CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols
Researchers present CrossLink, a passive tracing algorithm linking temporary device identifiers across LTE, WiFi, and BLE, reconstructing full traces for 83% of simulated users.
Smartphones emit temporary identifiers simultaneously over LTE, WiFi, and BLE, and per-protocol randomization defenses implicitly assume their protections compose across protocols. CrossLink is an uncertainty-aware tracing algorithm that stitches device identifiers across time, space, and protocols even when the adversary is fully passive and rotations are unsynchronized. In large-scale mobility simulation it reconstructs full traces for 83% of users versus 22% for the best single-protocol baseline. It remains effective under partial sniffer coverage, including strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions.
- Per-protocol identifier randomization does not compose across LTE, WiFi, and BLE.
- CrossLink links identifiers across time, space, and protocols under noisy localization.
- Reconstructs full traces for 83% of simulated users versus 22% baseline.
- Works under partial coverage: sniffers near LTE handover regions retain bridging evidence.
Full article156 words · extracted from arxiv.org · click to collapse
Smartphones simultaneously transmit temporary identifiers over LTE, WiFi, and BLE. Existing privacy defenses analyze identifier randomization per protocol, implicitly assuming that these protections compose across protocols. We show that they do not: Even when each protocol leaks only temporary identifiers and the adversary is fully passive, unsynchronized identifier rotations allow cross-protocol stitching of device traces. We present CrossLink, an uncertainty-aware tracing algorithm that links identifiers across time, space, and protocols under noisy localization and mobility. We evaluate CrossLink using controlled lab experiments with commodity devices and large-scale mobility simulation. Under large-scale mobility simulation, CrossLink reconstructs full traces for 83% of users, versus 22% for the best single-protocol baseline, showing that location privacy must be analyzed jointly across protocols. We further show that CrossLink remains effective under partial coverage: strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions retain sufficient cross-protocol evidence to bridge observation gaps, achieving substantially higher linkability than random deployments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.09963