24

I work at an office typing numbers into a computer. It gets quite boring sometimes, so I go on Netflix while using their WiFi on my phone.

Can they tell what apps I'm using, based on network traffic?

  • 64
    Yes they can. Use your own Internet connection. – Simon Oct 9 '15 at 13:17
  • 22
    Honestly, streaming video is pretty easy to spot using traffic analysis (sustained transfers at fixed bitrates), and Netflix is on the harmless end of the scale (not porn, not illegal). The same through a VPN would probably put up more flags. – drxzcl Oct 9 '15 at 18:40
  • 6
  • 7
    Am I the only one thinking the OP should be doing the job they've been paid to do? – JamesRyan Oct 11 '15 at 23:59
  • 4
    @drxzcl "Netflix is on the harmless end of the scale" This is not entirely true. There are other factors to consider. We don't know if any business critical processes are using the Wi-Fi. We don't know how much bandwidth is available via the Wi-Fi link. A situation could occur where the link is saturated with streaming Netflix traffic if other employees adopted this same approach to combat boredom, creating a DOS scenario. – k1DBLITZ Oct 13 '15 at 14:53
67

Short answer is yes. If there is any logging on their WiFi router they might not be able to see exact apps, but they'll be able to see the server domain/hostnames that you're connecting to.

You can also look at these question and answers:

Is there a way for my ISP or LAN admin to learn my Gmail address?
Can an employer see cellular network traffic routed through company-owned device?

Long Answer

Secure WiFi only encrypts traffic up to the Access Point. It's decrypted, and the traffic can be monitored. If it's an enterprise router it's more than capable of logging specific types of traffic. If your work has a firewall in their network then it's even more likely that your employer has the capability to monitor traffic. These do have to be configured, and your employer has to care, but it's very possible.

Domain Name Server (DNS) requests contain the domain hostname that you're trying to reach, and these requests are sent before an SSL/TLS channel can be established and secure.

enter image description here Source

If you're using SSL/TLS it's possible to see the hostname of the server that you're connecting to in two ways. First is the server's certificate. The common name generally needs to match the domain name that you're browsing to.

enter image description here

Can they link this back to you? This really depends on a lot of factors. If they're really adamant they'll be able to track down the MAC address of your device, IMEI, and other mobile phone identifiers. This is a lot of work, and in the end still might not link you to the traffic.

In all honesty, if they care it's just easier to block the traffic than it is to try and track you down.

  • 1
    Depending on how they are doing this and if the site uses SSL/TLS, all they are going to see is the Server's IP, no actual URLs. – rbialon Oct 9 '15 at 12:53
  • 14
    @rbialon In TLS the certificates sent by the server will contain the domain name of the website you're visiting, and DNS requests are still sent out in the clear. – RoraΖ Oct 9 '15 at 12:57
  • 1
    Perhaps it's more accurate to sey that they can see that someone is using Netflix on their phone using their wifi, but not easily link it to a particular person - as is the case from doing the same from a work computer. – Peteris Oct 9 '15 at 14:43
  • 2
    @JPhi1618 Yes and No. They're probably not using static IPs on the clients nor are they recording all the MAC addresses of their computers (or rather individual NICs.) Instead they probably rely on their domain controller to know who is doing what. – Dean MacGregor Oct 9 '15 at 17:29
  • 2
    Logging wouldn't have to be in the WiFi router/access point - it could also be anywhere between that and the connection to the ISP. – Andrew Medico Oct 9 '15 at 22:25
8

Depending on what they have set up as regards logging and monitoring, yes - this is something they could do.

If you have a policy against using the wifi for such things, I'd suggest not doing that, but I guess you could ask. They might not want you doing it when you should be working, however...

1

Yes, they can. It’s as simple as that.

If you want a solution, though, if your network allows it in the office, set up a small Raspberry Pi and Swan VPN at home. Connect your phone to the wifi and tunnel out your connection. Problem solved.

  • 11
    In this case, setting up a VPN doesn't help much. When they see 3+ Mbps of constant traffic going to your phone, they're going to be suspicious, regardless of whether it's encrypted or not. Furthermore, streaming content (whether video or, especially, VoIP) has quite unique traffic signatures that make it rather easy to detect, even when the traffic itself is encrypted. Lots of research has been done in this field (including some by myself) and the classifiers are actually quite good. – reirab Oct 9 '15 at 20:39
  • 1
    For a recent-ish survey paper of the topic, see Gomes, et al., 2013. (This is not my work, by the way.) – reirab Oct 9 '15 at 20:43
  • 1
    ^ "plausible deniability" only works to a v limited extent. (Setting aside more basic rules like bandwidth limits,) If an employer can't specifically prove you're doing something that goes against acceptable use, they might hedge their bets, and out you go. Employers aren't subject to the rules of science, law, or w/e when deciding whether to keep someone on. – underscore_d Oct 11 '15 at 12:35
  • 1
    @silverpenguin there are a lot of employers who will fire you even more likely for using a "shady" VPN than Netflix. I mean someone transfers data and doesn't want the company to see what they are doing? Either he is downloading malware or transferring out trade secrets. – Josef Oct 12 '15 at 12:29
  • 1
    @Michael He might. But the probability is quite high he is not even allowed to use company resources for personal pleasure and if he still does that, trying to hide it makes it worse! I am not against using a VPN in a free wifi network or your own network or whatever, but inside a proper company network, that's just asking for trouble. Just try to see the perspective of an network admin there. In his IDS a alert pops up, that massive unknown encrypted data is transferred. What do you think he will do? – Josef Oct 12 '15 at 13:06
0

Yes they can. If you do not want them to see what IP you connect to, use a VPN service, they will only be able to see the VPN IP and not know where the connection was intended for.

0

Yes they can see it, but depending on your country you might be protected by law or not... So you should ask if they can use that info against you or not... In some countries usage of that information will violate privacy laws.

0

Yes they can see the traffic, but maybe not the specific apps you are using. Just the traffic. Depending on the setup, they may have already tracked this. Sometimes they will not be able to tell who did it, but sometimes they will also be tracking the device's name (e.g. "Phil's iPad") depending on certain things.

So while it may be true that a company largely will not know if it's you even if they see the traffic, and they may not know specifically that you are using a particular app to generate the traffic, the fact is they COULD know you are the person generating the traffic to and from netflix servers, if your device's name is a dead giveaway or if anyone kind of already knows your device's name. (They could also know if there is anyone in your office who you have chatted with about this issue).

If you haven't been approached yet in any way, or if use of the network for Netflix or large downloads hasn't come up in some way you know about, chances are pretty good that they don't currently care. However you may also want to not risk it in the future, and instead use your own data plan for things like that.

-1

Yes they can.

(As a fighter of full disclosure I won't disclose here how they can. In full agreement with myself :), since in this case I won't give a key advantage to the bad against the good.)

In most law context it is lawful for your employer to investigate this abuse of its company resources: you are here using resources provided and maintained to permit work of all employees, your colleagues. The key exception to this right to stop a resources abuse is the case were resources are explicitly provided as a convenience for private use. For example if your wireless network is named "Rest area" or "Recreation area".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.