Apps,like facebook,that perform ARP protocol,get your MAC address,how to prevent

Intellectual2

Of course you can just not install social media mobile apps to begin with. But thats not point of post or what I'm asking. Can grapheneOS block apps from performing ARP protocol to prevent the mobile app from figuring out your MAC address of your PC, smartphone or modem/router? Or can you alternatively stop other devices from responding to ARP protocol/sniffing? For example, can you tell your device to stop responding to ARP request, without having to totally turn off the device? Facebook mobile app performs invasive ARP protocol to figure out what your MAC address is. And they use this to identify you even when you use a VPN/IP address masker.
--Thanks!

[deleted]

Intellectual2

It is not as difficult to use search or to read recommended https://grapheneos.org/faq and https://grapheneos.org/usage. We would diminish greatly many and many new threads asking the same questions all over again.

Answers to your comment is here:
https://grapheneos.org/faq#hardware-identifiers

Intellectual2

[deleted], thank you. The FAQ mentions that privileged apps included in the base system can access the MAC address,ones that have "READ_PRIVILEGED_PHONE_STATE whitelisted". Is this something u can easily turn off & on? How can an app become privileged? Sorry to bother, I am trying to learn & want to install grapheneOS. I've got to be allowed to ask questions somewhere, you know.

graphvpnquestion

[deleted]

This doesn't even answer the original question. Using ARP to obtain the MAC address would bypass the permissions checks. I would've thought that apps would not be able to perform ARP as it would require a raw socket which is typically reserved for root, but at some point I concluded that Spotify was bypassing my Mullvad VPN which had local network sharing disabled. I don't know how this was happening, but I think it would be a similar situation.

Pretty sure I was able to control Spotify on one phone from another phone. Either Mullvad wasn't properly disabling local network access or Spotify was bypassing it.

Intellectual2

graphvpnquestion wow, thanks! far out. was this spotify on a PC or smartphone?

Intellectual2

graphvpnquestion Here is someone's reply to ur spotify comment: "You cannot access /proc/net/arp with a file handle as as this post suggests on Android 10+ and ip neigh show won’t work on devices newer than Android 11 (SDK 30 and above). Accessing ARP cache through Google’s APIs isn’t possible as there is no permission that grants that."

Graphite

graphvpnquestion

Can you do a packet capture on that LAN segment. And also use a terminal like Termux and run ifconfig.

I don't think it would be ARP or any Layer 2 stuff. I would think that it would IP Multicast on your Wifi's network. Like Chromecast or Bonjour for iOS.

A VPN would not even try to tunnel local LAN traffic. When the tun0 is created, the routing tables update and create a default route out through the tunnel. But there is a higher priority route for your local LAN subnet that won't get tunneled.
Apps can listen for multicast packets, and don't require any additional permissions to see the local LAN IP/subnet.

Graphite

graphvpnquestion bypassing my Mullvad VPN which had local network sharing disabled

No idea how Mullvad or any Android VPN disables local network access. Maybe they are pushing routes for the 3 common internal subnets? In which case can be a bug.

UPDATE: Just confirmed with ProtonVPN, which has a similar "LAN connections" feature. It pushes a bunch of extra routes. Instead of Termux, I used Ping&Net app with Network Info.

Try looking at your routing table with Ping&Net during 3 conditions: No VPN, VPN with local network sharing disable, and again with enabled. Compare the results.