1

When ones goes into a public space, like a train or plane, how does one prevent their previously joined SSIDs from being broadcast? I noticed that my phone and tablet tend to try to join these networks and it can efficiently build a list of places I've been to in the past without too much effort. The accuracy might be off, but you'd know that I've traveled to Starbucks at least once.

If there isn't a solution outside of just disabling WiFi on my mobile devices, is this just a specification of WLAN devices? Also, if solutions exist, I'm curious specific about Android, Linux and Windows devices.

jackyalcine
  • 111
  • 4
  • Each device can do this differently. Windows, Linux, Mac, iOS, Android, they all have ways of dealing with this. Are you asking about protecting a particular device? – schroeder Dec 13 '14 at 01:57
  • Yeah, I'll update this accordingly. – jackyalcine Dec 13 '14 at 02:49
  • As long as you're not joining open networks, I'm not convinced SSID broadcast by client devices is a risk. See [my question](http://security.stackexchange.com/questions/74658/security-risks-of-disabling-ssid-broadcast) on the topic, and its answers/comments, for more details. – Iszi Dec 13 '14 at 05:16
  • 3
    @Iszi, it depends on how you define "risk". Would you enjoy having your cell phone broadcasting that you once connected to the AP of a clinic known mainly for treating STIs? – Mark Dec 13 '14 at 11:01
  • 1
    @Iszi I wouldn't want my phone to broadcast SSIDs it's connected to before. Instead, I'd rather it compile a list of the networks it can see, compare that against networks it's connected to before _but_ without showing all of the prior networks. – jackyalcine Dec 16 '14 at 07:50
  • @Mark So, privacy issue only - no risk to the home networks or data resident on the client? – Iszi Dec 16 '14 at 14:27
  • I'd say more so of a privacy issue, yes. – jackyalcine Dec 16 '14 at 21:52
  • 1
    It is a risk - have a look at how the wifi pineapple works! – Rory Alsop Dec 20 '14 at 12:23
  • @Iszi, [Privacy](http://security.stackexchange.com/a/29124/2379) issue **only**? Give me your bank account number. – Pacerier Feb 16 '15 at 09:45
  • @Pacerier Note the caveat in my first comment here - "As long as you're not joining open networks". If you join encrypted/authenticated networks only (and assuming those networks use strong protocols and strong keys), information such as account numbers, usernames & passwords will never be sent to a spoofed AP if all the attacker knows is the SSID. They need to also know the security configuration of your home AP (protocols, keys) to trick your device into auto-connecting. – Iszi Feb 17 '15 at 13:58
  • @Iszi, Even if it's not an open network, it's still a privacy issue. Mark has answered that, When you connect to a company network it's not an open network but still a privacy risk. – Pacerier Feb 22 '15 at 20:58
  • @Pacerier Okay, so what are you saying - is it actually a *security* issue (i.e.: a threat to the data stored on or processed by the client device or its home networks), or is it *only* a privacy issue (i.e.: only disclosing names of previously-connected networks, and allowing inferences to be derived from that information)? Unless your home network is called "MyBankAccountIs1234567890AndMyPinIs9874", there's no chance of an attacker getting your account details simply from SSID advertisement. – Iszi Feb 22 '15 at 22:49
  • @Pacerier This question has nothing to do with what happens with your data *after* you've connected to a network. It's only asking about how to keep the names of networks you've connected to - which is, albeit arguably, a *very low* Confidentiality risk - from being broadcast when your device is *not* connected. For that matter, even for there to be a risk at all an attacker would need to be determined enough to identify your devices from the dozens or so in the area that are also seeking to join networks. If you're actually facing such a threat, you've got bigger things to worry about. – Iszi Feb 22 '15 at 22:53
  • Haha true @Iszi. I was curious about practices about hiding in plain sight. – jackyalcine Feb 23 '15 at 00:29
  • @Iszi, Of course question focusing on privacy issues. It's tagged as such and quote *"The accuracy might be off, but you'd know that I've traveled to Starbucks at least once"*. – Pacerier Feb 23 '15 at 12:16

2 Answers2

1

It is a risk, it may even compromise the PSK of the broadcasted SSID if a rogue AP is set up for that purpose (to capture the handshake).

If any "Autoconnect to any Wireless network" toggle is available on those systems, you may be able to avoid the probe requests, but as far as I know, it's not usual to find access to that option.

Anyway, this talk about attacking clients and how to disable the probe requests of SSIDs on different devices may be interesting for you: http://www.slideshare.net/rootedcon/ral-siles-wifi-why-ios-android-and-others-fail-inexplicably-rooted-con-2013

BBerastegui
  • 525
  • 3
  • 9
1

Well, if you're worried about open wifi hotspots, the obvious answer is to simply delete them as you leave, so your device doesn't have them in the list anymore.

Alternately, particularly if you want to save WPA or WPA2 passwords, then on Linux and (rooted) Android, you can also remove them from wpa_supplicant.conf; you could have a variety of copies of that file with different names, and copy the one you need over the main file.

  • Android location: /data/misc/wifi/wpa_supplicant.conf

I'm not as sure about Windows; if you unselect "Connect automatically when this network is in range" and also unselect "Connect even if the network is not broadcasting its name (SSID)", what does a packet sniffer show you're broadcasting? I would expect it to no longer broadcast that SSID, but you'd have to check.

You should always check, if you're truly concerned :).

Anti-weakpasswords
  • 9,850
  • 2
  • 24
  • 52