Have a look at the below wifi traffic history for my daughter’s iPhone 7.
The data was generated via a packet sniffer running on my laptop looking for the mac address of my daughter’s phone.
What is the difference between the upper and the lower traffic pattern?
The upper pattern is from when the sniffer and the iPhone were on the same frequency. The different shades of green show different traffic volumes.
The lower pattern is with the sniffer on 5GHz and the iPhone on 2.4GHz. All the sniffer can pick up are probe requests (and some probe responses). The pattern is less solid because sometimes the iPhone seems to take a break from sending out probe requests for 10 or more minutes.
My point is, that the iPhone should not send out probe requests with unrandomized mac addresses on different channels at all. If those probe requests were randomized, I would not be able to monitor so easily.
‘So easily’ is the point here. I could still monitor all iPhones in the neighborhood by channel hopping while sniffing. Every time the sniffer happens to be on the same channel as a phone, it would pick up traffic, but the traffic volumes would become less telling because most of the time I would be on the ‘wrong’ channel.
Using channel hoppers is a pain. For one thing, you lose your internet connection if the wifi connection is all you have. On top of that, your overall system becomes less stable and tends to crash more often, so people are reluctant to use them.
Go Apple, fix this. It’s too easy now. I don’t need to know when all my neighbors with iPhones are home and when they are out. Oh, and I don’t like that everybody else can so easily monitor my wife, my daughter and me either. Randomize ALL probe requests. Also those you send out while connected to a network.
Just in case you think Android is any better, I include a scan for my Samsung S7 running on Android 7.0.
You can clearly see when I switched the scanner to the same channel as the sniffer. The patchy pattern in the lower half means that my phone is also not randomizing mac addresses of probe requests. Samsung, you’ve got some work to do too.
I put Apple in the title because Apple appears more sensitive to issues of this nature and Samsung will follow their lead eventually.