Slashdot Mirror
Sniffing and Tracking Wearable Tech and Smartphones
An anonymous reader writes: Senior researcher Scott Lester at Context Information Security has shown how someone can easily monitor and record Bluetooth Low Energy signals transmitted by many mobile phones, fitness monitors, and iBeacons. The findings have raised concerns about the privacy and confidentiality wearable devices may provide. “Many people wearing fitness devices don’t realize that they are broadcasting constantly and that these broadcasts can often be attributed to a unique device,” said Scott says. “Using cheap hardware or a smartphone, it could be possible to identify and locate a particular device – that may belong to a celebrity, politician or senior business executive – within 100 meters in the open air. This information could be used for social engineering as part of a planned cyber attack or for physical crime by knowing peoples’ movements.” The researchers have even developed an Android app that scans, detects and logs wearable devices.
whatever turns you on I suppose
This reminds me of the Minority Report scene, where people could easily be tracked by their eyes being scanned and the annoying part of it I always thought was the loud mouthed advertising, with the ads giving out your name and what you bought yesterday.
"Hi there, Jane, how are you enjoying those extra absorbent tampons you bought last week, is everything ok? Need some new underwear?"
As to tracking for your own legal purposes, there are many services designed for that. Any technology can be abused, the question is what do you find acceptable risk?
I fee sooo left out way out here in the sticks where I'm not getting my Bluetooth sniffed, or anything else except by the local wild and semi-wild fauna.
Not.
Seriously not. Adds one more reason to my list not to go down off the mountain...
The findings have raised concerns about the privacy and confidentiality wearable devices may provide.
Who ever suggested that there was any "privacy and confidentiality" of wearable devices that use Bluetooth? Who would even think such a thing? We're not talking about encrypted communications devices here...
If you want news from today, you have to come back tomorrow.
Broader privacy implications aside, it's actually kind of neat to be wearing a device which can identify when you're in a particular space and how long for. We have a volunteer tech group working on projects at our local museum and one of the guys implemented a fitbit scanner to identify when people were present and how long for (which is useful, as bureaucracy dictates we sign in/out for fire and visitor-tracking reasons). Every few minutes it broadcasts a request for fitbits, and all those within range respond. They return a mac which can be linked back to a fitbit account, if the user has authorised us to access it, which makes it a bit easier to identify the person who owns the fitbit. We could probably replace it with another sign in system, but passive is kind of neat when you want it.
I assume resolving the identifying problem wouldn't be as easy as using a random mac?
Whatever happened to good ol' fashioned stalking being the problem. Or, you know, the criminal being the problem.
I don't blame technology. I blame the criminal for comiitting the crime.
... and it does nothing.
It little behooves the best of us to comment on the rest of us.
"Sniffing and tracking"? My seven year old beagle does those things and has much longer battery life.
Call me when you're bluetooth device can fetch a tennis ball.
You are welcome on my lawn.
Saturate your body with sensors. A bluetooth connection for every hair in your ears, nose and butt. Wifi for each of your liver's lobes, flow sensor in your intestines, strain gauges glued to your nails, ears and eyelids, a nanomagnetometer for every neuron, tile the inner wall of your small intestine with enzyme chips, etc, etc. If enough people follows that trend, soon the data flow is going to surpass any available computing power to process it. An being fashionable in the process, the real concern of most gadget users.
While they are admittedly a staple of low-budget action shlock; it seems that the 'celebrities, politicians, and high level business executives'(none of those midlevel guys, do you know what a kidnapping costs, per kilogram of hostage?) would be the least relevant targets for this flavor of attack.
Fancy prominent people are valuable, strategically relevant, or have deranged and dangerous fans. Such people have merited considerable human effort on the part of assorted attackers more or less since the invention of enough society to be hierarchical.
A cheap, ubiquitous, trivial-to-implement; and quite possibly also legal (no reasonable expectation of privacy, yadda yadda) tracking mechanism doesn't change the game for them, it changes the game for every last Joe and Jane Nobody with some RF widget. As cellphones have demonstrated, enough bluetooth to track nearby bluetooth radios, and enough cellular hardware to report back to the mothership is smaller than a deck of cards, especially if installed somewhere with access to power. It's also cheap, potentially vanishingly so compared to things like billboard/signage space in well traveled areas, or other plausible deployment points.
"The CEO of SomethingDyne Corp has been kidnapped! Can you backtrace his bluetooth?" makes a better B movie; but this tracking technique is far more promising as a cheap, ubiquitous, mass observation mechanism(probably for some bullshit 'audience engagement metrics' thing, not even a proper authoritarian dystopia) than it is for picking off some dude in an armored limo with a couple of those ear-radio guys flanking him.
Bluetooth 4.1 adds Randomised private resolvable addresses. This allows only bonded devices to be tracked this way.
Isn't leaking personally identifiable health information a violation of HIPPA?
Why use the bluetooth in the first place? I only use usb cable and wifi to connect to computer.
Best action is to disconnect the actual bluetooth antenna, so that you can plug it back, if you ever really need that damn bluetooth.
"...identify and locate a particular device – that may belong to a celebrity, politician or..."
IOW a wet dream for paparazzi.
before someone puts up a website of interesting mac's seen/to watch for.
I wonder if this can go both ways?
Can you send to the device, or look like you are sending form the davice?
Seems like this wearable stuff is not fully thought out.
Perhaps the next gen will have power backoff to prevent emitting a bigger signal than it has to.
The latest wave of BLE / "Bluetooth Smart" devices, everything from headphones to keyboards to fitness bands, are a joke. Not only is the connection reliability *terrible*, but a paper describing a method of attack the protocol has been out for a while now.
My suggestion, and what I currently do, is refuse to buy any product that advertises that it supports or uses Bluetooth Low Energy or Bluetooth Smart or Bluetooth 4.0. Anything similar to that in the marketing literature or tech specs, and I pass it by. Bluetooth 4.0 might be OK, as long as one of the two devices you're connecting only supports Bluetooth 3.0 or earlier. And yes, I'm aware that not all Bluetooth 4.0 devices are using BLE/Smart, but in my testing and experience, anything communicating with the Bluetooth 4.0 protocol is fraught with problems.
I'm getting a lot more use than I expected out of devices and peripherals that are more than 2 years old that support BT 2.1 or BT 3.0. Looks like I'll be hanging on to them for another 1-2 years until they design a revised low energy protocol that isn't an absolute joke. No one's laughing, Bluetooth SIG.
And, yeah... the reliability issues are especially galling.
I have a bunch of different pairs of Bluetooth headphones and devices that transmit bluetooth audio, from "adapters", to smartphones, to desktop computers with a Bluetooth dongle, to laptops with built-in Bluetooth.
I consistently get great sound and no dropouts or clicks or pops, even at distances of 7 - 8 meters (usually further than most bluetooth devices can transmit without starting to drop out), as long as *at least one* of the devices does not support BLE/Bluetooth Smart/4.0. However, if both the headphones and the transmitter support Bluetooth 4.0 and/or Bluetooth LE, I get consistent and horrid clicks and pops and dropouts, regardless of range or wireless interference. To rule out interference, I performed the tests both at home and at work; my home environment has almost no traffic in the 2.4 GHz band, while the wireless environment at work is extremely noisy.
My tests are pretty conclusive. Right now, in my opinion, the best thing you can do is either don't buy Bluetooth 4.0 / BLE devices, or if you do, make sure you're pairing it with a device that forces it into an earlier-spec compatibility mode, like Bluetooth 3.0. You may, in fact, get worse battery life if you do this, but I would gladly trade that for extended range, reliability and sound quality, which is especially important if you are listening to music.