Apple fixed an old bug exposing a device's real MAC address to nearby wireless routers even when Private Wi-Fi Address is enabled, including in Lockdown Mode
@dangoodin — https://arstechnica.com/... X: @mysk_co : The bug addressed in iOS 17.1 is about hiding the device's MAC address from joined networks, a privacy feature introduced in iOS 14. This shouldn't be confused with another privacy feature introduced in iOS 8 that hides MACs while scanning for networks: https://thehackernews.com/... @vanhoefm : This new iPhone flaw is about tracking users *while connected* to a Wi-Fi network. Even with the CVE fixed, that's IMO hard to fully prevent. Usage of random MAC addresses while *scanning* for Wi-Fi networks seems to have properly worked all the time. https://arstechnica.com/... @cryptonator1337 : ‘Three years ago, Apple introduced a privacy-enhancing feature that hid the Wi-Fi address of iPhones and iPads when they joined a network. On Wednesday, the world learned that the feature has never worked as advertised.’ https://arstechnica.com/... Ben Hammersley / @benhammersley : @UK_Daniel_Card Ohh yeah, I'm confusing two things before coffee. There was a cve patched with 17.1 where devices with Private (MAC) Address set to on, leaked their true MAC address on 5353 anyway. Not IP. (Intrigued how LinkedIn can bypass private relay though.) https://arstechnica.com/... Gaetano Zappulla / @gaetanoz : Despite promises that this never-changing address would be hidden and replaced with a private one that was unique to each SSID, Apple devices have continued to display the real one, which in turn got broadcast to every other connected device on the network https://arstechnica.com/... @mysk_co : “Apple hasn't explained how a failure as basic as this one escaped notice for so long. The advisory the company issued Wednesday said only that the fix worked by ‘removing the vulnerable code.’” https://arstechnica.com/... Eva / @evacide : “Three years ago, Apple introduced a privacy-enhancing feature that hid the Wi-Fi address of iPhones and iPads when they joined a network. On Wednesday, the world learned that the feature has never worked as advertised.” https://arstechnica.com/... @mysk_co : NEW: Private Wi-Fi addresses had been useless ever since they were introduced in iOS 14. When an iPhone joins a network, it sends multicast requests to discover AirPlay devices in the network. In these requests, iOS sends the device's real Wi-Fi MAC address. Exposure of a device's real Wi-Fi MAC address makes it vulnerable to tracking across Wi-Fi networks. It's fixed in iOS 17.1 (CVE-2023-42846) LinkedIn: Bill Taub : iPhones have been exposing your unique MAC despite Apple's promises otherwise Clayton Miles : I remember back in the day spoofing droid IDs with ChameleMAC. Whilst only slightly detrimental on the onset, this begs some questions … Richie Muniak : Did you think Apple's privacy-enhancing feature hid your Wi-Fi address? Think again! It turns out that for the past three years … Sujata Raskar : Enter CreepyDOL, a low-cost, distributed network of Wi-Fi sensors that stalks people as they move about neighborhoods or even entire cities. … Mishaal Khan : 1️⃣ I'm surprised no one in the cybersecurity community used #WireShark to check this claim until now! … Jon Cole : What's just as dangerous as the lack of security? — A false sense of security. — #knowforsure — #cybersecurity Forums: Hacker News : iPhones have been exposing MAC addresses despite Apple's promises otherwise r/apple : iPhones have been exposing your unique MAC despite Apple's promises otherwise
Context & Ripple Effects
Apple’s privacy posture has repeatedly depended on security updates when system-level protections fall short, including the September emergency patches for actively exploited flaws. This case matters because it concerns the integrity of a privacy control rather than a conventional device-compromise bug.
The issue also narrows the practical promise of Lockdown Mode: protections can reduce exposure without necessarily preventing every form of network-level identification. Earlier iOS releases had likewise required fixes where protections were bypassed, such as flaws that defeated Blastdoor safeguards.
First-order effects
- iOS 17.1 stops affected iPhones and iPads from exposing their hardware Wi-Fi identifier to routers while Private Wi-Fi Address is enabled, reducing immediate tracking risk for users who update.
- Network operators and nearby routers can no longer rely on this bug to associate a device’s real MAC address with connections made under the privacy setting, including Lockdown Mode.
Second-order effects
- The fix restores the intended separation between a device’s privacy-preserving Wi-Fi identity and its hardware identity, forcing any tracking based on the leaked identifier to lose that signal on updated devices.
- It puts greater weight on Apple’s update adoption: users remaining on older software retain a gap in a feature introduced with iOS 14, while organizations managing Apple fleets need to treat the update as a privacy control.
Third-order effects
- The incident illustrates that anti-tracking features are only as strong as their behavior across all connection states; privacy claims will increasingly be judged on implementation details, not merely whether a setting exists.
- If similar flaws persist, hardened modes such as Lockdown Mode may be viewed as risk-reduction layers rather than complete anonymity protections, increasing scrutiny of how mobile platforms handle network identity.
The trend: Mobile privacy is shifting from visible settings toward continuous, implementation-level control of the identifiers devices expose to surrounding networks.