4 ms·

Lost and Found: Stopping Bluetooth Finders from Leaking Private Information

54 points by adulau 6y ago

lwneal 6y ago
These tiny coin-cell-powered Bluetooth tags are great for tracking your lost dog or stolen backpack, but they can do lots of other things, too! They can measure temperature, acceleration, and magnetic fields, so you can use them to detect when a door or window opens, whether a machine is vibrating, or even an object's orientation relative to magnetic north. All this can be done for years on a single battery charge and at a cost of pennies per sensor per day. If these devices become 10% smaller each year, it's easy to imagine them eventually becoming something like Smartdust [1]. You could stick one on a treadmill or a weight machine to see how often it is used. Put one on your refrigerator door to find out how often you open the fridge. Put one on your office chair and track how many hours you spend sitting in your seat. Stick one inside a utility panel or a locked door and get an alert whenever it is opened or rattled. The possibilities are endless. However, there are two truly difficult problems to solve in the design of a bluetooth smart tag: security, and battery life. Sadly, they often conflict. For example, it turns out that Bluetooth radios consume battery power not just when transmitting, but also while receiving. If you treat the tag as a standard Bluetooth device and allow it to receive and transmit, you're solving the easy security problem. But if you want to build a really good tracker with maximal battery life, then you have to solve the hard problem: the tracker has to spend most of its time operating as a broadcast-only beacon. That means that every passing receiver can't send challenges or requests: the tracker can only yell its encrypted data out into the void. The system proposed in this paper is a great improvement on what companies like Tile and Nut are doing. But I predict that Bluetooth smart tags won't really take off until someone solves the "hard" problem. [1] https://en.wikipedia.org/wiki/Smartdust https://en.wikipedia.org/wiki/Smartdust
- cerberusss 6y ago
  From what I gather from friends, these Tile trackers actually hardly work. At least here in The Netherlands. The phone doesn't actually register the last spot where you left your device, it's often outdated. And the idea that other Tile users will help in tracking, also doesn't seem to work in practice.
  - janekm 6y ago
    It needs a large enough network of users. There are rumours that Apple will come out with similar beacons, and the Covid-tracking API means iOS will already be scanning in the background for users that enable that, so there may be some hope in the future. UWB for better estimation of direction and range to the beacon could also help: https://www.patentlyapple.com/patently-apple/2019/01/apple-invents-ibeacon-version-2-using-ultra-wide-band-radio-technology.html https://www.patentlyapple.com/patently-apple/2019/01/apple-i...
    - ghaff 6y ago
      The thing I've wondered about is a "digital leash" between an Apple Watch and a phone. One of the big problems is that you need something that's not too annoying under normal conditions but alerts you quickly if you left your phone on a bar.
- gruez 6y ago
  >They can measure temperature, acceleration, and magnetic fields There are cheap bluetooth tags that have a thermometer, accelerometer, and hall sensor built in? How much do they cost and where do I get them?
  - kayhi 6y ago
    I'm also interested on where to buy tags for pennies even if they only have Bluetooth.
    - oarsinsync 6y ago
      > All this can be done for years on a single battery charge and at a cost of pennies per sensor per day Assuming pennies and years both (as plural) == 2, you're looking at a minimum of $14 per sensor. $15-30 feels like the right ballpark, so OP is in the right area.
      - kayhi 6y ago
        from where or are there brands you recommend?
        oarsinsync 6y ago
        I'm mostly in the zigbee space, rather than bluetooth. Aquara / Xiaomi have a load of cheap sensors available on aliexpress. Get yourself your own zigbee dongle (suggestions at https://www.zigbee2mqtt.io https://www.zigbee2mqtt.io, no affiliation, also available from aliexpress) and you have no vendor lock-in either.
- javajosh 6y ago
  Love this comment. Not a hardware guy but it seems to me it would be really cool to "deconstruct" bluetooth to the point where you just have a d-to-a converter periodically pump a small mutable memory region onto a tiny antenna ("shout into the void"). That memory region is written to periodically by the sensors, which are themselves tiny MEMS units that only sense and write to memory when powered; you periodically send power to them. Encryption would happen either before write or just before transmission. To keep things really simple, you could hardcode a secret into each device, only accessible by the end-user by opening the device and looking, maybe with a microscope for extra security. Alternatively, you might set it up to repetatively broadcast the secret on first power up and then have a one-time switch that the user "crushes" to it into sensing mode. (and if you hit that switch without the secret, or lose the secret, you now have a brick). I'm not sure how compatible this would be with bluetooth protocol, which I know is enormous, and is highly stateful (pairing, etc). One can hope.

54 points by adulau 6y ago

These tiny coin-cell-powered Bluetooth tags are great for tracking your lost dog or stolen backpack, but they can do lots of other things, too! They can measure temperature, acceleration, and magnetic fields, so you can use them to detect when a door or window opens, whether a machine is vibrating, or even an object's orientation relative to magnetic north. All this can be done for years on a single battery charge and at a cost of pennies per sensor per day. If these devices become 10% smaller each year, it's easy to imagine them eventually becoming something like Smartdust [1]. You could stick one on a treadmill or a weight machine to see how often it is used. Put one on your refrigerator door to find out how often you open the fridge. Put one on your office chair and track how many hours you spend sitting in your seat. Stick one inside a utility panel or a locked door and get an alert whenever it is opened or rattled. The possibilities are endless. However, there are two truly difficult problems to solve in the design of a bluetooth smart tag: security, and battery life. Sadly, they often conflict. For example, it turns out that Bluetooth radios consume battery power not just when transmitting, but also while receiving. If you treat the tag as a standard Bluetooth device and allow it to receive and transmit, you're solving the easy security problem. But if you want to build a really good tracker with maximal battery life, then you have to solve the hard problem: the tracker has to spend most of its time operating as a broadcast-only beacon. That means that every passing receiver can't send challenges or requests: the tracker can only yell its encrypted data out into the void. The system proposed in this paper is a great improvement on what companies like Tile and Nut are doing. But I predict that Bluetooth smart tags won't really take off until someone solves the "hard" problem. [1] https://en.wikipedia.org/wiki/Smartdust https://en.wikipedia.org/wiki/Smartdust

cerberusss 6y ago
From what I gather from friends, these Tile trackers actually hardly work. At least here in The Netherlands. The phone doesn't actually register the last spot where you left your device, it's often outdated. And the idea that other Tile users will help in tracking, also doesn't seem to work in practice.
- janekm 6y ago
  It needs a large enough network of users. There are rumours that Apple will come out with similar beacons, and the Covid-tracking API means iOS will already be scanning in the background for users that enable that, so there may be some hope in the future. UWB for better estimation of direction and range to the beacon could also help: https://www.patentlyapple.com/patently-apple/2019/01/apple-invents-ibeacon-version-2-using-ultra-wide-band-radio-technology.html https://www.patentlyapple.com/patently-apple/2019/01/apple-i...
  - ghaff 6y ago
    The thing I've wondered about is a "digital leash" between an Apple Watch and a phone. One of the big problems is that you need something that's not too annoying under normal conditions but alerts you quickly if you left your phone on a bar.
gruez 6y ago
>They can measure temperature, acceleration, and magnetic fields There are cheap bluetooth tags that have a thermometer, accelerometer, and hall sensor built in? How much do they cost and where do I get them?
- kayhi 6y ago
  I'm also interested on where to buy tags for pennies even if they only have Bluetooth.
  - oarsinsync 6y ago
    > All this can be done for years on a single battery charge and at a cost of pennies per sensor per day Assuming pennies and years both (as plural) == 2, you're looking at a minimum of $14 per sensor. $15-30 feels like the right ballpark, so OP is in the right area.
    - kayhi 6y ago
      from where or are there brands you recommend?
      - oarsinsync 6y ago
        I'm mostly in the zigbee space, rather than bluetooth. Aquara / Xiaomi have a load of cheap sensors available on aliexpress. Get yourself your own zigbee dongle (suggestions at https://www.zigbee2mqtt.io https://www.zigbee2mqtt.io, no affiliation, also available from aliexpress) and you have no vendor lock-in either.
javajosh 6y ago
Love this comment. Not a hardware guy but it seems to me it would be really cool to "deconstruct" bluetooth to the point where you just have a d-to-a converter periodically pump a small mutable memory region onto a tiny antenna ("shout into the void"). That memory region is written to periodically by the sensors, which are themselves tiny MEMS units that only sense and write to memory when powered; you periodically send power to them. Encryption would happen either before write or just before transmission. To keep things really simple, you could hardcode a secret into each device, only accessible by the end-user by opening the device and looking, maybe with a microscope for extra security. Alternatively, you might set it up to repetatively broadcast the secret on first power up and then have a one-time switch that the user "crushes" to it into sensing mode. (and if you hit that switch without the secret, or lose the secret, you now have a brick). I'm not sure how compatible this would be with bluetooth protocol, which I know is enormous, and is highly stateful (pairing, etc). One can hope.