IDBLEED Deanonymizing IoT via Exclusive-Use Side Channel

IDBLEED: Deanonymizing Device Identities via Side-channel Attacks in Exclusive-use IoTs

· 2 min · 460 words

topic/papercomputer science/securitycomputer science/networkingcomputer science/privacycomputer science/side channels

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: IDBLEED introduces a boolean side channel in exclusive-use wireless communication (BLE/WiFi) where devices only communicate with trusted peers. By observing whether communication succeeds or fails — regardless of encryption, authentication, or MAC randomization — an attacker can determine if two devices “trust” each other, enabling device deanonymization and tracking. The attack exploits behavioral differences at encryption, integrity verification, and authentication phases. The authors propose ANONYMIZATIONLAYER, a privacy-preserving mitigation with only ~2% overhead.

1. High-Level Overview

MAC address randomization was supposed to prevent device tracking. But IDBLEED shows that even with perfect randomization, exclusive-use relationships create an observable side channel: trusted devices communicate successfully; untrusted devices are rejected. This boolean signal (success/failure) leaks the trust relationship regardless of protocol-level protections.

2. The Boolean Side Channel

Exclusive-use = a device provides functionality only to associated/paired devices (e.g., your phone ↔ your smart speaker).

The side channel manifests at multiple protocol stages:

  • Encryption phase: trusted devices complete key negotiation; untrusted fail
  • Integrity verification: trusted devices pass MAC verification; untrusted get rejected
  • Authentication: trusted devices authenticate; untrusted are denied
  • Auto-connection: trusted devices reconnect automatically; untrusted are ignored

Each of these creates an observable binary outcome visible to a passive sniffer: either the handshake continues or it terminates. No decryption needed.

3. IDBLEED Attack

  • Attacker deploys relay nodes at different locations
  • Relays forward packets between a candidate smartphone and a known exclusive-use device (e.g., Alice’s smartspeaker left at home)
  • If communication succeeds → the smartphone is Alice’s (trust relationship confirmed)
  • If communication fails → the smartphone belongs to someone else
  • This deanonymizes the device and reveals its location at the relay point

4. Evaluation

  • Tested against BLE and Wi-Fi exclusive-use protocols
  • Works despite: MAC randomization, WPA2/WPA3 encryption, protocol-level authentication
  • ANONYMIZATIONLAYER defense: <2% overhead on smartphones/PCs

5. Key Findings

  1. Trust relationships are inherently observable — the boolean success/failure of protocol handshakes cannot be hidden
  2. MAC randomization is insufficient — the side channel operates above the address layer
  3. Cross-protocol — affects BLE, WiFi, and any exclusive-use wireless protocol
  4. Practical attack — requires only relay nodes and passive observation
  5. Efficient defense exists — ANONYMIZATIONLAYER at ~2% overhead

6. TL;DR

Exclusive-use device relationships leak a boolean side channel: trusted devices communicate, untrusted don’t. IDBLEED exploits this to deanonymize and track devices despite MAC randomization and encryption. Affects BLE and WiFi. Mitigation (ANONYMIZATIONLAYER) costs ~2% overhead.

Sources

  1. NDSS 2025 Paper (DOI): https://dx.doi.org/10.14722/ndss.2025.240703
  2. Authors: Christopher Ellis, Mohit Jangid, Shixuan Zhao, Zhiqiang Lin (Ohio State), Yue Zhang (Drexel)