by Daniele Pantaleone - Sep 21, 2020
On September 16th of 2020, Apple released the latest version of their operating system for mobile devices: iOS 14. This new update, which came out in September like every new iOS release, introduces new restrictions on the network identifiers shared by devices, in order to better protect the privacy of users.
As a consequence of this, devices equipped with the latest version of iOS will hide their MAC address when they connect to a WiFi network, identifying themselves with a randomised address instead. This specifically affects Fing as a constantly changing MAC address equals the identification of devices as “new” on the network even when they are not, as well as an unstable monitoring of the device status.
Previous releases
Jul 20, 2020 With iOS 14, iPadOS 14, and watchOS 7, Apple will randomize the MAC address of your iPhone, iPad, and Apple Watch every time you connect it to a new Wi-Fi network. This will help in further protecting your privacy as network operators will not be able to associate a specific MAC address to your device and then keep track of its internet. A media access control (MAC) address is a unique identifier for Wi-Fi devices. Changing it isn’t an easy task until Apple’s newest operating systems made it easy. The new setting will rotate your.
Starting with the release of iOS 11 in 2017, Apple has begun to introduce restrictions on the availability of network information accessible by third-party apps. The reason why the access to certain information has been restricted is to protect users' privacy, but Apple indirectly affected network monitoring applications available for iOS. This led to the mobilisation of developers and users to save network tools on iOS. Here a list of the main changes Apple has made over the years:
- Starting from iOS 11, the possibility for third-party apps to read the MAC addresses of network connected devices has been removed. These MAC addresses, available in the ARP table of the device, have been changed with a fixed, locally administered MAC address (i.e. 02:00:00:00:00:00) which cannot be used to uniquely identify a device. This limitation has forced all applications that perform network scanning on iOS to adopt a different approach to index network discovered nodes. The lack of MAC addresses also impacts the recognition of the device manufacturer, affecting functionalities to activate and detect devices in the network.
- Starting from iOS 13, third-party applications need the user's consent to access the name (SSID) and identifier (BSSID) of the Access Point to which the device is connected. Since a WiFi network is usually always located in the same geographical area, when a device is connected to a WiFi network, the geographical location of the device can be indirectly inferred, with a certain margin of error. Therefore, Apple has decided to limit access to this information only after the user has granted access to the location. Without access to the location, and therefore without the possibility of obtaining the Access Point identifier, Fing is unable to correctly index and retrieve the scanned networks.
These two limitations have affected all network monitoring apps for iOS, including the iOS version of Fing. The other products made by Fing, namely the Fing version for Android, Fingbox, and Fing Desktop, are not affected by this limitation in any way.
Mac Address Ios Format
A new limitation with iOS 14: Private MAC Address
Starting from iOS 14 (and similarly from iPadOS 14 and watchOS 7), all devices equipped with the latest version of the Apple mobile/wearable operating system will mask their real MAC address every time they connect to a WiFi network, identifying themselves on the network using a randomised MAC address. The reason behind this further limitation is to be found once again in the protection of user’s privacy by Apple. Quoting Apple:
“To communicate with a WiFi network, a device must identify itself to the network using a unique network address called a media access control (MAC) address. If the device always uses the same WiFi MAC address across all networks, network providers and other network observers can more easily relate that address to the device's network activity and location over time. This allows a kind of user tracking or profiling, and it applies to all devices on all WiFi networks.
To reduce this privacy risk, iOS 14, iPadOS 14 and watchOS 7 use a different MAC address for each WiFi network. This unique, static MAC address is your device's private WiFi address for that network only.”
This new feature is somewhat similar to the one Google introduced with the release of Android 10, but imposes stronger restrictions that we will describe below:
Mac Address For Oculus Quest
How this impacts Fing
As is evident from the table above, the introduction of Private MAC Addresses in Apple iOS 14, iPadOS 14 and watchOS 7 systems does not allow the use of the MAC address as a stable identifier of a network device, and this affects all Fing products as the restriction relates to published network information and not to what can be retrieved from an iOS device. Due to this limitation, all network monitoring applications that use the MAC address as an identifier for devices on the network will consider a device as a “new” network device:
- Fingbox, Fing Desktop and Fing for Android will notify the device as new whenever the device's MAC address changes.
- The impact will also have repercussions on Fingbox's Digital Presence, which is closely linked to the presence on the network of a “personal” device. Since the device will be identified as “new” every now and then, the tracking of the “old” device will be automatically lost because Fingbox will no longer detect the status change (even if in reality the device is always the same).
- This new restriction, on the other hand, will not cause any problems for the iOS version of Fing, because since the release of iOS 11, IP addresses are used to index devices connected to a network, and therefore the introduction of MAC addresses randomisation does not impact the app in any way.
How this impacts Fing Device Recognition
Although the Fing device identification works at best with non-private MAC addresses, the recognition engine and AI algorithms have been evolving to cope with local addresses, as iOS, Android and Windows started to partly hide the MAC’s since 2017. When Fing Device Recognition can make use of network protocols like DHCP, HTTP user agent and hostname, it is able to leverage them in order to recognise the device and classify its type, brand and model.
How to mitigate the side effects
The Private MAC Addresses can be disabled from the device, for each WiFi network. Therefore, to improve the recognition of new devices and continue to monitor changes in status, we recommend to disable the use of Private MAC Addresses for your network on your own iOS devices. Here how to proceed:
Mac Address Ios Swift
iPhone, iPad or iPod touch
- Open the iOS Settings app, then tap WiFi.
- Tap the information button next to a network.
- Disable Private Address using the appropriate Switch.
Mac Address For Ipad
Apple Watch
- Open the Settings app, then tap WiFi.
- Tap the name of the network you joined. If you haven't joined the network yet, swipe left on its name and tap more.
3. Disable Private Address using the appropriate Switch.
Because Private MAC Addresses are bound to the access point identifier rather than the WiFi network name, if you have multiple access points serving your network in WiFi roaming, you may be required to perform this operation multiple times for each device. Indeed, a new randomised MAC address will be generated every time the iOS device jumps from being connected to a WiFi access point A to another WiFi access point B of your network.