Exploiting DNS for Stealthy User Tracking

Exploiting DNS for Stealthy User Tracking

Speakers: Iango Bela (Senior Security Researcher, Bitdefender) and Ioan Padurean (Junior Security Researcher, Bitdefender)

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=xQy1YcLK1Ak

Reading Time: ~8 minutes

Type: Briefing

TL;DR

Researchers from Bitdefender demonstrated that DNS request patterns generated by smartphones are distinctive enough to fingerprint and track individual devices across network contexts with over 95% accuracy — using only statistical methods available for as little as $3,000 per month. Privacy controls like MAC address randomization and encrypted DNS reduce but do not eliminate the risk, and the technique works even within the two-week rotation window of modern iOS and Android randomization defaults.

Introduction

DNS was designed as a universal directory service, not a surveillance mechanism. But the researchers from Bitdefender's Transylvania offices discovered that the very universality of DNS — the fact that every application on every device uses it — makes it a surprisingly rich behavioral fingerprint. What began as research into improving parental control and spam filtering turned into a demonstration that smartphones can be tracked across networks without any access to advertising IDs, cookies, or device-level identifiers.

Iango Bela, a senior security researcher focusing on IoT security, and Ioan Padurean, whose background is in applied machine learning, presented the first study with exclusive focus on smartphone DNS fingerprinting. Their methodology is deliberately accessible: no exotic AI tooling, no novel hardware, only statistical techniques that any curious DNS resolver — whether a telco, a security vendor, or a malicious actor — could reproduce.

The Threat Model: The Curious DNS Resolver

Every DNS query a mobile device sends passes through a resolver. In most configurations, that resolver is controlled by a network operator, an ISP, or a security service. Each of these entities sits in a position to observe the full stream of DNS requests generated by every device on their network.

▶ Watch: DNS and the Privacy Problem (02:00)

Privacy measures exist to limit exploitation of this position. MAC address randomization — now default on both iOS and Android — prevents persistent device identification across network connections. Encrypted DNS protocols (DoH, DoT) obscure query contents from passive eavesdroppers. But both measures have gaps.

On iOS, the default MAC rotation period for a given Wi-Fi network is two weeks. This gives any observer in the resolver position a 14-day window during which a device presents a stable identifier. The Bitdefender research demonstrates that two hours of DNS traffic is sufficient to begin building a useful device profile — and that 24 hours of accumulated data is enough to identify a device within a pool of 2,500 at over 90% accuracy.

Encrypted DNS shifts the trust boundary rather than eliminating it: a device using DNS-over-HTTPS is still handing its queries to another resolver, which may be equally curious. The researchers documented historical cases in which telecoms have shared DNS data with governments and used it for targeted advertising without explicit consent.

Dataset and Methodology

At Bitdefender, multiple security products rely on proprietary DNS resolvers. After implementing privacy safeguards — specifically, hashing device identifiers so that MAC addresses could not be reverse-engineered from the research data — the team tapped those resolvers and collected DNS logs across a six-month period in 2024. The resulting dataset covered hundreds of thousands of iOS and Android devices spanning multiple countries, with France and the USA contributing the most requests.

▶ Watch: Dataset Overview and iOS vs. Android Differences (10:01)

A notable platform difference emerged immediately: iOS devices generate roughly ten times more DNS requests per device than Android devices, while the count of unique domains queried is roughly similar between the two platforms. iOS request patterns cluster heavily around Apple infrastructure; Android patterns center on Google services and popular third-party platforms. Both operating systems show highly repetitive request sequences — periodic background DNS activity generated by apps, system services, and cloud synchronization that creates a stable behavioral baseline even when users are not actively engaged with their devices.

From Raw Requests to Trackable Profiles: TF-IDF and Cosine Similarity

The core analytical challenge was representation. DNS domain names are categorical strings — values that machine learning algorithms cannot process directly. Standard encoding strategies (one-hot encoding, label encoding, feature hashing) all carried prohibitive dimensionality or collision problems at the scale of the dataset.

▶ Watch: Encoding DNS as NLP — The TF-IDF Approach (12:01)

The breakthrough came from treating each device's DNS trace as a document and applying natural language processing techniques borrowed from information retrieval. The team used TF-IDF (term frequency–inverse document frequency), a weighting scheme in which a domain queried frequently by a specific device but rarely by others receives high weight — effectively making it a strong fingerprint — while domains queried by almost everyone (Apple push notification servers, Google CDN endpoints) receive low weight.

To compare device traces, the researchers used cosine similarity, which measures the angle between two high-dimensional TF-IDF vectors. Cosine similarity is robust to differences in request volume — a device that generates twice as many queries as another but with the same distribution of domains appears as identical, which correctly captures behavioral similarity regardless of usage intensity.

The tracking methodology was then formalized in two metrics: an average self-similarity index (how consistent a device's DNS behavior is with itself over time) and a tracking index that compares self-similarity to cross-device similarity. A device with a tracking index above zero is meaningfully distinguishable from the pool.

Accuracy Results: Statistical Methods vs. Machine Learning

With batches of 250 iOS and 250 Android devices, the statistical approach reached 95% tracking accuracy after 24 hours of accumulated DNS traces. The accuracy curve climbed steeply in the first two hours — demonstrating that even short exposure windows are exploitable — and continued improving with additional data.

▶ Watch: Accuracy Results and Pool Size Analysis (18:01)

Scaling the pool to 2,500 devices reduced accuracy but did not collapse it: 24-hour traces still yielded over 90% identification accuracy in a mixed iOS/Android pool. This is the scale that approaches real-world deployment scenarios in enterprise networks or medium-sized ISP segments.

The team also trained LSTM (Long Short-Term Memory) neural networks on the same data, treating DNS request sequences as time series. A single LSTM layer with 188 cells achieved 96% test accuracy for both operating systems — marginally outperforming the statistical approach. However, the resource requirements were substantial: training 40 models per operating system across 2,500 devices required 280 GB of RAM for iOS and 190 GB for Android, running across two 64-vCPU computational clusters for nine days.

▶ Watch: LSTM Results and Resource Trade-offs (20:02)

The cost estimate for deploying a cloud-based version of this tracking system using commodity infrastructure: approximately $3,000 per month at minimum. The researchers framed this as "virtually anyone with minimal resources" being capable of operating such a system.

Beyond Tracking: Behavioral Change Detection

The researchers explored one extension of the fingerprinting capability: detecting significant behavioral changes in a device's DNS profile over time. Using clustering and silhouette scoring across two-week observation windows, the system could identify outlier devices whose DNS behavior had shifted substantially — changes traceable to new app installations, changes in browsing habits, or changes in physical location.

This extends the threat surface beyond simple re-identification. A persistent DNS observer could infer when a target device moves to a new environment, installs new applications, or changes primary services — a capability with clear implications for surveillance use cases.

Notable Quotes

"By looking with our naked eyes, we were seeing the same DNS requests and the same sequences and patterns being generated by devices. So we thought, okay, if we are seeing these repetitive sequences — why not try to track them?"

— Iango Bela ▶ 02:00

"Time will heal not only wounds, but also our tracking accuracy. The more you stay online with the same identifier, the more DNS traces you will generate."

— Iango Bela ▶ 18:01

"By using the cheapest cloud provider, there will be a minimum of around three thousand dollars a month — so virtually anyone with minimal resources can do this."

— Iango Bela ▶ 22:02

"We decided to keep it simple and maximize our ability to process a vast amount of data. We like to have explainability for our results."

— Ioan Padurean ▶ 14:01

Key Takeaways

• DNS is a behavioral fingerprint. The pattern of domains queried by a smartphone — their frequency, sequence, and distribution — is distinctive enough to identify a device across network contexts at over 95% accuracy.
• MAC randomization reduces but does not eliminate tracking risk. Two-week rotation windows are long enough that useful profiles can be built within a single rotation period. More aggressive randomization schedules would meaningfully raise the cost of tracking.
• Encrypted DNS shifts the trust problem, not the data exposure. DoH and DoT protect queries from passive eavesdroppers but require trusting the resolver. The "curious DNS resolver" threat remains.
• Statistical methods suffice for attackers with modest budgets. TF-IDF and cosine similarity achieve tracking accuracy comparable to LSTM neural networks at a fraction of the computational cost. A capable adversary does not need deep learning infrastructure.
• Defenders should enforce transparency. Organizations collecting DNS data for security purposes should document what is collected, for how long it is retained, and how it is anonymized — and apply DNS proxies and request aggregation to reduce device fingerprint distinctiveness.

Slides

No slides PDF was listed for this talk. A white paper accompanying the research is referenced by the presenters and available through Bitdefender.