Student tracks Bluetooth headset wearers by wardriving around Oslo on a bicycle

In one state I cannot mention, in Australia, there are at least 4000 of these things by the side of the road. During criminal cases its not unusual for a vehicles MAC address to be run through the database of collected data and matched to the vehicles location at a point in time. If the vehicle was also carrying correct plates then ALPR can be included. Prosecution gets to present a very pretty map with detailed timestamps.

I cannot mention the state because their presence is not disclosed publicly.

Yeah, I rewrote a system for a company that did this. If it makes you feel any safer, the original codebase was an error-prone mess written by an intern.

It’s not any more, but all it did was ping for MAC addresses at both ends of the stretch. I suppose the data could prove your presence, but it’s the presence of your car really. At least with Apple the MAC gets cycled now.

You know what you cant turn off? TPMS. I mean you can remove them from your car, but those little guys broadcast and with the right equipment you can track cars with them.

Similarly in NSW Australia they had installed similar antannas on traffic lights/traffic light boxes. Iirc they would also track Bluetooth signals. Not sure they tracked the OEM infotainment stuff or just the drivers phone Bluetooth IDs

Iteris (formerly Traffic Cast) is a company that does this too

https://www.iteris.com/products/travel-time

I just removed the bluetooth module from my car.

> or even unencrypted

Even unencrypted? I am biased here having run an open wifi since they were commercially avilable.

In the beginning, there was this huge concern that wifi would hurt the last mile ISP business. Many started outright forbidding guests using the connection in their terms of service. That didn't work out very well. Calling them insecure and having papers write about how to check that other people couldn't connect to work network worked much better.

My concern is that letting the commercial ISPs set the discourse around encryption, which is better suited for the endpoints than the transmission layer, set us back several years of deploying encryption everywhere. It also made for in my opinion unnecessary concerns around real world implementations of mesh networking.

Note that there are security concerns with running unencrypted wifi as compared to having a shared secret publicly available. An SSL-only world mostly mitigates this, and encrypted DNS is a piece to this story. End user systems could easily have had a no plain text-option among their firewall settings to help get this going. Language matters. Commercial interests are obvious here, the lay persons focus on transmission encryption made this transition harder, and every time someone speaks of insecure last mile transmission we are reminded of it.

I had a similar idea, and I suspect that address randomization isn't as big a problem as you might suspect, since many people have a paired device (i.e. headphones), and that pairing often uses classic Bluetooth, so it must have a fixed address. The burglar's car is also likely to broadcast unrandomized bluetooth if it's in the area, also.

But the real trouble with this system is that the police aren't going to do anything with this data unless there's a murder. Even if a bluetooth device were stolen and you could locate it, the police will not likely help you recover anything. And this assumes that they even understand what this pissed-off nerd is on about.

Amazon, however, could build a bluetooth sniffer or IMSI catcher into its devices and sell the resulting data to law enforcement, who could then avoid the time and expense of getting a warrant for location data. Assuming that the police care at all about property crime, this would achieve the goal.

As far as I know the way Bluetooth is implemented in many devices prevents it from working if you change the MAC address all the time.

I've experienced this reliance on MAC addresses by trying to use Bluetooth headphones in a dual boot system. Every time I switch operating systems, I need to repair. Same with phones that have been factory reset. Peripherals seem to assume that a device (MAC address) uuniquely identifies the other end of the connection (which it actually is supposed to, so fair enough). You can probably use random addresses for scanning for new devices, but for any active use of the protocol you're going to need to stick to a given address. As long as you only use one device at a time, that address can probably be randomised for each device, but that's a hard sell that strongly limits how Bluetooth can be used.

You could have use a stingray to capture their IMSI

Trivia: Norway is not in the EU, but they still adopted the GDPR. (A possible practical effect might be implementation differences due to that)

There are exemptions for academic research and journalism in the GDPR under article 85 [0]. That is why the original news article (that I wrote) clearly mentions right away that the information was collected for a academic project.

[0] https://bookdown.org/fede_caruso/bookdown/the-journalistic-e...

Reading GDPR's definition of personal data I think he is safe

GDPR applies to organizations, he is not an organization and not doing it as a business.