Apple Private Wi-Fi hasn't worked for the past three years

Three years aft Apple introduced a paper mounting called Private Wi-Fi Address, a measurement to spoof web identifiers called MAC addresses, nan privateness protection whitethorn yet activity arsenic advertised, acknowledgment to a package fix.

"To pass pinch a Wi-Fi network, a instrumentality must place itself to nan web utilizing a unsocial web reside called a Media Access Control (MAC) address," Apple explains successful its documentation.

"If nan instrumentality ever uses nan aforesaid Wi-Fi MAC reside crossed each networks, web operators and different web observers tin much easy subordinate that reside to nan device's web activity and location complete time. This allows a benignant of personification search aliases profiling, and it applies to each devices connected each Wi-Fi networks."

Private Wi-Fi Address intends to debar specified search by generating a different MAC reside for each different Wi-Fi network.

But Apple's identifier spoofing characteristic hasn't functioned decently since it was introduced for iOS 14, iPadOS 14, and watchOS 7 successful September 2020 owed a bug successful mDNSResponder, a process associated pinch Apple's Bonjour networking protocol.

• Apple drops urgent spot against obtuse TriangleDB iPhone malware
• Side transmission attacks return wound retired of Apple silicon pinch iLeakage exploit
• Google - yes, that Google - testing proxy strategy to hide IP addresses for privacy
• The problem pinch Jon Stewart is that Apple appears to person cancelled his show

The bug, CVE-2023-42846, was identified by flaw finders Tommy Mysk and Talal Haj Bakry of Mysk Inc, which besides makes various iOS and macOS apps.

"Private Wi-Fi addresses person been useless ever since they were introduced successful iOS 14," they said successful a Mastodon station connected Thursday. "When an iPhone joins a network, it sends multicast requests to observe AirPlay devices successful nan network. In these requests, iOS sends nan device's existent Wi-Fi MAC address."

The duo explicate that Apple's package replaces nan device's existent MAC reside successful nan information nexus furniture pinch a generated MAC address. But until Apple repaired its code, nan package besides passed nan existent MAC reside pinch nan decoy successful AirPlay find requests, moreover erstwhile connected to a VPN.

Bakry and Mysk wished this by utilizing nan Wireshark web protocol analyzer, which revealed that nan existent MAC reside was being sent successful nan Option Data: field, concatenated pinch nan generated MAC address, arsenic shown successful this video.

Youtube Video

Ironically, backmost successful 2015, Apple resumed using mDNSResponder aft its intended replacement, a daemon written successful C++ called discoveryd that was added a twelvemonth earlier arsenic portion of OS X Yosemite, proved to beryllium much problem than its C-based predecessor.

Apple did not respond to a petition for comment. The institution patched nan mDNSResponder bug connected Wednesday pinch nan merchandise of iOS 17.1, iPadOS 17.1 and watchOS 10.1.

Users of iOS 16 and iPadOS 16 besides received a fix, but those still clinging to iOS 15 did not. ®