3 ms·
Perhaps you would like to explain what the problem with this is? Broadcasting presence in itself is not a security hole - unless you think "Do not broadcast SSI
by matthewmacleod 10y ago
Perhaps you would like to explain what the problem with this is? Broadcasting presence in itself is not a security hole - unless you think "Do not broadcast SSID" is a WiFi AP security feature (it's not). If WiFi can be secured (with devices that "scream data about themselves"), why would Bluetooth be any different?
Well, there are a couple of reasons I think this is different:
1. APs are static and not mobile, versus Bluetooth devices – which can move, and are more importantly personally associated with a person. That inherently provides opportunities for more leakage on information, since device addresses can now be used to track people.
2. Devices aren't just advertising their existence. They're also advertising their services, and in some cases actually just sending whatever data a client asks for. There's a particular brand of iPad stylus which seems to just open up and send it's accelerometer readings to any device which connects. There seem to be heart-rate monitors that do the same.
For me, it's much more worrying that devices happily broadcast personal information without authentication – I don't actually think device advertisement is a big deal in comparison!
- secfirstmd 10y agoAgreed. Checking for Bluetooth devices in the immediate area is one trick we teach in our physical counter-surveillance training for NGOs and journalists in high risk countries.
- digi_owl 10y agoThe basic problem with 2, is that until nfc became commonplace doing pairing was either by pin not at all. So many devices still accept 0000 or 1234 because they have so way to input a pin, and is too old to use nfc pairing.
- matthewmacleod 10y agoEven then, quite a lot of Bluetooth LE devices don't have support for authentication as such. How to you authenticate a connection to a heart monitor, for example? It doesn't have any buttons!