3 ms·

The AirTag is based on an nRF52 Bluetooth microcontroller which should have protection against firmware extraction. Last year an exploit was found to bypass thi

The AirTag is based on an nRF52 Bluetooth microcontroller which should have protection against firmware extraction. Last year an exploit was found to bypass this using a glitch in the power supply at the right time in the boot up process. Now hackers have applied this process to get the firmware from the AirTag. The microcontroller doesn't have a secure boot process so you can use JTAG to flash it with new firmware. As for stalking, it was only ever going to be a matter of time before devices were small enough and power efficient enough to be tracked for prolonged periods of time. I think there is probably a market for an Android app which can detect if any Bluetooth devices appear to be following you.

gruez 5y ago
>I think there is probably a market for an Android app which can detect if any Bluetooth devices appear to be following you. how do you handle mac address changes?
- barbegal 5y ago
  It turns out that it is easy to detect that since the signal strength remains about the same, the new MAC appears just after the old one disappears and the contents of the Bluetooth advertisement remain broadly the same. However you do have to be continually scanning for this to work.
  - infofarmer 5y ago
    Should be trivial to thwart all three with slight changes in firmware.
lozaning 5y ago
You didn't need to do any firmware fuckery to stalk people. If you wanted to stalk someone with an iphone, just 'give' them a Samsung Galaxy tag, if you want to stalk someone with a Samsung phone, 'give' them an airtag. Neither company bothered to make the anti stalking functionality of their products cross platform.
- LorenPechtel 5y ago
  I think that's why the airtags make noise after being separated from their base for too long. The problem is that you can't make a viable system to distinguish stalking from legitimate behavior. I have Tile trackers on various objects that I can't imagine ever taking all of them with me--inevitably that means some will be away from the system for the duration of such a trip. If one starts beeping in an empty house that simply means a dead battery, but what if someone else lived here? On the flip side, you're going to end up "stalked" by the devices of anyone you take a long enough trip with. Anti-stalking is theater.

gruez 5y ago

>I think there is probably a market for an Android app which can detect if any Bluetooth devices appear to be following you. how do you handle mac address changes?

barbegal 5y ago
It turns out that it is easy to detect that since the signal strength remains about the same, the new MAC appears just after the old one disappears and the contents of the Bluetooth advertisement remain broadly the same. However you do have to be continually scanning for this to work.
- infofarmer 5y ago
  Should be trivial to thwart all three with slight changes in firmware.

lozaning 5y ago

You didn't need to do any firmware fuckery to stalk people. If you wanted to stalk someone with an iphone, just 'give' them a Samsung Galaxy tag, if you want to stalk someone with a Samsung phone, 'give' them an airtag. Neither company bothered to make the anti stalking functionality of their products cross platform.

LorenPechtel 5y ago
I think that's why the airtags make noise after being separated from their base for too long. The problem is that you can't make a viable system to distinguish stalking from legitimate behavior. I have Tile trackers on various objects that I can't imagine ever taking all of them with me--inevitably that means some will be away from the system for the duration of such a trip. If one starts beeping in an empty house that simply means a dead battery, but what if someone else lived here? On the flip side, you're going to end up "stalked" by the devices of anyone you take a long enough trip with. Anti-stalking is theater.