Uncovering Privacy Leakage in BLE Network Traffic of Wearable Fitness Trackers

Das, Arindam; Pathak, Parth H.; Chuah, Chen‐Nee; Mohapatra, Prasant

doi:10.1145/2873587.2873594

Cited by 103 publications

(53 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…By contrast, our work fo-cuses on the BLE technology, and specifically uses flaws in Apple's Continuity protocol (Section 2.5) to track devices despite randomization of the Bluetooth hardware identifier. More closely related to this study is previous work on tracking users via Bluetooth identifiers and the discovery of privacy leakages in Bluetooth protocols [22,32,35,38,42,43,65]. Of these studies, most focus on Bluetooth Classic [38,43,65], whereas we study Apple's BLE Continuity protocol messages exclusively.…”

Section: Related Workmentioning

confidence: 99%

“…Fawaz et al [35] develop a tool aimed at preventing privacy leakages in BLE devices by restricting who can discover, scan, and connect to BLE; to date, this tool has not been widely adopted outside of a laboratory setting. In [32], Das et al examine the privacy leakages present in wearable fitness tracking devices, as well as the ability to track these devices and therefore their owners. Unlike [32], Apple devices implement BLE MAC address randomization, which significantly increases the difficulty of tracking them.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol

Martin

Alpuche

Bodeman³

et al. 2019

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

We investigate Apple's Bluetooth Low Energy (BLE) Continuity protocol, designed to support interoperability and communication between iOS and macOS devices, and show that the price for this seamless experience is leakage of identifying information and behavioral data to passive adversaries. First, we reverse engineer numerous Continuity protocol message types and identify data fields that are transmitted unencrypted. We show that Continuity messages are broadcast over BLE in response to actions such as locking and unlocking a device's screen, copying and pasting information, making and accepting phone calls, and tapping the screen while it is unlocked. Laboratory experiments reveal a significant flaw in the most recent versions of macOS that defeats BLE Media Access Control (MAC) address randomization entirely by causing the public MAC address to be broadcast. We demonstrate that the format and content of Continuity messages can be used to fingerprint the type and Operating System (OS) version of a device, as well as behaviorally profile users. Finally, we show that predictable sequence numbers in these frames can allow an adversary to track Apple devices across space and time, defeating existing anti-tracking techniques such as MAC address randomization.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol

Martin

Alpuche

Bodeman³

et al. 2019

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…It profoundly helps bringing intelligence to the physical products [35], thereby making all products smartly connected [36]. There are various application of IoT which span across numerous areas such as wearables, smart homes, smart cities, industrial automation and many more [37]. In order to further understand IoT, it is necessary to comprehend the different constructs of IoT.…”

Section: Internet Of Thingsmentioning

confidence: 99%

Internet of Things based Customer Relationship Management – A Research Perspective

Yerpude¹,

Singhal²

2018

IJET

View full text Add to dashboard Cite

Objectives: To study the impact of Internet of things (IoT) on the Customer Relationship Management process and evaluate the benefits in terms of customer satisfaction and customer retention. Methods: An extensive literature review was conducting wherein the constructs of CRM and IoT are studied. Various preliminary information on IoT and CRM system along with the components of Digital enablers have been evaluated. References from research papers, journals, Internet sites, statistical data sites and books were used to collate the relevant content on the subject. The study of all the relevant scenarios where there is a possible impact of IoT origin real time data on CRM was undertaken. Findings: Customer demands are continuously evolving and it is very relevant for all the organizations to align and keep pace with the change. Organizations need to be customer centric and agile to the changing market scenarios. Evaluation of the trends in mobile internet vs desktop internet was also conducted to validate the findings. Application: The usage of real time data emerging out of the IoT landscape has become a reality with the data transmitted over the Internet and consumed by the CRM system. It improves the control on the customer relationship function helping the organizations to operate within healthy and sustained profit

show abstract

“…Security is of the utmost importance in many application domains. Although recent revisions of BLE were designed for better security and have fixed several vulnerabilities [80,81], security still remains as a significant challenge for many current and future BLE applications.…”

Section: Privacy and Securitymentioning

confidence: 99%

Beyond beaconing: Emerging applications and challenges of BLE

et al. 2020

View full text Add to dashboard Cite

As an emerging technology with exceptional low energy consumption and low-latency data transmissions, Bluetooth Low Energy (BLE) has gained significant momentum in various application domains, such as Indoor Positioning, Home Automation, and Wireless Personal Area Network (WPAN) communications. With various novel protocol stack features, BLE is finding use on resource-constrained sensor nodes as well as more powerful gateway devices. Particularly proximity detection using BLE beacons has been a popular usage scenario ever since the release of Bluetooth 4.0, primarily due to the beacons' energy efficiency and ease of deployment. However, with the rapid rise of the Internet of Things (IoT), BLE is likely to be a significant component in many other applications with widely varying performance and Quality-of-Service (QoS) requirements and there is a need for a consolidated view of the role that BLE will play in applications beyond beaconing. This paper comprehensively surveys state-of-the-art applications built with BLE, obstacles to adoption of BLE in new application areas, and current solutions from academia and industry that further expand the capabilities of BLE.

show abstract

Uncovering Privacy Leakage in BLE Network Traffic of Wearable Fitness Trackers

Cited by 103 publications

References 7 publications

Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol

Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol

Internet of Things based Customer Relationship Management – A Research Perspective

Beyond beaconing: Emerging applications and challenges of BLE

Contact Info

Product

Resources

About