Exploiting DNS for Stealthy User Tracking

## Overview

In the presentation "Exploiting DNS for Stealthy User Tracking," security researchers Bela Genge and Ioan Padurean from Bitdefender present research into user device tracking via mobile DNS request analysis. While DNS is vital for basic internet operations and security technologies (such as spam filtering, parental controls, and ad blocking), its repetitive patterns enable building device profiles that persist across distinct network contexts.

The researchers investigate whether existing technical privacy defenses—specifically MAC address randomization and encrypted/secure DNS—sufficiently mitigate device tracking. They observe that MAC addresses frequently remain constant on the same network or rotate on predictable windows (e.g., a default two-week rotation window on iOS Wi-Fi), providing ample time to collect DNS traces. Furthermore, while encrypted DNS prevents local network sniffing, users still rely on upstream DNS resolvers, which can act as "curious DNS resolvers."

---

## Dataset and Infrastructure

To study tracking feasibility, the researchers assumed the posture of a curious resolver by tapping into Bitdefender’s internal DNS infrastructure. Device identifiers were hashed to prevent reversing identifiers to MAC addresses. Key data and system metrics include:

* **Scope**: Data collected from approximately 30,000 mobile devices over a 35-day duration. * **Volume**: 985 million logged DNS events. * **Compute Infrastructure**: 4 computational clusters equipped with 480 virtual CPUs and 1.5 TB of RAM. * **Platform Differences**: * **iOS**: Dominated by requests from the United States. iOS devices generated roughly the same number of unique domains as Android, but about 10 times more total DNS requests, heavily skewed toward Apple-specific domains. * **Android**: Dominated by requests from France and the United States across fewer countries overall, focusing on Google services and common platform domains (e.g., Facebook, YouTube). * **Visualizing Patterns**: Color-coding request frequencies over 1-hour time windows across 72-hour periods revealed recurring, structured patterns and groupings over days and weeks.

---

## Analytics Methodology and Trace Modeling

Processing massive categorical string data posed two major challenges: handling high cardinality/dimensionality and scaling computation. Standard categorical encoding methods were rejected: * **One-Hot Encoding**: Led to high dimensionality. * **Label Encoding**: Imposed arbitrary alphabetical ordering on strings. * **Feature Hashing**: Suffered from hash collisions.

Instead, the researchers framed DNS request sequences as words within a text document, adopting Natural Language Processing (NLP) techniques: * **TF-IDF (Term Frequency–Inverse Document Frequency)**: * Used to quantify the frequency of requested domains and highlight rare, device-defining domains across traces. * Lower TF-IDF values correspond to high global frequency (common domains) or low single-trace frequency; higher values pinpoint domains appearing repeatedly within few specific devices. * **Cosine Similarity**: * Selected over Euclidean distance to compare TF-IDF vectors across device traces. * Effectively evaluates trace similarity independent of total request scale (e.g., identifying identical proportional domain compositions even when request counts vary).

---

## Scalability and Device Identification

To address data volume issues (where loading 30,000 devices simultaneously required tens of gigabytes of RAM), the team framed device identification mathematically as a matrix comparison problem. The evaluation parameters were configured around: 1. **Device Batching**: Processing devices in manageable batches ranging from 200 to 5,000 devices. 2. **Time Windows**: Constructing segmented device traces over specified time window intervals. 3. **Statistical vs. AI Methods**: The researchers prioritized explainable statistical analytics (TF-IDF and cosine similarity) over complex machine learning models to prevent parameter explosion and hardware exhaustion, while retaining the capability to map device traces back to unique device profiles within typical 14-day MAC rotation windows.