Shulou(Shulou.com)11/24 Report--

Thanks to CTOnews.com netizen Alejandro86 for the clue delivery! CTOnews.com, October 28 (Xinhua)-- Apple fixed a 3-year-old "private Wi-Fi address" bug in the official version of iOS / iPadOS released on October 26 to provide users with better security.

CTOnews.com Note: to communicate with a wireless LAN, the device must identify itself on the network with a unique network address, which is called the Media access Control (MAC) address.

If the device always uses the same WLAN MAC address on all networks, over time, network operators and other network observers can more easily associate this address with the device's network activity and location for some kind of user tracking or analysis, and this applies to all devices on all wireless Lans.

Starting with iOS 14, iPadOS 14 and watchOS 7 in 2020, Apple introduced a "private address" feature to better protect privacy by using different MAC addresses in each wireless local area network.

However, experiments have proved that the "private address" function is somewhat "non-existent". Two security experts, Tommy Mysk and Talal Haj, reported and discovered the vulnerability, tracking number CVE-2023-42846, indicating that it can be traced back to iOS 14 at the earliest.

When iPhone or any other device joins the network, it triggers multicast messages sent to all other devices on the network. As needed, the message must contain an MAC address, starting with iOS 14, and each SSID should have a different value by default.

Mysk released a demonstration video that uses the Wireshark packet sniffer to monitor traffic on the local network to which the Mac address is connected.

After joining the iPhone running iOS 17.1, the real Wi-Fi MAC address can still be seen on the 5353 / UDP port.

For most iPhone and iPad users, even if there is an impact, the impact may be small. But for people with strict privacy threat models, the inability of these devices to hide real MAC addresses within three years may be a real problem.

Related readings:

"Apple iOS / iPadOS 17.1 official release: supports AirDrop Internet transmission, adapts to USB-C Apple Pencil, etc."

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.