'Private Wi-Fi Address' Was A False Sense Of Security Before Apple Fixed It Three Years Later

Apple

Apple's is considered to have one of the most secure platforms in tech. But just like anything else, bugs are present.

There have been several instances where its iOS operating systems had bugs that went unnoticed. From the Shrug Bug, the DoorLock bug, the BLASTPASS bug, and more.

This time, yet another bug was found.

But not just any bug, because this bug was a false sense of security Apple gave.

Back in 2020 on iOS 14, Apple introduced what it calls the 'Private Wi-Fi Address, which supposed to mask an iPhone’s Media Access Control (MAC) address with a different set of numbers whenever users connect to a Wi-Fi network.

With the privacy feature, users device's real MAC address is kept hidden so any potential bad actors won’t be able to track them.

At least, that’s how it was supposed to work.

According to cybersecurity expert Mysk, it is possible for someone to find the actual MAC address if they know where to look.

Mysk explains that whenever an iPhone or iPad connects to a Wi-Fi network, it proceeds to send out “multicast requests” to see if there are any AirPlay devices nearby.

The issue here is that, anyone with the knowledge and the technical know-how, should know that the address is tucked away by Apple in Port 5353.

For users who use Apple's hardened security feature Lockdown Mode, it's still possible to find an iPhone's real MAC address because the devices continues to send out those requests.

This time, alongside the release of iOS 17.1, Apple finally took notice, and fixed it.

With the update, Apple finally makes Private Wi-Fi Address feature work like it should, by fixing the vulnerability, tracked as CVE-2023-42846.

The move apparently took the tech giant three years.

Apple released the patch to slightly older hardware, including the iPhone 8, running iOS 16.

But older iPhones running older iOS versions are still vulnerable.

It's worth noting that there haven’t been any major incidents revolving around bad actors using this bug to follow people.

But still, a bug is a bug, and when it comes to a software bug, the best bug is a squashed bug.

Published: 
28/10/2023