3 ms·

Bluetooth already broadcasts and has a UID, I have used this a few times in books as plot-outline to identify an antagonist, and I now wonder if NFC has a simil

by boznz 2y ago

Bluetooth already broadcasts and has a UID, I have used this a few times in books as plot-outline to identify an antagonist, and I now wonder if NFC has a similar UID It would be interesting to decode the data and see.

jsheard 2y ago
Don't they randomize their broadcast ID? I know both Android and iOS scramble the WiFi MAC address by default, it would be odd if they didn't take the same precaution with Bluetooth.
- boznz 2y ago
  Sci-Fi books and it was a sentient AI, I can do anything I want in that situation :-)
- csdvrx 2y ago
  The randomization doesn't matter: you can very easily link the addresses if you have a few datapoints, even if it's just the time you observed the addresses: the basic method is discussed in https://inria.hal.science/hal-03045555/document https://inria.hal.science/hal-03045555/document See https://inria.hal.science/hal-02394629v1 https://inria.hal.science/hal-02394629v1 for the theoretical bases then hop to https://samteplov.com/uploads/shmoocon20/slides.pdf https://samteplov.com/uploads/shmoocon20/slides.pdf for an example applying to Apple devices Those who said the randomization and other techniques were sufficient were wrong: https://petsymposium.org/popets/2020/popets-2020-0003.pdf https://petsymposium.org/popets/2020/popets-2020-0003.pdf will show you how they changed their mind :) It's not just apple: google nearby has also been reversed: https://publications.cispa.saarland/2748/ https://publications.cispa.saarland/2748/ and https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_06B-3_Antonioli_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... talks about attacks, but there's no need for that: just find identifiers that let you link the addresses Even if you don't have any identifiers, the Bluetooth address randomization happens only about every 15 minutes: the manufacturer specific data in the public advertisement (or even the frequency and the length of these advertisements) during these 15 minutes periods can be used for linking the randomized addresses
  - lxgr 2y ago
    That attack requires continuously monitoring a given device or area though, right? In other words, you could possibly track a given device through an area with enough sensors, e.g. a store, but not across visits.
    - csdvrx 2y ago
      > That attack requires continuously monitoring a given device or area though, right? The "randomization" seems to be a pseudo-randomization: with the seed and the timestamp, you should be able to deduce the future "randomized" addresses.
      - lxgr 2y ago
        Not with a cryptographically secure pseudorandom number generator, and constructing one doesn't seem hard to do, given that LE devices will need to support AES anyway.
- AStonesThrow 2y ago
  Google has lately been far overstepping their utility with “security measures” which I definitely don’t need and often make everything more annoying and difficult. Ex: blocking 3rd party cookies always now. Breaks countless websites which I need to work reliably. “Manage unused website/app’s permissions” even after I specifically granted them! Randomized virtual credit card numbers in Wallet: for no good reason, you thoroughly fucked up a refund attempt for me, >$500! And randomized MAC addresses by default for EVERY. SINGLE. SSID. It’s unhinged. It’s fake protection. As a matter of fact, I do not enjoy my devices lying to my ISP, or to my college campus, my medical clinic, or to my employers. Device, please identify yourself without wearing a fuckin’ Groucho mask on top, and put on your big boy pants.
  - HeatrayEnjoyer 2y ago
    Never thought I'd hear someone complain Google takes privacy too seriously.
    - AStonesThrow 2y ago
      Google is extremely conscious for their privacy of their data which they’re collecting from you. Google calls it “my privacy” but it’s not their business model to keep my stuff private to me but to Google and their partners. https://m.xkcd.com/1150/ https://m.xkcd.com/1150/ Google is trying to keep their own secrets like what their hardware MAC address really is, (because Google themselves are tracking everyone’s radio-enabled devices in every public space with far more sophisticated methods) or hide/virtualize my credit card details, and protecting the card from crackers who wear hoodies, build EBM playlists, and use Firefox? that is a side-effect at best, especially considering how they are already a crazy non-bank middleman 3rd party with a miasma of shifting TOS and hundreds of advertising partners salivating to know what you paid for 3 milliseconds ago. Sheesh.
capitainenemo 2y ago
Article notes this impacts soldiers (or I suppose others trying to be stealthy) who would have turned off bluetooth and wifi.
- ghostly_s 2y ago
  They mention android for this risk factor specifically-does android not have an "airplane mode" equivalent? I would assume it disables NFC also on iOS, but I guess I don't know —no mention of NFC on Apple's support page.
  - schaum 2y ago
    Andoird has an airplane mode Once enabled airplane mode you can enable Bluetooth again and airplane mode stays on,so just no mobile data an.same is true for WiFi. NFC however isn't touched by the airplane mode ...At least it was like that on the android phones I owned
    - eichin 2y ago
      Samsung Note (9 and 24 at least) has an "NFC and contactless payments" toggle (and a UWB one) on the page with wifi and bluetooth (Settings → Connections) but I don't know if it's "doesn't emit" or just "doesn't interact"...
  - c10ned 2y ago
    I’m the author. Let me clarify, as that was indeed worded rather vaguely in my post—I forgot to mention why exactly Android is at risk. On the Pixel 7, Airplane mode absolutely did not disable those frequency spikes upon screen unlock. Only disabling NFC through the dedicated setting in the phone’s parameters did (Settings > Connected devices > Connection Preferences > NFC). This theoretically puts Android users at greater risk, since on iOS, Airplane mode does disable those polling signals. It’s easy to see how an average user might assume they’ve gone completely dark by enabling Airplane mode on an Android device—when in fact, they haven’t. I’ll update the original post with this information, and thank you for pointing it out.
- 2y ago
jillyboel 2y ago
NFC uid is also randomized
lxgr 2y ago
"Classic" Bluetooth does not broadcast a detectable ID except if the device is explicitly in "pairing mode". It can be inferred when observing a connection establishment between two paired devices, or probed for if known (i.e. you can confirm that one of a few candidate devices is nearby, if you know their addresses), but not passively sniffed, as far as I know. Bluetooth LE does explicitly broadcast its MAC address in some modes, but offers various forms of private or random address modes to mitigate the problem.
- autoexec 2y ago
  there are passive ways to track cell phones using bluetooth: https://www.theregister.com/2021/10/22/bluetooth_tracking_device/ https://www.theregister.com/2021/10/22/bluetooth_tracking_de... https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-network-can-be-potential-tracking-tool https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-n...
  - lxgr 2y ago
    The second attack you linked is yet another completely different threat model. It requires running malicious software on the device to be tracked. From the paper: The Trojan code runs on the computer to be tracked. It retrieves the advertising address, acquires the matching public key from our server, and then advertises lost messages That's about as active as it gets! The first one describes radio fingerprinting, which is relatively new, concerning, and might be tricky to address.

by boznz 2y ago

jsheard 2y ago

Don't they randomize their broadcast ID? I know both Android and iOS scramble the WiFi MAC address by default, it would be odd if they didn't take the same precaution with Bluetooth.

boznz 2y ago
Sci-Fi books and it was a sentient AI, I can do anything I want in that situation :-)
csdvrx 2y ago
The randomization doesn't matter: you can very easily link the addresses if you have a few datapoints, even if it's just the time you observed the addresses: the basic method is discussed in https://inria.hal.science/hal-03045555/document https://inria.hal.science/hal-03045555/document See https://inria.hal.science/hal-02394629v1 https://inria.hal.science/hal-02394629v1 for the theoretical bases then hop to https://samteplov.com/uploads/shmoocon20/slides.pdf https://samteplov.com/uploads/shmoocon20/slides.pdf for an example applying to Apple devices Those who said the randomization and other techniques were sufficient were wrong: https://petsymposium.org/popets/2020/popets-2020-0003.pdf https://petsymposium.org/popets/2020/popets-2020-0003.pdf will show you how they changed their mind :) It's not just apple: google nearby has also been reversed: https://publications.cispa.saarland/2748/ https://publications.cispa.saarland/2748/ and https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_06B-3_Antonioli_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... talks about attacks, but there's no need for that: just find identifiers that let you link the addresses Even if you don't have any identifiers, the Bluetooth address randomization happens only about every 15 minutes: the manufacturer specific data in the public advertisement (or even the frequency and the length of these advertisements) during these 15 minutes periods can be used for linking the randomized addresses
- lxgr 2y ago
  That attack requires continuously monitoring a given device or area though, right? In other words, you could possibly track a given device through an area with enough sensors, e.g. a store, but not across visits.
  - csdvrx 2y ago
    > That attack requires continuously monitoring a given device or area though, right? The "randomization" seems to be a pseudo-randomization: with the seed and the timestamp, you should be able to deduce the future "randomized" addresses.
    - lxgr 2y ago
      Not with a cryptographically secure pseudorandom number generator, and constructing one doesn't seem hard to do, given that LE devices will need to support AES anyway.
AStonesThrow 2y ago
Google has lately been far overstepping their utility with “security measures” which I definitely don’t need and often make everything more annoying and difficult. Ex: blocking 3rd party cookies always now. Breaks countless websites which I need to work reliably. “Manage unused website/app’s permissions” even after I specifically granted them! Randomized virtual credit card numbers in Wallet: for no good reason, you thoroughly fucked up a refund attempt for me, >$500! And randomized MAC addresses by default for EVERY. SINGLE. SSID. It’s unhinged. It’s fake protection. As a matter of fact, I do not enjoy my devices lying to my ISP, or to my college campus, my medical clinic, or to my employers. Device, please identify yourself without wearing a fuckin’ Groucho mask on top, and put on your big boy pants.
- HeatrayEnjoyer 2y ago
  Never thought I'd hear someone complain Google takes privacy too seriously.
  - AStonesThrow 2y ago
    Google is extremely conscious for their privacy of their data which they’re collecting from you. Google calls it “my privacy” but it’s not their business model to keep my stuff private to me but to Google and their partners. https://m.xkcd.com/1150/ https://m.xkcd.com/1150/ Google is trying to keep their own secrets like what their hardware MAC address really is, (because Google themselves are tracking everyone’s radio-enabled devices in every public space with far more sophisticated methods) or hide/virtualize my credit card details, and protecting the card from crackers who wear hoodies, build EBM playlists, and use Firefox? that is a side-effect at best, especially considering how they are already a crazy non-bank middleman 3rd party with a miasma of shifting TOS and hundreds of advertising partners salivating to know what you paid for 3 milliseconds ago. Sheesh.

capitainenemo 2y ago

Article notes this impacts soldiers (or I suppose others trying to be stealthy) who would have turned off bluetooth and wifi.

ghostly_s 2y ago
They mention android for this risk factor specifically-does android not have an "airplane mode" equivalent? I would assume it disables NFC also on iOS, but I guess I don't know —no mention of NFC on Apple's support page.
- schaum 2y ago
  Andoird has an airplane mode Once enabled airplane mode you can enable Bluetooth again and airplane mode stays on,so just no mobile data an.same is true for WiFi. NFC however isn't touched by the airplane mode ...At least it was like that on the android phones I owned
  - eichin 2y ago
    Samsung Note (9 and 24 at least) has an "NFC and contactless payments" toggle (and a UWB one) on the page with wifi and bluetooth (Settings → Connections) but I don't know if it's "doesn't emit" or just "doesn't interact"...
- c10ned 2y ago
  I’m the author. Let me clarify, as that was indeed worded rather vaguely in my post—I forgot to mention why exactly Android is at risk. On the Pixel 7, Airplane mode absolutely did not disable those frequency spikes upon screen unlock. Only disabling NFC through the dedicated setting in the phone’s parameters did (Settings > Connected devices > Connection Preferences > NFC). This theoretically puts Android users at greater risk, since on iOS, Airplane mode does disable those polling signals. It’s easy to see how an average user might assume they’ve gone completely dark by enabling Airplane mode on an Android device—when in fact, they haven’t. I’ll update the original post with this information, and thank you for pointing it out.
2y ago

jillyboel 2y ago

NFC uid is also randomized

lxgr 2y ago

"Classic" Bluetooth does not broadcast a detectable ID except if the device is explicitly in "pairing mode". It can be inferred when observing a connection establishment between two paired devices, or probed for if known (i.e. you can confirm that one of a few candidate devices is nearby, if you know their addresses), but not passively sniffed, as far as I know. Bluetooth LE does explicitly broadcast its MAC address in some modes, but offers various forms of private or random address modes to mitigate the problem.

autoexec 2y ago
there are passive ways to track cell phones using bluetooth: https://www.theregister.com/2021/10/22/bluetooth_tracking_device/ https://www.theregister.com/2021/10/22/bluetooth_tracking_de... https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-network-can-be-potential-tracking-tool https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-n...
- lxgr 2y ago
  The second attack you linked is yet another completely different threat model. It requires running malicious software on the device to be tracked. From the paper: The Trojan code runs on the computer to be tracked. It retrieves the advertising address, acquires the matching public key from our server, and then advertises lost messages That's about as active as it gets! The first one describes radio fingerprinting, which is relatively new, concerning, and might be tricky to address.