4
submitted 1 month ago* (last edited 1 month ago) by possiblylinux127@lemmy.zip to c/privacy@lemmy.ml

So many people here will go though great lengths to protect themselves from fingerprinting and snooping. However, one thing tends to get overlooked is DHCP and other layer 3 holes. When your device requests an IP it sends over a significant amount of data. DHCP fingerprinting is very similar to browser fingerprinting but unlike the browser there does not seem to be a lot of resources to defend against it. You would need to make changes to the underlying OS components to spoof it.

What are everyone's thoughts on this? Did we miss the obvious?

https://www.arubanetworks.com/vrd/AOSDHCPFPAppNote/wwhelp/wwhimpl/common/html/wwhelp.htm#href=Chap2.html&single=true

you are viewing a single comment's thread
view the rest of the comments
[-] s38b35M5@lemmy.world 4 points 1 month ago

I used to provide commercial end-user support for a network intelligence product that used as much metadata as possible to help classify endpoints, shuffling them off to the right captive portals for the right segment based on that data.

I can tell you that the things you're saying are transmitted in a DHCP request/offer are just not. If they were, my job would've been a LOT easier. The only information you can count on are a MAC address.

I can't view that link you shared, but I've viewed my share of packet captures diagnosing misidentified endpoints. Not only does a DHCP request/offer not include other metadata, it can't. There's no place for OS metrics. Clients just ask for any address, or ask to renew one they think they can use. That only requires a MAC and an IP address.

I suppose DHCP option flags could maybe lead to some kind of data gathering, but that's usually sent by the server,not the client.

I think, at the end of the day, fighting so that random actors can't find out who manufactured my WiFi radio just isn't up there on my list of "worth its" to worry about.

[-] Bitrot 3 points 1 month ago* (last edited 1 month ago)

They are watching DHCP Discover option 55. The device tells the server what options it expects to receive, and different vendors and device ask for different options or ask for them in a different order, and they are fingerprinting that.

Cisco also describes the tactic: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116235-configure-ise-00.html

The fingerprints are viewable at https://github.com/karottc/fingerbank/blob/master/dhcp_fingerprints.conf - it is more specific than a mac vendor but not extremely anti-privacy, anybody watching firewall logs will know an iPhone connected pretty easily too.

[-] s38b35M5@lemmy.world 1 points 1 month ago

Okay, I do recall that our software had a feature that could classify on "DHCP requested options', but it was low-fidelity, unreliable. Ultimately, the software works best with known devices, and isn't very good at reliably classing unknowns.

As you say, just the first few seconds of actual traffic from a device is so rich in terms of ID characteristics compared to DHCP.

this post was submitted on 04 Jul 2024
4 points (59.1% liked)

Privacy

30644 readers
1787 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS