This paper presents and demonstrates a nuanced and difficult to solve privacy vulnerability that cannot not be mitigated without considerable changes to current- and next-generation wireless communication protocols. We discuss potential applications, strategies to prevent these leaks, and consider the effort required for an observer to present a practical privacy threat to the everyday WiFi user. The open-world false positive rate (38% overall, or 72% for unseen activity alone) leaves much room for improvement but the experiment demonstrates a plausible threat nevertheless.įinally, avenues for improvement and the limitations of this approach are identified. Although accuracy suffers greatly (67%) when moving to an open-world scenario, a high recall rate of 86% demonstrates that apps can unwittingly broadcast personal information openly despite using encrypted WiFi. Tests in a closed-world scenario showed 84% accuracy and demonstrated the ability to overcome the data limitations imposed by WiFi encryption. The classifier was then adapted to form the core of a detection program that could monitor multiple devices in real-time. The Random Forest algorithm was able to correctly identify apps with a mean accuracy of ∼99% within the training set. These side-channel data measurements are represented as histograms and used to construct a Random Forest classifier capable of accurately identifying mobile apps from the encrypted traffic they cause. Without the ability to read encrypted WiFi traffic directly, we process the limited side-channel data available (timings and frame sizes) to enable remote app detection. However, we demonstrate how encrypted traffic pattern analysis can allow a remote observer to infer potentially sensitive data passively and undetectably without any network credentials. Users would likely assume the confidentiality of personal information (including age, religion, sexuality and gender) when using an encrypted network. Using a selection of personas we illustrate how app usage can be tied to personal information. This paper describes how mobile device apps can inadvertently broadcast personal information through their use of wireless networks despite the correct use of encryption.

Reveals wifi app download