Logo image
Back
Deanonymizing Device Identities via Side-channel Attacks in Exclusive-use IoTs Mitigation
Conference proceeding   Open access

Deanonymizing Device Identities via Side-channel Attacks in Exclusive-use IoTs Mitigation

Christopher Ellis, Yue Zhang, Mohit Kumar Jangid, Shixuan Zhao, Zhiqiang Lin and INTERNET SOC
NETWORK AND DISTRIBUTED SYSTEM SECURITY SYMPOSIUM, NDSS 2025
01 Jan 2025
DOI: https://doi.org/10.14722/ndss.2025.240703
url
https://doi.org/10.14722/ndss.2025.240703View
Published, Version of Record (VoR) Open

Abstract

Computer Science, Theory & Methods Science & Technology Computer Science Technology Telecommunications
Wireless technologies like Bluetooth Low Energy (BLE) and Wi-Fi are essential to the Internet of Things (IoT), facilitating seamless device communication without physical connections. However, this convenience comes at a cost-exposed data exchanges that are susceptible to observation by attackers, leading to serious security and privacy threats such as device tracking. Although protocol designers have traditionally relied on strategies like address and identity randomization as a countermeasure, our research reveals that these attacks remain a significant threat due to a historically overlooked, fundamental flaw in exclusive-use wireless communication. We define exclusive-use as a scenario where devices are designed to provide functionality solely to an associated or paired device. The unique communication patterns inherent in these relationships create an observable boolean side-channel that attackers can exploit to discover whether two devices "trust" each other. This information leak allows for the deanonymization of devices, enabling tracking even in the presence of modern countermeasures. We introduce our tracking attacks as IDBLEED and demonstrate that BLE and Wi-Fi protocols that support confidentiality, integrity, and authentication remain vulnerable to deanonymization due to this fundamental flaw in exclusive-use communication patterns. Finally, we propose and quantitatively evaluate a generalized, privacy-preserving mitigation we call ANONYMIZATION LAYER to find a negligible 2% approximate overhead in performance and power consumption on tested smartphones and PCs.

Metrics

1 Record Views

Details

Logo image