6 ms·

Defending against Bluetooth tracker abuse: it’s complicated

61 points by kccqzy 4y ago

kccqzy 4y ago
> Depending on the design of the tag, it might be possible to rewrite the firmware to violate the requirements in this document, for instance by rotating the MAC address frequently to evade detection (oddly: this document says "The accessory SHOULD have firmware that is updatable by the owner", which is the opposite of what you want here.) One part of me supports this Stallman-esque proposition as self-evident: of course the owner should have the ability to update the firmware. Another part of me is deeply concerned about the potential for misuse, including modifications that explicitly evade detections of stalking. Tracking another human and violating their privacy shouldn't have been so easy.
- namaria 4y ago
  People want cheap, ubiquitous networked radio emitting devices. There is a fundamental trade-off there...
- AshamedCaptain 4y ago
  There are two sides here that should not be confused. One on side we have "the network", i.e. the ability for these tags to be tracked through a myriad of iPhone owners that are not even aware that they are doing the tracking. On the other hand, we have the broadcasts emitted by the tag itself, which can announce the presence of the tag to a _nearby_ stalker. What actually makes these tags interesting, I think, is the network. While changing the firmware of the tags makes it (probably) easier to track nearby ones "locally" with specialized software, it will not change its interaction with the Apple network whatsoever -- it will not make it easier nor harder to stalk long-distance. And if you are only interested in "local area stalking", I presume there are much smaller, cheaper and even more conspicuously looking trackers than an Apple AirTag.
  - saurik 4y ago
    > What actually makes these tags interesting, I think, is the network. I mean, that mostly only makes them more interesting for the stalking use case, no? If you left your wallet at a restaurant, you don't need the network: you need your phone to notice it lost the connectivity to the wallet when you left the restaurant and you need the ability to find where in the restaurant it might be once you go back there to get it. I've been using Tile for years and have been extremely happy--hell: I end up using it every couple days to find something--despite never once having an interest in their "network".
  - zamnos 4y ago
    How sensitive is the phone's "I'm being tracked" algorithm? It doesn't go by tag owner but by Bluetooth Mac. If I I buy 4 tags, register them all to me, overwrite the firmware on one so it rotates between 4 IDs, once every 15 minutes, then the phone won't see the tag as following it. Hell, you could glue 4 of them to transistors, a power supply, and a circuit to turn them on and off in rotation without modding the firmware.
    - AshamedCaptain 4y ago
      Why wouldn't it see 4 tags as following it, then?
      - zamnos 4y ago
        It might! I don't know what's in Apple's closed source blob that implements the "am I being stalked" behavior and what parameters actually trigger it. Maybe you need to rotate between 60 tags, or 600.
        AshamedCaptain 4y ago
        In which case Apple could notice that 600 tags from the same guy tend to float around you...
    - theshrike79 4y ago
      Or you could just spend a few bucks more and get a GPS tracker that's 100% undetectable.
Hizonner 4y ago
The article misses one of the design goals that's pretty obvious if you look at the reverse-engineered Airtag protocol: they don't do any public key cryptography at all on the tag itself. And the reason for that is that it would wreck their battery life. Anything that relies on "attestation" violates that constraint. Of course, another possible approach would be to JUST NOT HAVE THE NETWORK...
- kayodelycaon 4y ago
  Without the network, you don't have much of a product.
  - saurik 4y ago
    The vast majority of the value of the Tiles I own isn't figuring out where my keys might have been moved by someone else since I lost them, it is noticing (and remembering) when (and where) I left them and then helping me zero in on them once I am back there, something that can be done entirely using just my phone. The remaining product once you support those two features--neither of which require a "network"--has only niche applications to edge cases involving losing things and stalking people (as well as adding a bunch of difficult-to-avoid third-party surveillance).
    - AceJohnny2 4y ago
      "I don't value the feature" != "the feature has low value"
      - saurik 4y ago
        I am responding to "Without the network, you don't have much of a product." and believe that my comment correctly and directly disproves that assertion.
- bsder 4y ago
  > And the reason for that is that it would wreck their battery life. Not really. ECC is fine for energy consumption and most BLE chips now have crypto accelerators.
pnw 4y ago
Interesting that the OP doesn’t consistently get the “stalker” warning. I see it consistently within 30-45 mins when I’m with a dog whose tag is registered to someone else and they leave my vicinity. It’s a shame Apple had to kill the theft use case to prevent stalking. I assume thieves are well aware of this now.
- D13Fd 4y ago
  I use AirTags to help keep track of my young kids at busy places, and the "safety" measures interfere with that as well (when thinking of a hypothetical abduction). Personally I think the stalking fear is overblown, and it's unfortunate that they interfere with other use cases to prevent that one.
  - bsder 4y ago
    > Personally I think the stalking fear is overblown I used to think that, but I know one woman who was stalked with an AirTag and I personally know too many women who were stalked even before these tags came along. The one thing I have learned in life: as a large male, I simply view the world through a completely different lens than a small woman does.
    - D13Fd 4y ago
      There are many things that we accept in the US that have both beneficial and harmful uses: guns, cars, knives, alcohol, Tylenol. Many of those kinds of things disproportionately impact one sex (or category) of people, but that their overall utility outweighs the risks and downsides. Our solution is to ban the abuses (murder, assault, stalking) but not the product itself. I don’t see why this one needs special treatment.
      - plugin-baby 4y ago
        > I don’t see why this one needs special treatment. All the other things you list have special treatment. (Apart from tylenol?)
  - 4y ago
1024core 4y ago
Tangential: is it possible to just get a list of all BLE devices in my local area (for any definition of "local") for cheap?
- wongarsu 4y ago
  "Bluetooth wardriving" has promising google results, e.g. [1] [2] [3]. That would involve either driving around with such a setup, or planting a couple of them, depending on your coverage and update requirements. 1: http://mateslab.weebly.com/bluedriving.html http://mateslab.weebly.com/bluedriving.html 2: https://interruptlabs.ca/2021/10/15/Bluetooth-WarDriving-with-the-nRF52/ https://interruptlabs.ca/2021/10/15/Bluetooth-WarDriving-wit... 3: https://hackaday.com/2011/04/15/long-range-bluetooth-wardriving-rig/ https://hackaday.com/2011/04/15/long-range-bluetooth-wardriv...
exabrial 4y ago
Oh for the love of... can we please address the giant pink elephant blowing fire rings doing a hula dance on a tricycle in the room? "Stalking" was possible 15+ years ago with $5 worth of sketchy hardware off Ebay or Aliexpress. AirTags didn't all of the sudden invent a new problem. What worse is every crypto dork at these companies is pretending like the main use case _isn't_ recovering your stolen stuff. Lets be real: "finding your lost stuff" is a secondary use case. "Theft Recovery" is the primary use case. The protocols need to somehow cover theft, as theft is a much much bigger problem than stalking.
- iudqnolq 4y ago
  > What worse is every crypto dork at these companies is pretending like the main use case _isn't_ recovering your stolen stuff. Lets be real: "finding your lost stuff" is a secondary use case. "Theft Recovery" is the primary use case. I regularly used Tiles to find lost stuff. Then I got better at not losing things and stopped. I've never considered using them for theft recovery. Sounds illegal. Are you just showing up at random people's apartments and threatening them or something?
  - mock-possum 4y ago
    Someone stole my car last year - luckily, I had an AirTag stashed in a side compartment. I tracked it down to the other side of the city and stole it back from the parking lot of the shopping center while the thieves were busy shopping. Or shoplifting, more likely, given their treatment of my car. It’s not illegal to take something that’s yours back from someone who’s stolen it.
    - iudqnolq 4y ago
      Whether it's illegal or not depends on the specifics. for ex if you'd gone into their driveway to take it back that could be trespassing. regardless that sounds dangerous. I guess if my car was worth a lot more I might take that kind of risk.
      - 4y ago
ysleepy 4y ago
The poor cat. Imagine having a shrill beeping thing on their collar for days. Edit: this makes me unreasonably upset.

61 points by kccqzy 4y ago

> Depending on the design of the tag, it might be possible to rewrite the firmware to violate the requirements in this document, for instance by rotating the MAC address frequently to evade detection (oddly: this document says "The accessory SHOULD have firmware that is updatable by the owner", which is the opposite of what you want here.) One part of me supports this Stallman-esque proposition as self-evident: of course the owner should have the ability to update the firmware. Another part of me is deeply concerned about the potential for misuse, including modifications that explicitly evade detections of stalking. Tracking another human and violating their privacy shouldn't have been so easy.

namaria 4y ago
People want cheap, ubiquitous networked radio emitting devices. There is a fundamental trade-off there...
AshamedCaptain 4y ago
There are two sides here that should not be confused. One on side we have "the network", i.e. the ability for these tags to be tracked through a myriad of iPhone owners that are not even aware that they are doing the tracking. On the other hand, we have the broadcasts emitted by the tag itself, which can announce the presence of the tag to a _nearby_ stalker. What actually makes these tags interesting, I think, is the network. While changing the firmware of the tags makes it (probably) easier to track nearby ones "locally" with specialized software, it will not change its interaction with the Apple network whatsoever -- it will not make it easier nor harder to stalk long-distance. And if you are only interested in "local area stalking", I presume there are much smaller, cheaper and even more conspicuously looking trackers than an Apple AirTag.
- saurik 4y ago
  > What actually makes these tags interesting, I think, is the network. I mean, that mostly only makes them more interesting for the stalking use case, no? If you left your wallet at a restaurant, you don't need the network: you need your phone to notice it lost the connectivity to the wallet when you left the restaurant and you need the ability to find where in the restaurant it might be once you go back there to get it. I've been using Tile for years and have been extremely happy--hell: I end up using it every couple days to find something--despite never once having an interest in their "network".
- zamnos 4y ago
  How sensitive is the phone's "I'm being tracked" algorithm? It doesn't go by tag owner but by Bluetooth Mac. If I I buy 4 tags, register them all to me, overwrite the firmware on one so it rotates between 4 IDs, once every 15 minutes, then the phone won't see the tag as following it. Hell, you could glue 4 of them to transistors, a power supply, and a circuit to turn them on and off in rotation without modding the firmware.
  - AshamedCaptain 4y ago
    Why wouldn't it see 4 tags as following it, then?
    - zamnos 4y ago
      It might! I don't know what's in Apple's closed source blob that implements the "am I being stalked" behavior and what parameters actually trigger it. Maybe you need to rotate between 60 tags, or 600.
      - AshamedCaptain 4y ago
        In which case Apple could notice that 600 tags from the same guy tend to float around you...
  - theshrike79 4y ago
    Or you could just spend a few bucks more and get a GPS tracker that's 100% undetectable.

Hizonner 4y ago

The article misses one of the design goals that's pretty obvious if you look at the reverse-engineered Airtag protocol: they don't do any public key cryptography at all on the tag itself. And the reason for that is that it would wreck their battery life. Anything that relies on "attestation" violates that constraint. Of course, another possible approach would be to JUST NOT HAVE THE NETWORK...

kayodelycaon 4y ago
Without the network, you don't have much of a product.
- saurik 4y ago
  The vast majority of the value of the Tiles I own isn't figuring out where my keys might have been moved by someone else since I lost them, it is noticing (and remembering) when (and where) I left them and then helping me zero in on them once I am back there, something that can be done entirely using just my phone. The remaining product once you support those two features--neither of which require a "network"--has only niche applications to edge cases involving losing things and stalking people (as well as adding a bunch of difficult-to-avoid third-party surveillance).
  - AceJohnny2 4y ago
    "I don't value the feature" != "the feature has low value"
    - saurik 4y ago
      I am responding to "Without the network, you don't have much of a product." and believe that my comment correctly and directly disproves that assertion.
bsder 4y ago
> And the reason for that is that it would wreck their battery life. Not really. ECC is fine for energy consumption and most BLE chips now have crypto accelerators.

pnw 4y ago

Interesting that the OP doesn’t consistently get the “stalker” warning. I see it consistently within 30-45 mins when I’m with a dog whose tag is registered to someone else and they leave my vicinity. It’s a shame Apple had to kill the theft use case to prevent stalking. I assume thieves are well aware of this now.

D13Fd 4y ago
I use AirTags to help keep track of my young kids at busy places, and the "safety" measures interfere with that as well (when thinking of a hypothetical abduction). Personally I think the stalking fear is overblown, and it's unfortunate that they interfere with other use cases to prevent that one.
- bsder 4y ago
  > Personally I think the stalking fear is overblown I used to think that, but I know one woman who was stalked with an AirTag and I personally know too many women who were stalked even before these tags came along. The one thing I have learned in life: as a large male, I simply view the world through a completely different lens than a small woman does.
  - D13Fd 4y ago
    There are many things that we accept in the US that have both beneficial and harmful uses: guns, cars, knives, alcohol, Tylenol. Many of those kinds of things disproportionately impact one sex (or category) of people, but that their overall utility outweighs the risks and downsides. Our solution is to ban the abuses (murder, assault, stalking) but not the product itself. I don’t see why this one needs special treatment.
    - plugin-baby 4y ago
      > I don’t see why this one needs special treatment. All the other things you list have special treatment. (Apart from tylenol?)
- 4y ago

1024core 4y ago

Tangential: is it possible to just get a list of all BLE devices in my local area (for any definition of "local") for cheap?

wongarsu 4y ago
"Bluetooth wardriving" has promising google results, e.g. [1] [2] [3]. That would involve either driving around with such a setup, or planting a couple of them, depending on your coverage and update requirements. 1: http://mateslab.weebly.com/bluedriving.html http://mateslab.weebly.com/bluedriving.html 2: https://interruptlabs.ca/2021/10/15/Bluetooth-WarDriving-with-the-nRF52/ https://interruptlabs.ca/2021/10/15/Bluetooth-WarDriving-wit... 3: https://hackaday.com/2011/04/15/long-range-bluetooth-wardriving-rig/ https://hackaday.com/2011/04/15/long-range-bluetooth-wardriv...

exabrial 4y ago

Oh for the love of... can we please address the giant pink elephant blowing fire rings doing a hula dance on a tricycle in the room? "Stalking" was possible 15+ years ago with $5 worth of sketchy hardware off Ebay or Aliexpress. AirTags didn't all of the sudden invent a new problem. What worse is every crypto dork at these companies is pretending like the main use case _isn't_ recovering your stolen stuff. Lets be real: "finding your lost stuff" is a secondary use case. "Theft Recovery" is the primary use case. The protocols need to somehow cover theft, as theft is a much much bigger problem than stalking.

iudqnolq 4y ago
> What worse is every crypto dork at these companies is pretending like the main use case _isn't_ recovering your stolen stuff. Lets be real: "finding your lost stuff" is a secondary use case. "Theft Recovery" is the primary use case. I regularly used Tiles to find lost stuff. Then I got better at not losing things and stopped. I've never considered using them for theft recovery. Sounds illegal. Are you just showing up at random people's apartments and threatening them or something?
- mock-possum 4y ago
  Someone stole my car last year - luckily, I had an AirTag stashed in a side compartment. I tracked it down to the other side of the city and stole it back from the parking lot of the shopping center while the thieves were busy shopping. Or shoplifting, more likely, given their treatment of my car. It’s not illegal to take something that’s yours back from someone who’s stolen it.
  - iudqnolq 4y ago
    Whether it's illegal or not depends on the specifics. for ex if you'd gone into their driveway to take it back that could be trespassing. regardless that sounds dangerous. I guess if my car was worth a lot more I might take that kind of risk.
    - 4y ago

ysleepy 4y ago

The poor cat. Imagine having a shrill beeping thing on their collar for days. Edit: this makes me unreasonably upset.