Accurate, ubiquitous indoor localization has long been a central goal in wireless systems, yet most proposed methods remain impractical for large-scale deployment. We present PeepLoc, a scalable Wi-Fi-based system that leverages existing infrastructure and unmodified mobile devices. PeepLoc operates in any indoor space with standards-compliant Wi-Fi APs and regular pedestrian traffic. It combines (a) extracting non-cooperative time-of-flight (ToF) from any AP, and (b) a crowdsourced bootstrapping approach using pedestrian dead reckoning (PDR) to localize APs as anchors. Implemented on commodity hardware, PeepLoc is evaluated across four buildings, achieving 3.41m mean and 3.06m median error, outperforming commercial indoor localization systems and approaching GPS-level accuracy outdoors.

This work presents an attack to undermine MAC address randomization using a dual-layer approach combining PHY and MAC-layer analysis. By passively collecting CSI features along with MAC-layer behavioral patterns, our system applies an XGBoost classifier to distinguish devices enabling MAC randomization in dense networks, achieving up to 100% precision and 86% recall.

We present results for exposing vulnerabilities in MAC address randomization using Wi-Fi network discovery traffic collected at MobiCom 2023. By analyzing probe request sequence numbers and vendor-specific information elements, we successfully link randomized MAC addresses, reducing the observed MAC addresses to linked groups by over 45%. This demonstrates current MAC randomization protocols inadequately protect device privacy during network discovery.

To prevent tracking a Wi-Fi device based on its MAC address, several operating systems have adopted MAC address randomization to conceal its factory-assigned address. This feature benefits users when their devices scan for networks, but a flaw arises when timing between transmissions stays consistent despite MAC address randomization in use. We present a defense mechanism, implemented with the Netlink library, against a time correlation attack for probe request packets on Wi-Fi devices. We show how adding random jitter to probe request transmissions renders a timing correlation attack infeasible to track devices during network discovery.