{"id":"https://openalex.org/W4411652468","doi":"https://doi.org/10.1145/3744559","title":"Breaking BLE MAC Address Randomization with Allowlist-Based Side Channels and its Countermeasure","display_name":"Breaking BLE MAC Address Randomization with Allowlist-Based Side Channels and its Countermeasure","publication_year":2025,"publication_date":"2025-06-25","ids":{"openalex":"https://openalex.org/W4411652468","doi":"https://doi.org/10.1145/3744559"},"language":"en","primary_location":{"id":"doi:10.1145/3744559","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3744559","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3744559","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3744559","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100333755","display_name":"Yue Zhang","orcid":"https://orcid.org/0000-0002-7786-0231"},"institutions":[{"id":"https://openalex.org/I52357470","display_name":"The Ohio State University","ror":"https://ror.org/00rs6vg23","country_code":"US","type":"education","lineage":["https://openalex.org/I52357470"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yue Zhang","raw_affiliation_strings":["Department of Computer Science, The Ohio State University"],"raw_orcid":"https://orcid.org/0000-0002-7786-0231","affiliations":[{"raw_affiliation_string":"Department of Computer Science, The Ohio State University","institution_ids":["https://openalex.org/I52357470"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5026864098","display_name":"Zhiqiang Lin","orcid":"https://orcid.org/0000-0001-6527-5994"},"institutions":[{"id":"https://openalex.org/I52357470","display_name":"The Ohio State University","ror":"https://ror.org/00rs6vg23","country_code":"US","type":"education","lineage":["https://openalex.org/I52357470"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiqiang Lin","raw_affiliation_strings":["Computer Science and Engineering Dept, Ohio State University"],"raw_orcid":"https://orcid.org/0000-0001-6527-5994","affiliations":[{"raw_affiliation_string":"Computer Science and Engineering Dept, Ohio State University","institution_ids":["https://openalex.org/I52357470"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I52357470"],"apc_list":null,"apc_paid":null,"fwci":1.3357,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.82049043,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":"28","issue":"4","first_page":"1","last_page":"33"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12801","display_name":"Bluetooth and Wireless Communication Technologies","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12801","display_name":"Bluetooth and Wireless Communication Technologies","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11932","display_name":"Wireless Body Area Networks","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/2204","display_name":"Biomedical Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12079","display_name":"IoT Networks and Protocols","score":0.9954000115394592,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/countermeasure","display_name":"Countermeasure","score":0.6531621217727661},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6051356792449951},{"id":"https://openalex.org/keywords/randomization","display_name":"Randomization","score":0.5555687546730042},{"id":"https://openalex.org/keywords/side-channel-attack","display_name":"Side channel attack","score":0.5524239540100098},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.43245166540145874},{"id":"https://openalex.org/keywords/channel","display_name":"Channel (broadcasting)","score":0.41841909289360046},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3553773760795593},{"id":"https://openalex.org/keywords/medicine","display_name":"Medicine","score":0.18107208609580994},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.13937774300575256},{"id":"https://openalex.org/keywords/randomized-controlled-trial","display_name":"Randomized controlled trial","score":0.10616496205329895},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.07237911224365234},{"id":"https://openalex.org/keywords/internal-medicine","display_name":"Internal medicine","score":0.06573373079299927}],"concepts":[{"id":"https://openalex.org/C21593369","wikidata":"https://www.wikidata.org/wiki/Q1032176","display_name":"Countermeasure","level":2,"score":0.6531621217727661},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6051356792449951},{"id":"https://openalex.org/C204243189","wikidata":"https://www.wikidata.org/wiki/Q1363085","display_name":"Randomization","level":3,"score":0.5555687546730042},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.5524239540100098},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.43245166540145874},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.41841909289360046},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3553773760795593},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.18107208609580994},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.13937774300575256},{"id":"https://openalex.org/C168563851","wikidata":"https://www.wikidata.org/wiki/Q1436668","display_name":"Randomized controlled trial","level":2,"score":0.10616496205329895},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.07237911224365234},{"id":"https://openalex.org/C126322002","wikidata":"https://www.wikidata.org/wiki/Q11180","display_name":"Internal medicine","level":1,"score":0.06573373079299927},{"id":"https://openalex.org/C146978453","wikidata":"https://www.wikidata.org/wiki/Q3798668","display_name":"Aerospace engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3744559","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3744559","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3744559","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3744559","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3744559","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3744559","source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2186497367","display_name":"AI Institute for Future Edge Networks and Distributed Intelligence (AI-EDGE)","funder_award_id":"2112471","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4411652468.pdf","grobid_xml":"https://content.openalex.org/works/W4411652468.grobid-xml"},"referenced_works_count":31,"referenced_works":["https://openalex.org/W103398704","https://openalex.org/W2019698782","https://openalex.org/W2036116878","https://openalex.org/W2092553878","https://openalex.org/W2157921329","https://openalex.org/W2274307588","https://openalex.org/W2411034138","https://openalex.org/W2591782716","https://openalex.org/W2621148797","https://openalex.org/W2748719146","https://openalex.org/W2790176444","https://openalex.org/W2902420616","https://openalex.org/W2912568927","https://openalex.org/W2913347285","https://openalex.org/W2947213621","https://openalex.org/W2963660578","https://openalex.org/W2983028905","https://openalex.org/W2986203625","https://openalex.org/W2992094613","https://openalex.org/W2997157514","https://openalex.org/W3015314850","https://openalex.org/W3038161846","https://openalex.org/W3047244366","https://openalex.org/W3096391524","https://openalex.org/W3110917798","https://openalex.org/W3159047493","https://openalex.org/W4288080331","https://openalex.org/W4300424244","https://openalex.org/W4388867283","https://openalex.org/W4405907368","https://openalex.org/W6604224933"],"related_works":["https://openalex.org/W2378749186","https://openalex.org/W2364088131","https://openalex.org/W2362741838","https://openalex.org/W622044715","https://openalex.org/W2378994067","https://openalex.org/W1598708558","https://openalex.org/W2347979151","https://openalex.org/W2366397149","https://openalex.org/W2121017442","https://openalex.org/W1790664656"],"abstract_inverted_index":{"Bluetooth":[0,78,240,261,270],"Low":[1],"Energy":[2],"(BLE)":[3],"is":[4,80,139],"ubiquitous":[5],"today.":[6],"To":[7],"prevent":[8],"a":[9,13,41,48,84,93,100,237,285,294],"BLE":[10,121],"device":[11,45,49,102,165,214],"(e.g.,":[12],"smartphone)":[14],"from":[15,28,83],"being":[16],"connected":[17],"by":[18],"unknown":[19],"devices,":[20,123],"it":[21,58],"uses":[22],"allowlisting":[23,138],"to":[24,97,141,162,195,208,211,251,260,274],"allow":[25],"the":[26,51,70,142,147,191],"connectivity":[27],"only":[29],"recognized":[30],"devices.":[31],"Unfortunately,":[32],"we":[33,66],"show":[34],"that":[35,69,201,243],"this":[36,276],"allowlist":[37],"feature":[38],"actually":[39],"introduces":[40],"side":[42,116],"channel":[43,117],"for":[44,172,176,183,188,219,229],"tracking,":[46],"since":[47],"with":[50,87,119,137,236,293],"allowed":[52],"list":[53],"behaves":[54],"differently":[55],"even":[56],"though":[57],"has":[59],"used":[60],"randomized":[61,197],"MAC":[62,72,95,158,198],"addresses.":[63],"Even":[64],"worse,":[65],"also":[67],"find":[68],"current":[71],"address":[73,96,159],"randomization":[74,160],"scheme":[75,161],"specified":[76],"in":[77,267],"protocol":[79,278],"flawed,":[81],"suffering":[82],"replay":[85,92,209],"attack":[86],"which":[88],"an":[89,150],"attacker":[90],"can":[91,203],"sniffed":[94,247],"probe":[98],"whether":[99],"targeted":[101],"will":[103],"respond":[104],"or":[105],"not":[106],"based":[107],"on":[108],"its":[109],"allowlist.":[110],"We":[111,145,255],"have":[112,256],"validated":[113],"our":[114,252,258,282],"allowlist-based":[115],"attacks":[118],"43":[120],"peripheral":[122,155],"11":[124],"centrals,":[125],"and":[126,130,154,174,178,185,190,221,224,231,263,290],"4":[127],"development":[128],"boards,":[129],"found":[131],"none":[132],"of":[133,149,193,245],"them":[134,210],"once":[135],"configured":[136],"immune":[140],"proposed":[143],"attacks.":[144,254],"advocate":[146],"use":[148,192],"interval":[151],"unpredictable,":[152],"central":[153],"synchronized":[156],"random":[157],"defeat":[163,212],"passive":[164],"tracking":[166,215],"(introducing":[167,216],"1%":[168],"power":[169],"consumption":[170],"overhead":[171,182,218,228],"centrals":[173,184,230],"6.75%":[175],"peripherals,":[177,220],"88.49":[179],"\u03bcs":[180,187,223,226],"performance":[181,227],"94.46":[186],"peripherals),":[189],"timestamps":[194],"derive":[196],"addresses":[199],"such":[200],"attackers":[202],"no":[204],"longer":[205],"be":[206],"able":[207],"active":[213],"3.04%":[217],"63.58":[222],"20.54":[225],"peripherals).":[232],"Our":[233],"field":[234],"testing":[235],"long":[238],"range":[239],"sniffer":[241],"shows":[242],"16,422":[244],"100,101":[246],"devices":[248],"are":[249],"subject":[250],"BAT":[253],"disclosed":[257],"findings":[259,283],"SIG":[262,271],"many":[264],"other":[265],"stakeholders":[266],"October":[268],"2020.":[269],"assigned":[272,281],"CVE-2020-35473":[273],"track":[275],"logical-level":[277],"flaw.":[279],"Google":[280],"as":[284],"high":[286],"severity":[287],"design":[288],"flaw":[289],"awarded":[291],"us":[292],"bug":[295],"bounty.":[296]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}