Black Hat USA 2025 | Exploiting DNS for Stealthy User Tracking
•February 20, 2026
0
Why It Matters
Even with modern privacy measures, DNS traffic remains a viable vector for stealthy cross‑network user tracking, compelling a reassessment of DNS security and regulatory oversight.
Key Takeaways
- •DNS queries can uniquely fingerprint mobile devices across networks.
- •iOS generates far more DNS requests than Android, aiding profiling.
- •Simple statistical methods outperform complex AI for DNS-based tracking.
- •MAC randomization and encrypted DNS only delay, not prevent, profiling.
- •Researchers processed 985 million DNS events from 30k devices to demonstrate feasibility.
Summary
The Black Hat USA 2025 presentation by Bitdefender researchers Yangabella and Yan Pedrian revealed how DNS traffic from smartphones can be weaponized to create persistent, cross‑network device fingerprints. By acting as a curious DNS resolver, they collected 985 million DNS events from roughly 30,000 iOS and Android devices over 35 days, demonstrating that even routine name lookups expose a rich behavioral signature.
Their analysis showed that iOS devices generate roughly ten times more DNS queries than Android, with dominant domains ranging from Apple services to major platforms like Facebook and YouTube. Using straightforward statistical tools—TF‑IDF weighting and cosine similarity—they could cluster and match device traces without resorting to opaque AI models, achieving explainable, high‑accuracy tracking within a two‑week MAC‑randomization window.
Key moments included the observation that “repetitive DNS sequences are visible to the naked eye,” and the admission that “MAC randomization only gives us a 14‑day window, while encrypted DNS merely shifts trust to the resolver.” The researchers also highlighted the computational challenge of processing tens of gigabytes of data, which they overcame with batch processing and feature hashing.
The findings underscore a critical privacy gap: current safeguards like MAC randomization and DNS over HTTPS delay but do not eliminate the ability to profile users via DNS. This raises urgent questions for regulators, DNS resolver operators, and security vendors about strengthening DNS privacy and limiting the data exposure inherent in everyday mobile app usage.
Original Description
Who needs AI when raw statistics can do the job just as well—if not better? Every Domain Name System (DNS) query leaves a trail, and with the right statistical techniques, you can uncover user behaviors, fingerprint devices, and even track individuals across networks. This session dives into how simple yet powerful methods like frequency analysis, correlation metrics, and anomaly detection can turn DNS traffic into a goldmine of intel.
We dissected over 1.5 billion DNS requests from 30,000 iOS and Android devices over a 30-day period, and the results are eye-opening. Within just minutes of observing DNS traffic, devices begin to reveal their unique fingerprints. Given only a few hours, accurate identification becomes a certainty.
But here's where it gets even more interesting—iOS devices flood the network with repetitive DNS requests, hitting the same domains over and over, while Android devices operate nearly 10x more efficiently, generating far less noise. This difference isn't just a curiosity—it's the key to our findings. With as little as 20% of DNS traffic for both iOS and Android, device tracking becomes shockingly precise.
Our research shows that simple statistical techniques are more than enough to achieve highly accurate tracking—no need for AI or complex models. This paves the way for real-world applications, especially in resource-constrained environments like routers, and, in general, in embedded systems. The combination of simplicity, accuracy, and scalability makes the technique a great candidate for large-scale deployments.
Of course, where there's a method, there's a defense. We'll also explore countermeasures to mitigate these vulnerabilities. To this end, DNSSEC and other secure protocols offer some level of protection—though as we'll demonstrate, true privacy is much harder to achieve than most expect.
By:
Bela Genge | Senior Security Researcher, Bitdefender
Ioan Padurean | Junior Security Researcher, Bitdefender
Dan Macovei | Director of Product Management
Presentation Materials Available at:
0
Comments
Want to join the conversation?
Loading comments...