MAC Address Randomization in Mobile Devices and When it Fails
MAC Address Randomization in Mobile Devices and When it Fails
arxiv.org
A Study of MAC Address Randomization in Mobile Devices and When it Fails

I was annoyed by MAC Randomization on my own network and wondered whether there are any effective attacks to re-id devices.
Sure enough.
See also (van Hoef is also the brains behind several of the WPA attacks.)