Would it be possible for the IT department to trace the model of my cellphone if I connect to the wifi provided by the company?

  • 3
    Your MAC address can give away equipment manufacturer which can give an idea as the make of the phone. – iainpb Mar 22 '18 at 15:18

The answer is yes; they can definitely see what phone you are using if they know where to look.

In addition to the MAC OUI, which reveals the manufacturer, the device may advertise its hostname as the manufacturer and model number (looking at my network's DHCP clients, I see some right now, e.g. a device named "SAMSUNG-SM-G890A"). Also, if you are browsing HTTP websites (or using apps that communicate over HTTP), the user agent string in the HTTP headers may contain the device manufacturer and model number. Some apps may also transmit this data for analytic or telemetry purposes.

  • You answer "definitely yes" but then mention examples which do not apply to all phone models. I suggest to rephrase your initial statement accordingly. Also consider that most app data nowadays is transmitted in encrypted form. – studio2012 Mar 24 '18 at 5:22
  • @Enos what models do these things not apply to? Even if app traffic is HTTPS, things like Google's connectivity check are not. – multithr3at3d Mar 25 '18 at 2:06

The answer depends on the type of phone and on how you configured it. A phone connected to a network may for example disclose the following:

  • MAC/OUI: the MAC address of a phone is publicly associated with its brand.
  • DHCP/DNS hostname: some phones by default include their make or model in their hostname, which then shows up in DHCP and DNS logs (E.g. "Hitesh's iPhone 5").
  • Browser user agents: some phones include their brand and/or model in the user agent of the default browser, which then shows up in HTTP logs.
  • Some phones may connect to unencrypted services sending information about their exact model in the clear
  • WIFI logs can be used to triangulate positions and can be cross-checked with company logon times, badge recordings and images from security cameras

Most information in this list can be spoofed to impersonate another phone.

  • 3
    Another: default device names that disclose the model name: "Hitesh's iPhone 5" – schroeder Mar 22 '18 at 22:10
  • OS type and version can also be determined through a number of methods, which could be used to at least narrow down the model if you have already determined the manufacturer. – YLearn Mar 22 '18 at 23:13

As others have answered, WiFi alone reveals quite a bit about your mobile phone. But it's not the only data available to someone monitoring for mobile phones.

Depending on the capabilities of your IT department, they could be using a tool like Pwn Pulse, which catalogs different wireless devices including WiFi, Bluetooth, and BTLE. BTLE devices can advertise many services including Manufacturer Name String, Model Number String, and Local Name, which may reveal much more detail than just the OUI. And it's not uncommon for the MAC address of the WiFi adapter to be used to derive the MAC or UUID on a Bluetooth device; some manufacturers have been known to take the WiFi MAC and simply add one to it, then assign the new number to the Bluetooth interface. This kind of data can help an analyst corroborate the WiFi and Bluetooth signals to determine if they are coming from the same device.

Pwn Pulse is a commercial tool, sold to companies who are trying to detect rogue devices. It isn't a cool research project, it's been deployed to many big companies.

There are any number of Journey Time Monitoring Systems (JTMS) used by highway departments to identify cars by their Bluetooth emanations, and to determine average highway speeds based on time/distance measurements.

Blue Hydra is a similar open source project you can download and run yourself. It can open up wardriving to gather Bluetooth intel along with WiFi info.

In addition to all the RF your phone is emitting, researchers have discovered other ways to detect and identify phones. A particularly interesting approach uses IR to fingerprint them. Most phones have a "proximity detector" that wakes the phone when you approach it, and dims the screen when you hold it to your ear. This is done by using an IR emitter that blinks a pattern and measures the echoes. It turns out that each phone make and model has its own distinctive pattern, and even individual phones may have identifiable variations. These faint IR blinks can be picked up remotely (there's a project on Github named Iris you can use to map them.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.