A few days ago Apple published a new privacy page on its website that detailed the various measures it has put in place to protect Mac and iOS users’ personal data. One of those features, which is new in iOS 8, is the automatic randomization of MAC addresses when the device is searching for a Wi-Fi network. This makes it much more difficult to track a device by seeing which Wi-Fi networks have spotted its unique identifier.
A new two-part study by AirTight Networks into how well this security feature works has turned up some interesting results, including several conditions that will stop the phone from randomizing a MAC address. Part one of the study breaks down what exactly needs to happen in order to start this function…
First, one of the more important points in the study indicates that the iPhone 5 and older models don’t seem to take advantage of MAC address randomization, though the security notes for iOS 8 say that the feature works on all devices. According to the AirTight research, only the iPhone 5s could be observed using this feature.
Apple’s website (seen above) states that to trigger this function, the user should be “out running errands with your phone in your pocket.” As implied by that sentence, the device needs to be locked to start randomzing its MAC address. This was confirmed by the AirTight study, which found that about two minutes after the device’s screen was locked, it would start searching for a familiar Wi-Fi network using a random address. Every time the device wakes up and goes back to sleep, a new MAC address is generated.
There is another stipulation that must be met before this feature will kick in, however, and it’s one that most users aren’t going to meet. In order to start using randomized MAC addresses, location services must be disabled.
If that requirement hasn’t ruled out every iPhone user from taking advantage of this feature, a discovery in the second part of the study almost certainly will. During the first round of testing, the researchers at the AirTight blog had not used SIM cards in any of the phones being analyzed. When they put SIM cards into these units and activated a cellular data connection, they found that MAC address randomization was completely disabled no matter what other critera were met.
You read that correctly: activating cellular data (3G/4G/LTE) on your iPhone (which you need to get iMessages, push notifications, emails, and more when not on Wi-Fi) seems to be deactivating one of the key features touted on Apple’s own privacy page. Apparently Apple belives that you should disable your cellular data connection when “out running errands with your phone in your pocket.”
