How your favorite gadgets could be exposing your dataYour Bluetooth gear can be tracked by bad actors and retailers. Here's what experts recommend you do.
Jada Jones/ZDNET • Your Bluetooth devices constantly emit small packets of data.
• These packets keep your devices connected, but also contain data.
• Remove identifying information, update your devices, and upgrade legacy peripherals to stay safe.
Imagine the tech you pack for a work trip: your phone, laptop, headphones, or tablet, maybe peripherals like a wireless mouse or keyboard. Despite the different manufacturers and operating systems of these devices, they all have one thing in common: Bluetooth.
For these devices to work smoothly, they send out advertising packets, or wireless beacons, to announce their presence so other devices can connect to them and participate in large-scale device location networks, such as those offered by Apple and Google.
Bluetooth Low Energy is the foundation of Apple’s Automatic Pairing and Google’s Fast Pair, which allow seamless, no-friction pairing for compatible devices. However, these data packets can reveal information about you, and anyone concerned about privacy, from IT professionals to everyday people, may want to practice better hygiene to avoid giving too much away.
Here’s what to know.What is Bluetooth sniffing?Bluetooth sniffing is the act of intercepting Bluetooth Low Energy advertising packets as they’re being transmitted from one device to another. Once intercepted, a packet can reveal a device’s packet exchange history, its name, manufacturer, firmware version, and MAC address.
More consistent monitoring can show how often a device advertises, how long it advertises, especially if someone plants a sniffer in one location, such as a hotel lobby, and can determine when a device appeared and disappeared from its range.
Although advancements in Bluetooth Low Energy prioritize increased security, vulnerabilities still exist, as evidenced earlier this year when Belgium’s KU Leuven University Computer Security and Industrial Cryptography group
unveiled flaws in Google Fast Pair that allowed attackers to hijack personal audio devices.
More recent Bluetooth vulnerability findings
presented by French researchers at Eurecom show that the Bluetooth Low Energy re-pairing process can be exploited to impersonate devices, downgrade security levels, and leave devices vulnerable to unauthorized pairing, regardless of their Bluetooth version.
Google Pixel 9 Pro and Pixel Buds Pro 2 | Jada Jones/ZDNETSome devices are more vulnerable than others; many laptops and smartphones use Bluetooth Low Energy’s Resolvable Private Addresses (RPAs), which regularly rotate the information a device uses to authenticate a wireless connection to a recognized device, such as a pair of earbuds or a smartwatch.
RPAs generate new MAC addresses, preventing Bluetooth Low Energy scanners from tracking a device over the long term, while still allowing authorized devices to remain connected via an encrypted key.
However, not every Bluetooth device uses RPAs. On top of that, some peripheral devices with RPAs, such as headphones and smartwatches, may not generate a new RPA as often as desired, and
research suggests that RPAs alone don’t completely prevent information leakage.
Beware the decade-old mouseAirports, hotel lobbies, conferences, coffee shops, gyms — anywhere where people, and most importantly, their devices, congregate — can be favorable locations for Bluetooth Low Energy advertising packet reading.
Though vulnerabilities like WhisperPair found in Google’s Fast Pair protocol may be less likely, people of interest can give away their habits, such as when they frequent a location, and which devices are usually on their person.
Older devices are particularly hazardous for professionals working on sensitive materials while in private spaces, especially if they aren’t updated to the latest firmware. Aimee Simpson, director of product marketing at Huntress, says that devices with older firmware or legacy Bluetooth versions are more susceptible to bad actors.
“Without the right updates in place, a malicious actor may take advantage of the Bluetooth OBEX protocol, which allows them to bypass authentication protocols and lift data off a device,” she says.
Simpson also mentioned
bluesnarfing, the act of exploiting a legacy device’s Bluetooth vulnerabilities to steal data. If companies provide employees with outdated devices, especially mice, keyboards, and headsets, the risk increases.
On the topic of legacy wireless devices, Brett Walkenhorst, chief technology officer at Bastille, brings up a 10-year-old vulnerability the company discovered called
MouseJack. This vulnerability targets older 2.4GHz wireless dongles used to connect a mouse to a computer.
Though these devices use a different wireless protocol from Bluetooth, they’re still lingering in offices, conference rooms, reception desks, and home offices. The long hardware lifespan
continues to sustain the older vulnerability, and IT decision-makers should consider upgrading to wireless peripherals with encrypted Bluetooth connections.
“For businesses, awareness is only part of the solution,” Walkenhorst says. “Organizations should understand which wireless devices are operating within their environments and establish policies governing their use, particularly in areas where sensitive information is handled.”
Advertising packets living up to their nameIt’s likely you feel that you have nothing to hide, and potentially nothing to offer, to bad actors from the information collected by your keyboard or headphones. As I mentioned earlier, sniffing for your Bluetooth devices can reveal certain information, such as the device’s name.
If your devices are labeled with your name, such as “Jada’s AirPods” and “Jada’s wireless keyboard,” then someone can simply sniff out your active devices and know your name. Lorena Carthy-Wilmot, head of EU security strategy at iVerify, suggests keeping your device names random or vague, with her personal favorite being “FBI Surveillance Van.”
However, Carthy-Wilmot also says that, in her experience, Bluetooth sniffing is a backup strategy for bad actors rather than a primary source of valuable information. If you’re not a high-profile person, such as a government official or C-Suite executive, you’re likely not a targeted person.
iPhone 18 Pro | Kerry Wan/ZDNETStill, Bluetooth advertising packets are a valuable source of data for retailers, with some using small beacons near the entrance to detect your phone’s presence. Then, you may be targeted with coupons or promotions once you’re inside the store.
Target’s privacy policy states that if your phone has location services enabled, in-store Bluetooth beacons pick up your phone’s emitted packets to “permit Target to find nearby products for you, get you real-time deals, auto-sort your shopping list and more.”
Walmart’s privacy policy states the same, but disabling location services and Bluetooth disallows further tracking.
What you can doAll the experts I spoke to offered the same advice, first and foremost: remove your name from your Bluetooth device labels in your device settings. They also suggested powering off peripherals like mice and keyboards when they’re not in use. Additionally, if you’re not using a Bluetooth device, turn off your phone’s Bluetooth in Settings, not in the Control Center.
Turning off Bluetooth in the settings menu stops your phone from sending out packets to discover (and be discovered by) nearby devices, while turning it off in the Control Center only disconnects your phone from your active connections.
source
