Certain models of Bluetooth headsets can be used to track users. This is an “extremely worrying” conclusion drawn by a Norwegian student who was cycling through Oslo and analyzing signals from various devices.
During the 300-kilometer (186-mile) journey, Bjorn Hegnes, a network and IT security student at Norov University in Norway, collected data containing nearly 2 million Bluetooth messages. He found more than 9,000 Bluetooth transmitters, including 129 headsets. This enables students to analyze signals from at least a dozen headphone models.
Hegnes discovered that none of the headsets he picked up during the project had implemented a security measure called media access control (MAC) address randomization.
Since the MAC address is a unique identifier when it appears on the network, it can be used to track the device back to its wearer. In a longer period of time, it may also be used by third parties to establish patterns of behavior and habits of its owners.
The data collected and Hegnes’ analysis form part of him First year project At Norof University, and has proven that Bluetooth technology is easily tracked and monitored.
“This report explores the privacy vulnerabilities of WiFi and Bluetooth, that is, location tracking from a third party without the user’s knowledge,” Hegnes wrote in his report. “As ordinary citizens increasingly use WIFI and Bluetooth devices in their daily lives, many people will have at least one device, if not more than one, it can be used as a tracking device.”
Hegnes made several bicycle rides in Oslo within 12 days, and the first few rides were used as a way to test the equipment. His kit includes a Raspberry Pi, an omnidirectional Wi-Fi antenna that can receive Bluetooth signals from a distance of 100 meters, and a USB GPS device that can be accurately positioned.
The student named the project “Operation Wardrive” “wardriving”, a term used to describe unauthorized access to WiFi networks. The project is concentrated in the Oslo third ring area, accounting for about 20% of the total area of Oslo.
Hegnes’ report suggests that it may be easier to track a person’s movements using Bluetooth headsets than using Bluetooth headsets. cell phoneMany companies are already using MAC information and tracking technology in this way.
Helsinki AirportFor example, use Bluetooth MAC address information from a passenger’s smartphone to estimate the time to wait in a safe queue. The same is true at Oslo Airport, which collects information from WiFi points located before and after the security checkpoint to get the average time it takes for passengers to pass through the security checkpoint.
Hegnes’s discovery raises some concerns, especially considering the National Security Agency informer Edward Snowden. Information leaked by former NSA system administrators, especially Leave President Donald TrumpThe list of pardons shows how easy it is to collect data from mobile phones and other devices.
“With the boom in smart devices over the past decade,” Jake Moore, a security expert at the Slovak information security company ESET, told The Register, “When privacy is currently undergoing a powerful shift, it is very worrying not to take this into consideration.
“The post-Snowden era also makes these findings even more worrying.”
Getty Images
