  MAC address randomization is a privacy technique whereby mobile devices
rotate through random hardware addresses in order to prevent observers from
singling out their traffic or physical location from other nearby devices.
Adoption of this technology, however, has been sporadic and varied across
device manufacturers. In this paper, we present the first wide-scale study of
MAC address randomization in the wild, including a detailed breakdown of
different randomization techniques by operating system, manufacturer, and model
of device.
  We then identify multiple flaws in these implementations which can be
exploited to defeat randomization as performed by existing devices. First, we
show that devices commonly make improper use of randomization by sending
wireless frames with the true, global address when they should be using a
randomized address. We move on to extend the passive identification techniques
of Vanhoef et al. to effectively defeat randomization in ~96% of Android
phones. Finally, we show a method that can be used to track 100% of devices
using randomization, regardless of manufacturer, by exploiting a previously
unknown flaw in the way existing wireless chipsets handle low-level control
frames.
