CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols
Researchers present CrossLink, a passive tracing algorithm linking temporary device identifiers across LTE, WiFi, and BLE, reconstructing full traces for 83% of simulated users.
Smartphones emit temporary identifiers simultaneously over LTE, WiFi, and BLE, and per-protocol randomization defenses implicitly assume their protections compose across protocols. CrossLink is an uncertainty-aware tracing algorithm that stitches device identifiers across time, space, and protocols even when the adversary is fully passive and rotations are unsynchronized. In large-scale mobility simulation it reconstructs full traces for 83% of users versus 22% for the best single-protocol baseline. It remains effective under partial sniffer coverage, including strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions.
- Per-protocol identifier randomization does not compose across LTE, WiFi, and BLE.
- CrossLink links identifiers across time, space, and protocols under noisy localization.
- Reconstructs full traces for 83% of simulated users versus 22% baseline.
- Works under partial coverage: sniffers near LTE handover regions retain bridging evidence.
From the original article
1 min read at arxiv.orgSmartphones simultaneously transmit temporary identifiers over LTE, WiFi, and BLE. Existing privacy defenses analyze identifier randomization per protocol, implicitly assuming that these protections compose across protocols.
By Aneet Kumar Dutta · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.