1

When ones goes into a public space, like a train or plane, how does one prevent their previously joined SSIDs from being broadcast? I noticed that my phone and tablet tend to try to join these networks and it can efficiently build a list of places I've been to in the past without too much effort. The accuracy might be off, but you'd know that I've traveled to Starbucks at least once.

If there isn't a solution outside of just disabling WiFi on my mobile devices, is this just a specification of WLAN devices? Also, if solutions exist, I'm curious specific about Android, Linux and Windows devices.

15
  • Each device can do this differently. Windows, Linux, Mac, iOS, Android, they all have ways of dealing with this. Are you asking about protecting a particular device?
    – schroeder
    Dec 13, 2014 at 1:57
  • Yeah, I'll update this accordingly. Dec 13, 2014 at 2:49
  • 3
    @Iszi, it depends on how you define "risk". Would you enjoy having your cell phone broadcasting that you once connected to the AP of a clinic known mainly for treating STIs?
    – Mark
    Dec 13, 2014 at 11:01
  • 1
    @Iszi I wouldn't want my phone to broadcast SSIDs it's connected to before. Instead, I'd rather it compile a list of the networks it can see, compare that against networks it's connected to before but without showing all of the prior networks. Dec 16, 2014 at 7:50
  • 1
    It is a risk - have a look at how the wifi pineapple works!
    – Rory Alsop
    Dec 20, 2014 at 12:23

2 Answers 2

1

It is a risk, it may even compromise the PSK of the broadcasted SSID if a rogue AP is set up for that purpose (to capture the handshake).

If any "Autoconnect to any Wireless network" toggle is available on those systems, you may be able to avoid the probe requests, but as far as I know, it's not usual to find access to that option.

Anyway, this talk about attacking clients and how to disable the probe requests of SSIDs on different devices may be interesting for you: http://www.slideshare.net/rootedcon/ral-siles-wifi-why-ios-android-and-others-fail-inexplicably-rooted-con-2013

0
1

Well, if you're worried about open wifi hotspots, the obvious answer is to simply delete them as you leave, so your device doesn't have them in the list anymore.

Alternately, particularly if you want to save WPA or WPA2 passwords, then on Linux and (rooted) Android, you can also remove them from wpa_supplicant.conf; you could have a variety of copies of that file with different names, and copy the one you need over the main file.

  • Android location: /data/misc/wifi/wpa_supplicant.conf

I'm not as sure about Windows; if you unselect "Connect automatically when this network is in range" and also unselect "Connect even if the network is not broadcasting its name (SSID)", what does a packet sniffer show you're broadcasting? I would expect it to no longer broadcast that SSID, but you'd have to check.

You should always check, if you're truly concerned :).

5
  • Thanks for the tips! It always seems like rooted Android is the way to go! Kind of wish (I'm not sure if it has) it used SELinux more often. Jan 12, 2015 at 11:51
  • @Anti-weakpasswords, What do you use to check?
    – Pacerier
    Feb 16, 2015 at 10:00
  • @Pacerier you would use a wifi sniffer, preferably on a different device, to receive and display what the suspect device is actually broadcasting, using Wireshark and/or airodump-ng or a similar tool. Jun 14, 2015 at 17:18
  • @Anti-weakpasswords, I mean which one do you recommend / use?
    – Pacerier
    Jul 8, 2015 at 10:49
  • @Pacerier, I generally use airodump/wireshark to check. For Android, currently I still use Cyanogenmod. Nov 1, 2015 at 4:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .