Himiko: A human interface for monitoring and inferring knowledge on bluetooth-low-energy objects
Guillaume Celosia, Mathieu Cunche · 2019
The Bluetooth Low Energy (BLE) protocol is being included in a growing number of connected objects such as smartphones, fitness trackers, headphones and smartwatches. As part of the service discovery mechanism of BLE, devices announce themselves by broadcasting radio signals called advertisement packets that can be collected with off-the-shelf hardware and software. To avoid the risk of tracking based on those messages, BLE features an address randomization mechanism that substitutes the device MAC address with random temporary pseudonyms. However, the payload of the advertisement packet still contains fields that can hamper the randomization mechanism by exposing counters and static identifiers. In addition to defeating the randomization mechanism, some of these fields can leak sensitive attributes of the owner such as his medical condition.