CrossLink links device IDs across networks to break privacy protections
CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols
Cryptography and Security
Summary
Phones send temporary ID codes over different wireless networks like LTE, WiFi, and Bluetooth to protect your location privacy. The authors found that even if each network changes these codes regularly, a passive listener can still connect the dots across networks to track a phone's movements. They built CrossLink, a tool that carefully matches these changing IDs over time and across different signals, revealing how these protections fail when combined. Their tests show that CrossLink can successfully reconstruct the paths of most users, exposing location privacy risks.
What this means in practice
- •For mobile network security teams: Detect and mitigate cross-network tracking risks from temporary identifier rotations that compromise location privacy.
- •For privacy-focused device manufacturers: Design devices and protocols that consider identifier linkability across protocols to better protect users’ location privacy.
- •For retail analytics teams: Use strategic sensor placement with cross-protocol linkage methods to track customer movement more accurately across store areas.$Commercial implications: Enables improved customer behavior tracking products by linking device IDs from multiple wireless signals for richer location data.
Authors
Aneet Kumar Dutta, Mihirraj Dixit, Kevin Gni, Wouter Lueks, Mridula Singh
Abstract
Smartphones simultaneously transmit temporary identifiers over LTE, WiFi, and BLE. Existing privacy defenses analyze identifier randomization per protocol, implicitly assuming that these protections compose across protocols. We show that they do not: Even when each protocol leaks only temporary identifiers and the adversary is fully passive, unsynchronized identifier rotations allow cross-protocol stitching of device traces. We present CrossLink, an uncertainty-aware tracing algorithm that links identifiers across time, space, and protocols under noisy localization and mobility. We evaluate CrossLink using controlled lab experiments with commodity devices and large-scale mobility simulation. Under large-scale mobility simulation, CrossLink reconstructs full traces for 83% of users, versus 22% for the best single-protocol baseline, showing that location privacy must be analyzed jointly across protocols. We further show that CrossLink remains effective under partial coverage: strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions retain sufficient cross-protocol evidence to bridge observation gaps, achieving substantially higher linkability than random deployments.