Dave Palmer on MAC randomization
From Chasing Your Tail With a Raspberry Pi · · Black Hat
“MAC address randomization is happening constantly — I personally didn't realize it was basically constant — so for randomized devices we stop focusing on the MAC and instead look for what the device is looking for: the probe request, the actual Wi‑Fi network name.”
On , Dave Palmer, Cofounder at Darktrace, spoke about MAC randomization during Chasing Your Tail With a Raspberry Pi on Black Hat.
About Dave Palmer
Dave Palmer, cofounder and director of technology at Darktrace, has spoken extensively about the use of artificial intelligence in cybersecurity. He has stated that Darktrace's approach involves using AI to detect cyberattacks that have already penetrated an organization's defenses, rather than solely focusing on preventing intrusions. Palmer has described the technology as an "immune system" that learns normal patterns of behavior within a network and can surgically interrupt unusual activity, such as ransomware encryption, while preserving business continuity. He has also discussed the growing complexity of defending hybrid networks that include cloud, SaaS, and IoT environments, and has argued that automation and AI are necessary because the scale of modern digital businesses has surpassed human comprehension. Palmer has warned that AI will increasingly be used by criminals to automate and scale their operations, citing examples such as AI-generated spear-phishing emails and self-spreading worms that treat network propagation like a game of chess. He has noted that criminal organizations are already offering hacking tools with money-back guarantees and call centers, and has predicted that AI will make attacks more damaging once inside a network. In a separate talk on physical surveillance, Palmer demonstrated a passive Wi-Fi and Bluetooth detection system built with a Raspberry Pi, designed to help individuals determine if they are being followed. He emphasized that the tool is meant to assist people in potentially dangerous situations, and discussed how unique Wi-Fi network names and probe requests can be used for device identification even when MAC addresses are randomized.