Fingerprinting using Fine Timing Measurement

Abstract

The time-of-flight based ranging mechanism defined in 802.11-2016 offers a range of parameters too rich to be implemented with similar pattern among vendors, unless further guidance is formulated on what parameter sets are reasonable. We examine 802.11-2016 FTM, and show that simple FTM frame observation can easily allow for individual chipset identification. We also show that a learning machine can recognize individual machines performing FTM exchanges, even when these machines implement the same chipset or the same hardware platform. We also suggest ways to mitigate individual device patterning based on FTM exchange observation.