6 ms·

Firmware update hides a device’s Bluetooth fingerprint

151 points by transpute 2y ago

IshKebab 2y ago
This is a very confusing article. Surely it's the beacons that transmit beacons, not phones? And what is the signature based on? What is the fix? Terrible reporting. In any case I doubt this has much practical impact given you presumably need an SDR to do this tracking.
- 0xDEADFED5 2y ago
  it all makes sense if you read the paper linked at the top of the article.
- arlort 2y ago
  I think they might be referring to ble advertisement packets
  - jbgreer 2y ago
    I’m with you: I read the link and think they are referring to BLE advertisements. The frequency of such advertisements is configurable. AIR, the advertisement interval has to be a multiple of 0.625msec. Per the spec, a random delay of 0-10msec is added in between the interval to aid in collision prevention. I’ve mainly seen “BLE beacon” used to refer to types of devices, especially ones that primarily advertise. There are some devices, like BLE-based remote controls, that advertise very frequently, I assume to reduce latency between a user’s action and response by the receiving device. It makes for a very noisy environment if you’re playing at home and not filtering based on MAC, etc.
- Reventlov 2y ago
  Phones can also transmit beacons. The same as laptops, actually, some of them constantly broadcast BLE beacons. The signature is based on physical layer characteristics, according to the linked paper : « They result in two measurable metrics in BLE and WiFi transmissions: Carrier Frequency Offset (CFO) and I/Q imperfections, specifically: I/Q offset and I/Q imbalance. ». Yes, you would probably need SDR to do this tracking, but SDR are generally not this expensive.
- codetrotter 2y ago
  From the article: > Mobile devices, including phones, smartwatches and fitness trackers, constantly transmit signals, known as Bluetooth beacons, at the rate of roughly 500 beacons per minute. These beacons enable features like Apple’s “Find My”--a tracking service to find a lost device as well as COVID-19 tracing apps; and connect smartphones to other devices such as wireless earphones. > The current approach taken by smartphone companies to make the devices hard to track by their Bluetooth signals is to randomly change the phone’s identity, its MAC address. However, that doesn’t address the physical-layer fingerprints inherent in each device’s transmissions due to unique hardware imperfections. > All wireless devices have small manufacturing imperfections in the hardware used to emit these beacons that are unique to each device. These fingerprints are an accidental byproduct of the manufacturing process. These imperfections in Bluetooth hardware result in unique distortions, which can be used as a fingerprint to track a specific device.
  - IshKebab 2y ago
    Yes I read the article. This doesn't answer the questions in my comment.
    - Brian_K_White 2y ago
      What is missing? For example, your first question exposed that you had a misconception of what "beacon" means, and the first sentence of these excerpts is exactly an utter layperson definition of what "beacon" actually means. I don't know how you can say "I read the article" and then read these bits yet a 2nd time, and still claim to have those questions.
- surajrmal 2y ago
  It's a press release, not a white paper. Phones do transmit beacons.
- JohnFen 2y ago
  > given you presumably need an SDR to do this tracking. SDRs and the software to make good use of them are cheap and readily available. Using them is well within the ability of almost everybody. All you need is the desire.
schobi 2y ago
The article is indeed hard to understand on its own. From the linked 2022 paper: BLE sends beacons hundred times per minute, even from phones. For privacy reasons the Mac addresses are randomized. The attacker can further analyze the beacons for imperfections in the rf signal and get a fingerprint for devices from frequency offsets/drift/iq imbalance. Haven't seen the new paper, but the article suggests the a firmware change can even reduce this attack vector. I guess that introducing further randomization in chipset parameters for each beacon can make this kind of tracking harder still. I doubt that this hides all aspects of fingerprinting and settings stepsizes would still be observable, just harder to track. "Randomization pattern F is this manufacturer gen 2025 devices" My take on this: most of the day, I would not need any beacons at all - maybe there is an intelligent limit on avoiding them? Configurable? Only when unlocked? Only when in motion? Sometimes sending half the beacons would double the time needed for tracking already. Again, this would boil down to "a firmware update could improve privacy"
- dylan604 2y ago
  > BLE sends beacons hundred times per minute > Sometimes sending half the beacons would double the time needed Great, so still within one second. Not seeing how that's doing anything detrimental to the trackers. Even when walking through a store, 50 tracks per second is really accurate. The best thing you could do to improve privacy from blue tooth trackers is to disable blue tooth
  - throwaway562if1 2y ago
    Only within one second if fingerprinting can be done from a single data point. If it takes 10,000 beacons to identify a device with reasonable certainty, doubling that count is significant.
- JohnFen 2y ago
  > most of the day, I would not need any beacons at all - maybe there is an intelligent limit on avoiding them? My approach is to leave bluetooth (and every other radio, but that's neither here nor there) turned off when I'm not actively using it.
barbegal 2y ago
I think they have linked to the wrong paper. This paper https://cseweb.ucsd.edu/~schulman/docs/oakland24-phyobfuscation.pdf https://cseweb.ucsd.edu/~schulman/docs/oakland24-phyobfuscat... more closely matches the article and it explains that the obfuscation is possible due to the TI CC2640 having a variable frequency synthesiser which has 16 bits of resolution. It's a clever technique but I'm not sure it is easily implemented on other chipsets. And this is only valid against one fingerprinting methodology: carrier frequency offset (CFO), there are other fingerprinting techniques which are more difficult to defend against.
- RachelF 2y ago
  Thank you for that link. There are many flaws in the paper's approach. There is much literature on this already, it has been investigated for decades. Much of the fingerprinting used comes from non-linearities in the RF power amplifiers, not the frequency.
  - transpute 2y ago
    Could you recommend a good paper on the topic?
    - RachelF 2y ago
      Google "umop ew" for a list. UMOP stands for unintentional modulation on pulse. This will start you off with the foundation papers in the field.
  - RF_Savage 2y ago
    Most Bluetooth being GFSK means the TX chain is completely non-linear to begin with, so the frequency error is an easier target for fingerprinting. That said, most also have ramp-up and ramp-down slopes on the transmission start and end to control and shape the spectral emissions. So there might also be something to that. Still a harder thing to fingerprint than frequency errors relating to transmit center frequency and baudrate.
ChrisMarshallNY 2y ago
Apple has been obfuscating the bluetooth MAC for a while.
- transpute 2y ago
  From the article: > The current approach taken by smartphone companies to make the devices hard to track by their Bluetooth signals is to randomly change the phone’s identity, its MAC address. However, that doesn’t address the physical-layer fingerprints inherent in each device’s transmissions.. All wireless devices have small manufacturing imperfections in the hardware used to emit these beacons.. These imperfections in Bluetooth hardware result in unique distortions, which can be used as a fingerprint to track a specific device.
  - ChrisMarshallNY 2y ago
    Fair 'nuff. I didn't read the article. Fair cop, Guv.
    - ChrisMarshallNY 2y ago
      Hey, I admitted it. I see a number of others that didn't. Looks like a number of folks didn't read it, and there's a number of others that are taking great glee in pointing it out. There's utility in promptly admitting when we're wrong.
      - swores 2y ago
        Maybe people downvoted you for choosing to attempt humour in your mea culpa while not bothering to either thank the person who took time to answer you nor apologise for wasting their time. Though I'm not a mind reader, maybe that's not why they felt downvotes were warranted and only I had that thought.
        ChrisMarshallNY 2y ago
        Nah. I sincerely want to contribute, and deserved the downvotes. I could have deleted it, but didn't, because I think folks around here could probably use some object lessons, on what admitting error looks like. I didn't waste anyone's time. They were more than happy to ding me. In fact, there's few things that geeks like doing, more than telling other geeks, they are wrong, so I maybe did a public service. I'll do humor, and, if people want to get butthurt, they'll bang on the down button, just like they always have.
jtrueb 2y ago
> “This defense can be rolled out incrementally, requiring only software modification on at least one widely-used Bluetooth Low Energy chipset,” said Hadi Givehchian, the paper’s first author and a Ph.D. student in the UC San Diego Department of Computer Science and Engineering. “But in order to deploy this defense widely, we need to partner with Bluetooth chip manufacturers.” Essentially, this is useless. It doesn’t apply to most chipsets and would require changing the firmware on existing beacon hardware. The chip manufacturers would have put this in the hardware if they wanted it.
- transpute 2y ago
  > The chip manufacturers would have put this in the hardware if they wanted it. High-volume device customers of chip manufacturers can make it a requirement, e.g. if their marketing and business model support privacy.
  - rasz 2y ago
    You have to realize even juggernauts like Apple are unable to influence other juggernauts like Broadcom. 4 years ago https://news.ycombinator.com/item?id=22907591 https://news.ycombinator.com/item?id=22907591 : >Broadcom bluetooth/wifi chips ran out of firmware hot patch ram slots long time ago. Company seems to be too cheap to respin the rom mask with all the fixes baked in. From what I remember even brand new iphone x ships with no room for BT firmware patching. >RECON 2019 - Reversing and Exploiting Broadcom Bluetooth (Jiska, Dennis Mantz) https://www.youtube.com/watch?v=96Mi8_9ABCc https://www.youtube.com/watch?v=96Mi8_9ABCc >35C3 - Dissecting Broadcom Bluetooth (jiska mantz) https://www.youtube.com/watch?v=4_nI9ok7iQg https://www.youtube.com/watch?v=4_nI9ok7iQg
transpute 2y ago
Wi-Fi radios can be similarly identified, "Wi-Fi device identification based on multi-domain physical layer fingerprint" (2023), https://www.sciencedirect.com/science/article/abs/pii/S0140366423001032 https://www.sciencedirect.com/science/article/abs/pii/S01403... > A possible solution for authenticating IoT devices with limited computing resources when accessing wireless networks is to extract a unique and unclonable identifier of the device.. The effectiveness of the physical layer fingerprint lies in the subtle random differences that occur during the manufacturing process of the device.. The accuracy of Wi-Fi device identification based on physical layer fingerprint features.. can reach 98% for 15 different types of IoT Wi-Fi devices, and 90.76% for 10 network cards, having smaller differences in manufacturing, with the same type of chips. Of course, if Auto-Join is enabled, the client device broadcasts the Wi-Fi access points it has previously joined, which can be informative without an SDR.
motohagiography 2y ago
it appears from the article this method of detection is viable until chipset mfgs adopt the randomization technique.

151 points by transpute 2y ago

This is a very confusing article. Surely it's the beacons that transmit beacons, not phones? And what is the signature based on? What is the fix? Terrible reporting. In any case I doubt this has much practical impact given you presumably need an SDR to do this tracking.

0xDEADFED5 2y ago
it all makes sense if you read the paper linked at the top of the article.
arlort 2y ago
I think they might be referring to ble advertisement packets
- jbgreer 2y ago
  I’m with you: I read the link and think they are referring to BLE advertisements. The frequency of such advertisements is configurable. AIR, the advertisement interval has to be a multiple of 0.625msec. Per the spec, a random delay of 0-10msec is added in between the interval to aid in collision prevention. I’ve mainly seen “BLE beacon” used to refer to types of devices, especially ones that primarily advertise. There are some devices, like BLE-based remote controls, that advertise very frequently, I assume to reduce latency between a user’s action and response by the receiving device. It makes for a very noisy environment if you’re playing at home and not filtering based on MAC, etc.
Reventlov 2y ago
Phones can also transmit beacons. The same as laptops, actually, some of them constantly broadcast BLE beacons. The signature is based on physical layer characteristics, according to the linked paper : « They result in two measurable metrics in BLE and WiFi transmissions: Carrier Frequency Offset (CFO) and I/Q imperfections, specifically: I/Q offset and I/Q imbalance. ». Yes, you would probably need SDR to do this tracking, but SDR are generally not this expensive.
codetrotter 2y ago
From the article: > Mobile devices, including phones, smartwatches and fitness trackers, constantly transmit signals, known as Bluetooth beacons, at the rate of roughly 500 beacons per minute. These beacons enable features like Apple’s “Find My”--a tracking service to find a lost device as well as COVID-19 tracing apps; and connect smartphones to other devices such as wireless earphones. > The current approach taken by smartphone companies to make the devices hard to track by their Bluetooth signals is to randomly change the phone’s identity, its MAC address. However, that doesn’t address the physical-layer fingerprints inherent in each device’s transmissions due to unique hardware imperfections. > All wireless devices have small manufacturing imperfections in the hardware used to emit these beacons that are unique to each device. These fingerprints are an accidental byproduct of the manufacturing process. These imperfections in Bluetooth hardware result in unique distortions, which can be used as a fingerprint to track a specific device.
- IshKebab 2y ago
  Yes I read the article. This doesn't answer the questions in my comment.
  - Brian_K_White 2y ago
    What is missing? For example, your first question exposed that you had a misconception of what "beacon" means, and the first sentence of these excerpts is exactly an utter layperson definition of what "beacon" actually means. I don't know how you can say "I read the article" and then read these bits yet a 2nd time, and still claim to have those questions.
surajrmal 2y ago
It's a press release, not a white paper. Phones do transmit beacons.
JohnFen 2y ago
> given you presumably need an SDR to do this tracking. SDRs and the software to make good use of them are cheap and readily available. Using them is well within the ability of almost everybody. All you need is the desire.

schobi 2y ago

The article is indeed hard to understand on its own. From the linked 2022 paper: BLE sends beacons hundred times per minute, even from phones. For privacy reasons the Mac addresses are randomized. The attacker can further analyze the beacons for imperfections in the rf signal and get a fingerprint for devices from frequency offsets/drift/iq imbalance. Haven't seen the new paper, but the article suggests the a firmware change can even reduce this attack vector. I guess that introducing further randomization in chipset parameters for each beacon can make this kind of tracking harder still. I doubt that this hides all aspects of fingerprinting and settings stepsizes would still be observable, just harder to track. "Randomization pattern F is this manufacturer gen 2025 devices" My take on this: most of the day, I would not need any beacons at all - maybe there is an intelligent limit on avoiding them? Configurable? Only when unlocked? Only when in motion? Sometimes sending half the beacons would double the time needed for tracking already. Again, this would boil down to "a firmware update could improve privacy"

dylan604 2y ago
> BLE sends beacons hundred times per minute > Sometimes sending half the beacons would double the time needed Great, so still within one second. Not seeing how that's doing anything detrimental to the trackers. Even when walking through a store, 50 tracks per second is really accurate. The best thing you could do to improve privacy from blue tooth trackers is to disable blue tooth
- throwaway562if1 2y ago
  Only within one second if fingerprinting can be done from a single data point. If it takes 10,000 beacons to identify a device with reasonable certainty, doubling that count is significant.
JohnFen 2y ago
> most of the day, I would not need any beacons at all - maybe there is an intelligent limit on avoiding them? My approach is to leave bluetooth (and every other radio, but that's neither here nor there) turned off when I'm not actively using it.

barbegal 2y ago

I think they have linked to the wrong paper. This paper https://cseweb.ucsd.edu/~schulman/docs/oakland24-phyobfuscation.pdf https://cseweb.ucsd.edu/~schulman/docs/oakland24-phyobfuscat... more closely matches the article and it explains that the obfuscation is possible due to the TI CC2640 having a variable frequency synthesiser which has 16 bits of resolution. It's a clever technique but I'm not sure it is easily implemented on other chipsets. And this is only valid against one fingerprinting methodology: carrier frequency offset (CFO), there are other fingerprinting techniques which are more difficult to defend against.

RachelF 2y ago
Thank you for that link. There are many flaws in the paper's approach. There is much literature on this already, it has been investigated for decades. Much of the fingerprinting used comes from non-linearities in the RF power amplifiers, not the frequency.
- transpute 2y ago
  Could you recommend a good paper on the topic?
  - RachelF 2y ago
    Google "umop ew" for a list. UMOP stands for unintentional modulation on pulse. This will start you off with the foundation papers in the field.
- RF_Savage 2y ago
  Most Bluetooth being GFSK means the TX chain is completely non-linear to begin with, so the frequency error is an easier target for fingerprinting. That said, most also have ramp-up and ramp-down slopes on the transmission start and end to control and shape the spectral emissions. So there might also be something to that. Still a harder thing to fingerprint than frequency errors relating to transmit center frequency and baudrate.

ChrisMarshallNY 2y ago

Apple has been obfuscating the bluetooth MAC for a while.

transpute 2y ago
From the article: > The current approach taken by smartphone companies to make the devices hard to track by their Bluetooth signals is to randomly change the phone’s identity, its MAC address. However, that doesn’t address the physical-layer fingerprints inherent in each device’s transmissions.. All wireless devices have small manufacturing imperfections in the hardware used to emit these beacons.. These imperfections in Bluetooth hardware result in unique distortions, which can be used as a fingerprint to track a specific device.
- ChrisMarshallNY 2y ago
  Fair 'nuff. I didn't read the article. Fair cop, Guv.
  - ChrisMarshallNY 2y ago
    Hey, I admitted it. I see a number of others that didn't. Looks like a number of folks didn't read it, and there's a number of others that are taking great glee in pointing it out. There's utility in promptly admitting when we're wrong.
    - swores 2y ago
      Maybe people downvoted you for choosing to attempt humour in your mea culpa while not bothering to either thank the person who took time to answer you nor apologise for wasting their time. Though I'm not a mind reader, maybe that's not why they felt downvotes were warranted and only I had that thought.
      - ChrisMarshallNY 2y ago
        Nah. I sincerely want to contribute, and deserved the downvotes. I could have deleted it, but didn't, because I think folks around here could probably use some object lessons, on what admitting error looks like. I didn't waste anyone's time. They were more than happy to ding me. In fact, there's few things that geeks like doing, more than telling other geeks, they are wrong, so I maybe did a public service. I'll do humor, and, if people want to get butthurt, they'll bang on the down button, just like they always have.

jtrueb 2y ago

> “This defense can be rolled out incrementally, requiring only software modification on at least one widely-used Bluetooth Low Energy chipset,” said Hadi Givehchian, the paper’s first author and a Ph.D. student in the UC San Diego Department of Computer Science and Engineering. “But in order to deploy this defense widely, we need to partner with Bluetooth chip manufacturers.” Essentially, this is useless. It doesn’t apply to most chipsets and would require changing the firmware on existing beacon hardware. The chip manufacturers would have put this in the hardware if they wanted it.

transpute 2y ago
> The chip manufacturers would have put this in the hardware if they wanted it. High-volume device customers of chip manufacturers can make it a requirement, e.g. if their marketing and business model support privacy.
- rasz 2y ago
  You have to realize even juggernauts like Apple are unable to influence other juggernauts like Broadcom. 4 years ago https://news.ycombinator.com/item?id=22907591 https://news.ycombinator.com/item?id=22907591 : >Broadcom bluetooth/wifi chips ran out of firmware hot patch ram slots long time ago. Company seems to be too cheap to respin the rom mask with all the fixes baked in. From what I remember even brand new iphone x ships with no room for BT firmware patching. >RECON 2019 - Reversing and Exploiting Broadcom Bluetooth (Jiska, Dennis Mantz) https://www.youtube.com/watch?v=96Mi8_9ABCc https://www.youtube.com/watch?v=96Mi8_9ABCc >35C3 - Dissecting Broadcom Bluetooth (jiska mantz) https://www.youtube.com/watch?v=4_nI9ok7iQg https://www.youtube.com/watch?v=4_nI9ok7iQg

transpute 2y ago

Wi-Fi radios can be similarly identified, "Wi-Fi device identification based on multi-domain physical layer fingerprint" (2023), https://www.sciencedirect.com/science/article/abs/pii/S0140366423001032 https://www.sciencedirect.com/science/article/abs/pii/S01403... > A possible solution for authenticating IoT devices with limited computing resources when accessing wireless networks is to extract a unique and unclonable identifier of the device.. The effectiveness of the physical layer fingerprint lies in the subtle random differences that occur during the manufacturing process of the device.. The accuracy of Wi-Fi device identification based on physical layer fingerprint features.. can reach 98% for 15 different types of IoT Wi-Fi devices, and 90.76% for 10 network cards, having smaller differences in manufacturing, with the same type of chips. Of course, if Auto-Join is enabled, the client device broadcasts the Wi-Fi access points it has previously joined, which can be informative without an SDR.

motohagiography 2y ago

it appears from the article this method of detection is viable until chipset mfgs adopt the randomization technique.