A Novel Covert Channel for IEEE 802.11 Networks Utilizing MAC Address Randomization

Abstract

Vendors implement the MAC address randomization technique to prevent IEEE 802.11 client station devices from being tracked. Although it conceals device identity, it cannot hide its occurring data transmission. This paper presents a novel covert channel that leverages the MAC address randomization technique to create a covert channel to hide data transmission inside IEEE 802.11 networks. The secret data are a disposable random MAC address generated by the IEEE 802.11 station as part of the probe request frame while scanning the network. The paper presents the concept of the covert channel, its implementation, and performance metrics. The study covers diverse scenarios, including the adaptation of the modified Selective Repeat ARQ protocol to alleviate the impact of the number of client stations and their offered loads on the covert channel. The results show that with the appropriate parameter selections, we can adapt the covert channel to produce excellent throughput, efficiency, delay, and jitter according to the environment in which it is installed.

StegoBackoff: Creating a Covert Channel in Smart Grids Using the Backoff Procedure of IEEE 802.11 Networks

“…One effective approach is leveraging fields that permit the use of custom values. The study [18] introduces an innovative covert channel that exploits the MAC address randomization technique for concealing data transmissions within IEEE 802.11 networks. In this covert communication method, disposable random MAC addresses are employed, generated by the IEEE 802.11 station as an integral part of the probe request frame during the network scanning phase.…”

“…Medium Medium [18] The hidden information consists of a one-time-use random MAC address created by the IEEE 802.11 station during the network scanning process within the probe request frame.…”

LoRa network protocol design based on CSMA/CA with asynchronous downlink mode

“…For downlink communication, the gateway follows the asynchronous downlink mode for communication as described below. There are time parameters in the protocol such as DIFS, SIFS, SlotTime [5] . The size of these parameters depends on the LoRa physical layer parameters.…”