back to article Brilliant Boston boffins blow big borehole in Bluetooth's ballyhooed barricades: MAC addy randomization broken

A team of US academics have proposed a simple method to defeat the Bluetooth LE standard's anti-tracking measures. David Strobinski, David Li, and Johannes Becker at Boston University told The Register how they found that the MAC randomization system of Bluetooth LE, designed to thwart the tracking of devices, transmits …

  1. NetBlackOps

    Intentional?

    And at whose behest, if so. Yeah, I wear a tinfoil hat 24x7.

    1. Anonymous Coward
      Anonymous Coward

      Re: Intentional?

      No need. Like children getting at the cookie jar. You don't need to intentionally bug the cookie jar... just look for the crumbs.

  2. Anonymous Coward
    Anonymous Coward

    I still think...

    I still think MAC scrambling is effin stupid.

    It's meant to be unique.

    I understand the privacy concerns, but we really need to wonder how we got to the point that unique information now has to be scrambled at every cost when interacting with the world.

    1. Pascal Monett Silver badge

      I agree with you totally, but that is what happens when a ridiculously small number of fucking assholes screw it up for everyone else.

    2. Anonymous Coward
      Anonymous Coward

      Re: I still think...

      Mmmm. Downvotes cure cancer!

      1. Danny 2

        Re: I still think...

        I was the second person to downvote you, seconds ago, and the reason was you posted anonymously while decryng anonymity. If you had posted that under your username then I wouldn't have downvoted you.

        I could explain every downvote I make - very few, mostly upvotes all round - but that would be boring for everyone else. You were downvoted this time for hypocrisy on anonymity - no offence, just so you know.

        1. deive

          Re: I still think...

          Well said Danny 2! I try to do similar and be sparing with the down votes.

          Having said that; if someone gets offended that you don't agree with them then that is their problem, not yours!

          1. Anonymous Coward
            Anonymous Coward

            Re: I still think...

            So if an anon posts a response in a chain of another anon, are they the same anon that posted anon before, or is the new posted anon filled by a different anon?

            Asking for a friend, who shall remain anon.

            Because the sense of humor of the first anon is so great.

      2. Anonymous Coward
        Anonymous Coward

        Re: Downvotes cure Cancer

        Ok, so have you had Cancer?

        I have and would not wish it on anyone. It is no laughing matter in any shape or form.

        Posting as AC because I get enough scammers calling me trying to sell bogus funeral plans. I ain't going anywhere soon but those ****** don't care.

        1. Phil Koenig

          Bogus funeral plans

          I've been a user here for years and I see no evidence that it has lead to sales calls or emails from anyone.

          Here's a coin, try again.

    3. doublelayer Silver badge

      Re: I still think...

      MACs are supposed to be unique, yes, because networks can't deal with (some exceptions apply) duplicate MACs. That's how they're designed. However, why does my MAC have to be globally unique instead of just unique on my network? And why does it have to be the same unique value when it's on my network and when I've connected to your network?

      Some things need to be globally unique, so people can find or at least recognize that specific thing when it appears. Others don't. Given that a MAC is essentially a random number, telling you only what manufacturer built the device (which you don't need to know because it doesn't tell you anything you need), there is no major benefit obtained from keeping that MAC or using a random one, unless you somehow connect to a network with another device that has simultaneously decided to use the same randomized number.

  3. Novex

    Isn't the real flaw...

    ...the idea of having bluetooth on all the time so you can receive advertising as you walk/cycle/drive along a street...? Isn't that just inviting trouble (and high battery usage)?

    1. Charles 9

      Re: Isn't the real flaw...

      No, the real flaw is fundamental and not unique to Bluetooth. It's a nigh-intractable problem: how do you maintain a dialogue (a two-way communication) without one or the other being able to be identified simply by tracking the communique itself? Think of it like envelopes. How does one expect a reply without posting a return address? That's the reason most privacy-oriented communications are one-way and employ passive listeners. But that necessarily introduces inefficiencies: a killer for devices with very little power.

      1. Anonymous Coward
        Anonymous Coward

        Re: Isn't the real flaw...

        Even harder. Timing or location channels allow you to get some meta data from it.

        Like, in the envelope example. If you know the route of collection from post boxes, you can guess someones location to that street, because the letter turns up in the post van the same time every day/week.

        You can find out where it's been, because here the sending branch/recivined branch might stamp the letter as received by the van.

        The sender might send less letters when it is raining. Or when they are on holiday.

        So even without opening it, you can gain some info. Though sometimes it's just noticing what type of paper is used. :P

        1. eionmac

          Re: Isn't the real flaw...

          or the pheromone on the envelope [sorry "expensive perfume"].

      2. Craig 2

        Re: Isn't the real flaw...

        Exactly... We need a unique identifier to allow 2 way communications. But, we need to stop tracking so we'll occasionally send another unique identifier to randomise the original unique identifier. Repeat ad infinitum..

      3. Phil Koenig
        Black Helicopters

        Re: Isn't the real flaw...

        One WiFi privacy tool I use on my phone uses the GPS to ascertain if you are near a known network or not before it attempts to connect. (Rather than the usual practice of constantly broadcasting and looking for a known network)

        Perhaps something like that could be applied to Bluetooth. (Of course, all the privacy-invasive things people like to use Bluetooth for - like retail BT beacons and such, would stop working. A feature, not a bug..)

        1. Charles 9

          Re: Isn't the real flaw...

          Not to mention GPS chews up the battery, which is a no-no for devices designed on little power.

        2. doublelayer Silver badge

          Re: Isn't the real flaw...

          I've long thought devices should stop sending packets asking for the networks they know--they could instead listen for broadcast SSIDs which get announced anyway. This would at least solve the problem of devices that always respond yes no matter what SSID was requested and the other problem where devices can be fingerprinted based on the SSIDs they ask about. I'm not quite sure why WiFi decided to go the other way.

          1. Charles 9

            Re: Isn't the real flaw...

            Two words: HIDDEN SSIDs, used in say corporate environments which aren't meant to be known to all and sundry. I know one exists where I work right now.

  4. Anonymous Coward
    Anonymous Coward

    Dear Danny_2

    Dear Danny_2:

    Why does a third party, broadcasting using Bluetooth, need to know anything about me and my mobile phone?

    *

    As an example, when I buy a copy of an (old fashioned) newspaper, do the advertisers in the newspaper need to know my name or my location?

    *

    In the case of Bluetooth, we HAVE NO IDEA AT ALL about the data transmitted off my mobile phone. Why should Bluetooth not be just as anonymous as a copy of The Sun newspaper. Why do you think that anonymity is a problem? Perhaps you work for the STASI? Perhaps you are just a nosy parker? Or maybe you just don't understand that some people actually value their privacy....until they consent to be identified.

    *

    Signed: Anonymous Coward

    1. Danny 2

      Re: Dear Danny_2

      There are a few obvious problems with anonymity, such as it's easily astroturfed. That's why when I speak out in favour of anonymity I put my name to it. To portray me as anti-privacy is silly. My surname isn't really 2, and I trust El Reg more than I trust the readers of El Reg. No offence.

      There are obvious tech reasons why a unique identifier on any network was useful; there are obvious socio-political reasons today why it is dangerous. This article isn't about whether MAC addresses should be spoofed or not, it is about a flaw in one corporations spoofing. DIY.

      1. Charles 9

        Re: Dear Danny_2

        "This article isn't about whether MAC addresses should be spoofed or not, it is about a flaw in one corporations spoofing."

        But the thing is, the flaw behind the flaw is that it's fundamentally very HARD to anonymize a two-way communication. Meaning it's probably not just the implementation that's flawed but rather the whole concept is a problem from the start.

  5. Anonymous Coward
    Anonymous Coward

    It’s disabled

    I’m good thanks.

    If I need it for something, like .01% of the time I use the device, I’ll turn it on. Then immediately turn it off...

    Question: Is Google a member of the group that contributed to the Bluetooth standard? Microsoft? My bet is yes...

    It’s better to be paranoid... it’s usually the right call.

    1. Psmo
      Go

      Re: It’s disabled

      It’s better to be paranoid... it’s usually the right call.

      Granted, however both Microsoft and Google produce operating systems that integrate with Bluetooth on a driver and operations level.

      This time they should get a pass.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like