Live data from Hacker News

What your Bluetooth devices reveal

blog.dmcc.io

91–100 of 204 posts

Re: What your Bluetooth devices reveal

#91
post #41

This is not very different from collecting visual cues. You can notice a delivery van arriving. You can see the driver's face, same with passers-by. The biggest difference is that a camera needs to be more conspicuous, while a BT receiver can be invisible and undetectable. Much cheaper, too.

I have an ESP32 Cam in front of me right now. I think I paid maybe 8 bucks for it. If I wanted to, I could very easily hide the tiny camera in my front door, and use it to both collect bluetooth and wifi metadata (including MAC addresses) and correlate images/faces to MAC addresses when people pass by close enough so that I can identify them later from longer range wifi/ble detections.

(I actually do plan to install this at my front door, but aimed mainly to detect when a deliver/parcel in on my doorstep, and I don't (yet?) plan on sniffing bluetooth/wifi with it)

Re: What your Bluetooth devices reveal

#92
post #49
post #15

Bluetooth desperately needs mac randomization. Wifi mac randomization is welcome, but it doesn't do much when many (most?) people have bluetooth accessories broadcasting a persistent identifier whenever they're on.

> Bluetooth desperately needs mac randomization. Bluetooth already has a well developed MAC randomization scheme. Lookup "resolvable private address". The short of it is, your phone can find your headphones or vice-versa, despite one or both having random addresses. The addresses can be regenerated or rotate at an interval (say 15 minutes). The first part of the address is a nonce (pRand), and the rest of the address…

> Lookup "resolvable private address". The short of it is, your phone can find your headphones or vice-versa, despite one or both having random addresses.

Is that just for the connection phase? Or does it then start publicly broadcasting a persistent MAC onced it's connected, so if you earbuds or watch are connected and communicating with your phoine, would a sniffer see a persisten MAC address or the session randomised one?

That's a problam (one of many problems) with WiFi MAC address randomisation - you can sniff the network names a phone is trying to connect to, then stand up a wifi access point with one of those names and the phone will reveal its real MAC address when it connects. I experimented a long time back with having a raspi that broadcast itself as a McDonalds free wifi access point, a huge number of phones would try to connect while I was out in public with it.

Re: What your Bluetooth devices reveal

#93

Ring: thank you for the idea, "Introducing Ring Face-Off, face masks covering faces during a break-in is no an issue for Ring, we will track the thieves until they reveal their face to our Ring network."

For immediate release: BLE N95 Facemasks Inc (YCombinator Summer 2025) is proud to come out of stealth mode and announce our acquisition by Ring. This follows a major private angel investment by Palintir with a post money valuation of $500 million.

Re: What your Bluetooth devices reveal

#94
post #92
post #49

Earlier quoted context omitted.

> Bluetooth desperately needs mac randomization. Bluetooth already has a well developed MAC randomization scheme. Lookup "resolvable private address". The short of it is, your phone can find your headphones or vice-versa, despite one or both having random addresses. The addresses can be regenerated or rotate at an interval (say 15 minutes). The first part of the address is a nonce (pRand), and the rest of the address…

> Lookup "resolvable private address". The short of it is, your phone can find your headphones or vice-versa, despite one or both having random addresses. Is that just for the connection phase? Or does it then start publicly broadcasting a persistent MAC onced it's connected, so if you earbuds or watch are connected and communicating with your phoine, would a sniffer see a persisten MAC address or the session randomi…

>That's a problam (one of many problems) with WiFi MAC address randomisation - you can sniff the network names a phone is trying to connect to, then stand up a wifi access point with one of those names and the phone will reveal its real MAC address when it connects.

That's not how mac address randomization works now for both android and ios. Both connects with a randomized mac as well, which might be persistent per-network, but it still heavily hampers data collection. For ios specifically, it also seems to have some sort of heuristic to detect which network names are common/guessable, and use a rotating mac for those. Moreover "you can sniff the network names a phone is trying to connect to" isn't really a thing unless the network is using hidden ssid, which isn't the default for almost all routers.

Re: What your Bluetooth devices reveal

#95
post #16
post #12

Earlier quoted context omitted.

> even medical devices constantly broadcast their presence I mean yes, said medical devices are a whole lot less useful to me if they are not transmitting data. For some of this stuff you can't have your cake and eat it too.

There’s a middle ground here. There is no technical reason a pacemaker constantly broadcasts itself - there is ways to allow communication to such devices without yelling your name all the time. And there is definitely no reason for such a name to be a unique identifier.

There are technical reasons, though.

Let's suppose we have a pacemaker, and it has data that is beneficial to read -- maybe even in real-time on their pocket computer, or opportunistically as the patient walks by their reader-device, or however that is done.

So we want this data, and we want it over RF. It probably seems obvious that it should only transmit when it is told to do so, right?

So how do we tell the pacemaker to transmit? On its face, that problem seems solved by integrating a receiver that sits and waits for a valid instruction.

Except: That receiver takes power to run. And since changing batteries inside of a person is problematic, we want them to last as long as they can while still performing the desired task.

Now we get to the not-obvious part: In terms of power, it's often less costly to intermittently transmit a string of data than to continuously operate a radio receiver. And maybe it's a bad idea to have an implanted pacemaker that has an open receiver for anything nearby to try to fuck with, anyway.

But a transmit-only radio? Good luck hacking that.

So... we do intermittent transmission, and this works for pacemakers. It also works for the cheap Zigbee thermometer I have (wherein I don't normally request the temperature; it just delivers it periodically, and it runs for years and years on a coin cell).

(Now: Should that pacemaker data be encrypted? Yes, of course. And so should the ID. In fact, the whole transmission should be indistinguishable from background noise by unrelated devices. In this way, authorized devices can then use pre-shared keys to receive and decode these messages and others receive nothing. That kind of cuts BLE and thus also the pocket computer out of the monitoring mix, but tradeoffs are tradeoffs.)

Re: What your Bluetooth devices reveal

#96

I read an article in 2012 about the feds (DHS?) placing Bluetooth enabled devices along I5 in Seattle. They were able to make profiles of people based on what Bluetooth devices they had in their cars. Is anyone familiar with this? I've periodically tried to Google it and can't find anything about it

There are realtime systems for traffic analysis. I know of Addinsight, e.g. https://news.addinsight.com/bluetooths-leap-forward-the-evol...

Re: What your Bluetooth devices reveal

#97
post #27
post #13

Earlier quoted context omitted.

Yeah, but it stopped pretty soon stores figured out that they could flood you with advertisements over Bluetooth. In some places it was bad enough that I had to turn off Bluetooth.

How did this play out? Were the ads from an app from the store that you had installed? Or did they spam you over SMS because they associated your bluetooth info with an account you have with the store, or contact info they bought from a third party?

Neither. They used to discover your device and then send a Bluetooth push. "Would you like to receive a file from …"

It was usually an image, movie, or audio file.

Re: What your Bluetooth devices reveal

#98
post #94
post #92

Earlier quoted context omitted.

> Lookup "resolvable private address". The short of it is, your phone can find your headphones or vice-versa, despite one or both having random addresses. Is that just for the connection phase? Or does it then start publicly broadcasting a persistent MAC onced it's connected, so if you earbuds or watch are connected and communicating with your phoine, would a sniffer see a persisten MAC address or the session randomi…

>That's a problam (one of many problems) with WiFi MAC address randomisation - you can sniff the network names a phone is trying to connect to, then stand up a wifi access point with one of those names and the phone will reveal its real MAC address when it connects. That's not how mac address randomization works now for both android and ios. Both connects with a randomized mac as well, which might be persistent per-n…

Oh cool, thanks. My last time playing with this was pre covid, possibly 5 or more years pre covid.

I do know for sure that my iOS devices connect with persistent MAC addresses on both my home and work wifi networks - I'd _assumed_ it was the same MAC address on both networks, but I'll be curious to see if that's correct next time I'm in the office.

Re: What your Bluetooth devices reveal

#99
post #78

Earlier quoted context omitted.

You can do this for much cheaper - all four of your tires are broadcasting a unique ID to report tire pressure, the radio to pick it up is cheap (because cars), and TPMS has no facility to randomize or otherwise secure this.

It’s actually even easier, your car has a plate on the front with a unique ID that a camera scans, often to automatically track your park time for ticketing. I can’t really care about obscure Bluetooth tracking when every business has CCTV doing facial recognition.

Yeah exactly, with a car I would no longer be expecting any type of privacy, sadly.

Here in Holland we must even have a mobile phone module in every car so it can call the emergencies in case of a crash.

Re: What your Bluetooth devices reveal

#100

Earlier quoted context omitted.

I have the opposite experience: GrapheneOS has an option to automatically turn your bluetooth off after a configurable period of not being used. So when I need to use bluetooth, I turn it on like normal. Then, without thinking about it, it automatically turns off. The end result is my bluetooth is only ever on for a couple hours each month when I'm making phone calls.

I only see an option to turn back on tomorrow. How do you find this option?

It's under Settings > Security and Privacy > Exploit Protection > Turn off bluetooth automatically

Definitely not the most obvious location. I would have expected to find this under the bluetooth settings.

Post reply on HN