Tracking Anonymized Bluetooth Devices

Abstract

Bluetooth Low Energy (BLE) devices use public (non-encrypted) advertising channels to announce their presence to other devices. To prevent tracking on these public channels, devices may use a periodically changing, randomized address instead of their permanent Media Access Control (MAC) address. In this work we show that many state-of-the-art devices which are implementing such anonymization measures are vulnerable to passive tracking that extends well beyond their address randomization cycles. We show that it is possible to extract identifying tokens from the pay-load of advertising messages for tracking purposes. We present an address-carryover algorithm which exploits the asynchronous nature of payload and address changes to achieve tracking beyond the address randomization of a device. We furthermore identify an identity-exposing attack via a device accessory that allows permanent, non-continuous tracking, as well as an iOS side-channel which allows insights into user activity. Finally, we provide countermeasures against the presented algorithm and other privacy flaws in BLE advertising.

Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol

“…Contemporaneously and most closely related to our work, Becker et al [22] examine tracking devices using randomized BLE identifiers. While they examine OSes we do not (Windows, Android), their Apple evaluation considers the BLE messages to be largely uninterpretable data; we exhaustively reverse-engineer the Continuity protocol, revealing both the structure of the messages as well as what actions are required to produce them.…”

Regulatory, safety, and privacy concerns of home monitoring technologies during COVID-19

“…Cybersecurity vetting can take months, especially for newer products, which could prevent the rapid deployment of these technologies when they are most needed. The use of Bluetooth technology for exposure notification, for example, is far less invasive than the collection of WiFi or global-positioning-system location data, but Bluetooth is also known to be vulnerable to cyber attacks 39,40 .…”

Uncovering Practical Security and Privacy Threats for Connected Glasses with Embedded Video Cameras

“…One sensible hypothesis after analyzing the prior work on the security and privacy of wearables is that the increasing complexity of these devices and the functionalities they offer to their wearers, e.g., Bluetooth and Wi-Fi connectivity, increase the attack surface on the data that is collected, stored, and shared compared to on-board storing and processing in line with the general observation that "as the complexity of the environment increases, the number of elements in that environment creates additional risk" [47]. This, in turn, allows new points of entry for attackers that exploit Wi-Fi and/or Bluetooth vulnerabilities for such devices [11,60,67,74,90]. For example, security analysis of fitness tracking devices concluded that none could guarantee data integrity, authenticity, and confidentiality [30].…”

“…(1) MAC address disclosure can be partially prevented, according to expert E 1 , by (i) using address randomization whenever devices are broadcasting on public channels before the pairing phase and (ii) by using hash-or encryption-based anonymization; although see Demir et al [22] and Becker et al [11] for caveats, e.g., hash-based anonymization in Wi-Fi tracking systems can still be defeated by using an appropriate guesswork [22]. Since the glasses device acts as an Access Point, MAC address randomization could be implemented in several ways.…”

“…, left) revealed: (1) a power source connected to the battery from the other temple, (2) a Camera Serial Interface (CSI) connector to implement the interface between the video camera and the host processor, (3) a power LED indicator, (4) a Wi-Fi LED indicator, (5) a LR44 battery, (6) a microphone, (7) two firmware (FW) pins, probably serving for the programming interface, (8) an RX/TX pin, and (9) an on/off switch button. The bottom layer of the PCB(Figure 3, right) revealed several additional components: (10) a Wi-Fi antenna,(11) an SV6030P wireless communications chip located in the proximity of the antenna supporting WEP, WPA1, and WPA2 security protocols in the 2.4 GHz band, (12) a 26 MHz real-time clock, (13) a microcontroller (of an unknown model),(14) flash memory, model P25Q15H[73] of 2048 kB, and (15) an SD CARD interface.…”