A group of engineers from University of California at San Diego demonstrated that the Bluetooth signals constantly emitted by our mobile phones have a unique fingerprint that can be used to monitor and track an individual's movements.
Mobile devices, including phones, smartwatches and fitness bands, constantly transmit signals, known as Bluetooth beacons, at a rate of approximately 500 beacons per minute. These enable features such as Apple's “Find My” Find Network's lost device tracking service; COVID-19 tracking applications, and allows smartphones to connect to other devices, such as wireless headphones.
In previous investigations it had already been possible to identify that the wireless fingerprint exists in the WiFi network and in other wireless technologies. The critical perception of the UC San Diego team was that this form of monitoring can also be done using Bluetooth, in a highly accurate way.
"This is important because in today's world Bluetooth poses a more significant threat as it is a frequent and constant wireless signal emitted by all of our personal mobile devices.", said Nishant Bhaskar, a master's student in the Department of Computer Science and Engineering at UC San Diego and one of the paper's lead authors.
BUT: Bluetooth: Serious Failure Affects Smartphones and Computers
The team, which includes researchers from the Departments of Computer Science and Engineering and Electrical and Computer Engineering, presented their findings at the conference IEEE Security & Privacy in Oakland, California on May 24, 2022.
The researchers evaluated their method of monitoring, or tracking, through several real-world experiments. In the first experiment the group found that 40% of 162 mobile devices seen in public areas such as cafes were uniquely identifiable.
They then extended the experiment and observed 647 mobile devices on a public road for two days. The team found that 47% of these devices had unique fingerprints. Finally, the researchers demonstrated an actual tracking attack by fingerprinting and following a mobile device owned by a study volunteer as they entered and exited their home.
Now, if the problem can be fixed, the Bluetooth hardware would have to be redesigned and replaced. But researchers believe other, easier solutions can be found. The team is currently working on a way to hide Bluetooth fingerprints through digital signal processing in the Bluetooth device's firmware.
Those responsible for this study are also exploring whether the method they developed can be applied to other types of devices. Furthermore, they noted that just turning off Bluetooth may not necessarily prevent all phones from emitting Bluetooth beacons. For example, beacons are still emitted when turning off Bluetooth in Control Center on the Home screen of some Apple devices.
"As far as we know, the only thing that definitely stops Bluetooth beacons is turning off your phone.,” stated Bhaskar.
