its" to worry about.

[–] Bitrot@lemmy.sdf.org 3 points 4 months ago* (last edited 4 months ago) (1 children)

They are watching DHCP Discover option 55. The device tells the server what options it expects to receive, and different vendors and device ask for different options or ask for them in a different order, and they are fingerprinting that.

Cisco also describes the tactic: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116235-configure-ise-00.html

The fingerprints are viewable at https://github.com/karottc/fingerbank/blob/master/dhcp_fingerprints.conf - it is more specific than a mac vendor but not extremely anti-privacy, anybody watching firewall logs will know an iPhone connected pretty easily too.

[–] s38b35M5@lemmy.world 1 points 4 months ago

Okay, I do recall that our software had a feature that could classify on "DHCP requested options', but it was low-fidelity, unreliable. Ultimately, the software works best with known devices, and isn't very good at reliably classing unknowns.

As you say, just the first few seconds of actual traffic from a device is so rich in terms of ID characteristics compared to DHCP.

[–] hostops@sh.itjust.works 5 points 4 months ago (2 children)

DHCP only acts in local networks which is in 90%:

  1. home network where you trust every device to not spy on you
  2. office network where in most cases your emloyer provided you with the hardware. And in 10%:
  3. Public WiFi

The only thing leaked in DHCP is your MAC. Attacker can use this info to identify brand of our network adapter. Or if they have really huge database of laptop manufacturers attacker can identify your device. If you use VPN or TOR the only thing they know from now on is that you use VPN or TOR. And if they really have everything in that database they will be able to tell who bought that computer. So now attacker can only knows who is in their netwotk.

Which is useless in scenario 1. and 2. Where you already know who is in your network and owner of that network has no database to identify you based on your MAC.

In scenario 3. If we are talking about huge public networks like WiFi provided from your town. If infiltrated by 3 letter agencies which may have such database they could theoretically track your location based on which town network you connected to.

But you can protect yourself from this:

  1. Do not connect to public networks
  2. Your OS/Network card driver allow you to use random MAC address. Just enable random MAC in your network settings. In Android: WiFi > Select specific network > Privacy > Use randomized MAC.

Also take note some general location tracking can already be done through mobile networks.

[–] refalo@programming.dev 3 points 4 months ago (1 children)

The only thing leaked in DHCP is your MAC

This is not true. It also leaks your hostname by default and often your previously associated IP. There's also vendor-specific "DHCP option" sets that can hold extra data too, which some OSes might use to leak additional info.

[–] hostops@sh.itjust.works 0 points 4 months ago

But the reasoning stays the same.

[–] schwim@lemm.ee 2 points 4 months ago (1 children)

Does randomizing your MAC create any usability issues? Needing to log in repeatedly, getting bumped off network due to looking like a different device, anything else hindering usability?

[–] makeasnek@lemmy.ml 4 points 4 months ago

No, you may have to re-login every time you connect, but once you connect, your MAC would be stable for that session.

[–] TCB13@lemmy.world 4 points 4 months ago (1 children)

When your device requests an IP it sends over a significant amount of data.

Like...?

[–] delirious_owl@discuss.online 0 points 4 months ago (1 children)

Read the article that they linked-to..

[–] TCB13@lemmy.world 1 points 4 months ago

Link wasn't there when the original post was made.

[–] jet@hackertalks.com 2 points 4 months ago (1 children)

Using randomized MAC on my phone's, and observing the behavior on my network. It works fine, the router can't assign a ip to the device because the physical address changes. The os fingerprinting still works, the gateway knows what kind of device it's talking to.

[–] delirious_owl@discuss.online 2 points 4 months ago (1 children)

Android? How do I force it to use a random Mac every time? It pins a random Mac to a given network, which greatly reduces privacy between sessions.

[–] jet@hackertalks.com 1 points 4 months ago* (last edited 4 months ago) (1 children)

Developer settings for newer androids.

GOS has it on by default https://grapheneos.org/features#wifi-privacy

[–] delirious_owl@discuss.online 0 points 4 months ago (1 children)

How do I install this on non-Graphene OS?

[–] jet@hackertalks.com 1 points 4 months ago* (last edited 4 months ago) (1 children)
[–] delirious_owl@discuss.online 2 points 4 months ago (1 children)

Eh, I tried it. It doesn't work. Even the option says that it "may" change the mac on reconnect.

[–] jet@hackertalks.com 1 points 4 months ago (1 children)

What android are you running?

[–] MonkderDritte@feddit.de 2 points 4 months ago (1 children)

I mean, yeah. Lots of shopping centers have devices specialized on fingerprinting mac adress. It was already 10 years ago a thema that you should disable wlan and bluetooth if you go out of the house.

[–] possiblylinux127@lemmy.zip 1 points 4 months ago (1 children)

Phones randomized Macs

[–] MonkderDritte@feddit.de 1 points 4 months ago* (last edited 4 months ago)

Oh right, i forgot that's the reason Androids do this now too.

[–] cypherpunks@lemmy.ml 1 points 4 months ago

If you use systemd's DHCP client, since version 235 you can set Anonymize=true in your network config to stop sending unique identifiers as per RFC 7844 Anonymity Profiles for DHCP Clients. (Don't forget to also set MACAddressPolicy=random.)