Mike Spicer - I Know What U Did Last Summer: 3 Years of Wireless Monitoring at DEF CON

Three Years of Passive Wireless Monitoring at DEF CON

Mike Spicer presents longitudinal research from three consecutive DEF CON conferences where he deployed a mobile passive 802.11 monitoring rig, collecting and analyzing wireless traffic patterns from conference attendees.

Passive Monitoring Setup

The monitoring rig — built into a backpack — uses multiple high-gain antennas and commodity 802.11 cards in monitor mode across all Wi-Fi channels, logging probe requests, management frames, and broadcast traffic without association to any network.

Device Fingerprinting via Probe Requests

Even without connecting to any network, smartphones constantly broadcast probe requests containing the SSIDs of previously connected networks. Spicer demonstrates how these probes reveal attendees' home and work networks, travel history, and device model information through the MAC address OUI.

Year-over-Year Behavioral Trends

Tracking probe request patterns across three DEF CON conferences reveals trends in device security posture (MAC address randomization adoption, probe request frequency reductions) and demonstrates the persistent effectiveness of passive wireless surveillance despite industry countermeasures.