[HN Gopher] Defending against Bluetooth tracker abuse: it's comp...
___________________________________________________________________
Defending against Bluetooth tracker abuse: it's complicated
Author : kccqzy
Score : 36 points
Date : 2023-05-09 17:41 UTC (5 hours ago)
(HTM) web link (educatedguesswork.org)
(TXT) w3m dump (educatedguesswork.org)
| Hizonner wrote:
| The article misses one of the design goals that's pretty obvious
| if you look at the reverse-engineered Airtag protocol: they don't
| do any public key cryptography at all on the tag itself. And the
| reason for that is that it would wreck their battery life.
|
| Anything that relies on "attestation" violates that constraint.
|
| Of course, another possible approach would be to JUST NOT HAVE
| THE NETWORK...
| ekr____ wrote:
| > The article misses one of the design goals that's pretty
| obvious if you look at the reverse-engineered Airtag protocol:
| they don't do any public key cryptography at all on the tag
| itself. And the reason for that is that it would wreck their
| battery life. > > Anything that relies on "attestation"
| violates that constraint.
|
| Article author here. Thanks for making this point.
|
| I agree that you want to minimize the amount of ECC on the tag
| and certainly you don't want each advertisement to require a
| separate EC op. However, I don't think the requirement is no
| crypto on the tag.
|
| 1. Each time you change keys (every 15 minutes in detached
| mode) you have to some EC crypto ops. 2. You could require
| attestation only prior to reporting, thus keeping the cost
| fairly low. Note that this does allow a nearby attacker to
| force you to do crypto but they can also cause you to run the
| speaker, which consumes power.
| kayodelycaon wrote:
| Without the network, you don't have much of a product.
| saurik wrote:
| The vast majority of the value of the Tiles I own isn't
| figuring out where my keys might have been moved by someone
| else since I lost them, it is noticing (and remembering) when
| (and where) I left them and then helping me zero in on them
| once I am back there, something that can be done entirely
| using just my phone. The remaining product once you support
| those two features--neither of which require a "network"--has
| only niche applications to edge cases involving losing things
| and stalking people (as well as adding a bunch of difficult-
| to-avoid third-party surveillance).
| AceJohnny2 wrote:
| "I don't value the feature" != "the feature has low value"
| bsder wrote:
| > And the reason for that is that it would wreck their battery
| life.
|
| Not really. ECC is fine for energy consumption and most BLE
| chips now have crypto accelerators.
| pnw wrote:
| Interesting that the OP doesn't consistently get the "stalker"
| warning. I see it consistently within 30-45 mins when I'm with a
| dog whose tag is registered to someone else and they leave my
| vicinity.
|
| It's a shame Apple had to kill the theft use case to prevent
| stalking. I assume thieves are well aware of this now.
| D13Fd wrote:
| I use AirTags to help keep track of my young kids at busy
| places, and the "safety" measures interfere with that as well
| (when thinking of a hypothetical abduction).
|
| Personally I think the stalking fear is overblown, and it's
| unfortunate that they interfere with other use cases to prevent
| that one.
| dannyobrien wrote:
| I would take a $1000 bet with you that stalking cases by a
| known adversary outnumber child abduction by strangers. Not
| sure how to find the stats though.
| bsder wrote:
| > Personally I think the stalking fear is overblown
|
| I used to think that, but I know one woman who was stalked
| with an AirTag and I personally know too many women who were
| stalked even before these tags came along.
|
| The one thing I have learned in life: as a large male, I
| simply view the world through a _completely_ different lens
| than a small woman does.
| D13Fd wrote:
| There are many things that we accept in the US that have
| both beneficial and harmful uses: guns, cars, knives,
| alcohol, Tylenol. Many of those kinds of things
| disproportionately impact one sex (or category) of people,
| but that their overall utility outweighs the risks and
| downsides. Our solution is to ban the abuses (murder,
| assault, stalking) but not the product itself. I don't see
| why this one needs special treatment.
| ignite wrote:
| New York didn't get that memo:
| https://abcnews.go.com/Politics/nyc-distribute-apple-airtags...
| 1024core wrote:
| Tangential: is it possible to just get a list of all BLE devices
| in my local area (for any definition of "local") for cheap?
| wongarsu wrote:
| "Bluetooth wardriving" has promising google results, e.g. [1]
| [2] [3]. That would involve either driving around with such a
| setup, or planting a couple of them, depending on your coverage
| and update requirements.
|
| 1: http://mateslab.weebly.com/bluedriving.html
|
| 2: https://interruptlabs.ca/2021/10/15/Bluetooth-WarDriving-
| wit...
|
| 3: https://hackaday.com/2011/04/15/long-range-bluetooth-
| wardriv...
| kccqzy wrote:
| > Depending on the design of the tag, it might be possible to
| rewrite the firmware to violate the requirements in this
| document, for instance by rotating the MAC address frequently to
| evade detection (oddly: this document says "The accessory SHOULD
| have firmware that is updatable by the owner", which is the
| opposite of what you want here.)
|
| One part of me supports this Stallman-esque proposition as self-
| evident: of course the owner should have the ability to update
| the firmware. Another part of me is deeply concerned about the
| potential for misuse, including modifications that explicitly
| evade detections of stalking. Tracking another human and
| violating their privacy shouldn't have been so easy.
| namaria wrote:
| People want cheap, ubiquitous networked radio emitting devices.
| There is a fundamental trade-off there...
| AshamedCaptain wrote:
| There are two sides here that should not be confused. One on
| side we have "the network", i.e. the ability for these tags to
| be tracked through a myriad of iPhone owners that are not even
| aware that they are doing the tracking. On the other hand, we
| have the broadcasts emitted by the tag itself, which can
| announce the presence of the tag to a _nearby_ stalker.
|
| What actually makes these tags interesting, I think, is the
| network.
|
| While changing the firmware of the tags makes it (probably)
| easier to track nearby ones "locally" with specialized
| software, it will not change its interaction with the Apple
| network whatsoever -- it will not make it easier nor harder to
| stalk long-distance.
|
| And if you are only interested in "local area stalking", I
| presume there are much smaller, cheaper and even more
| conspicuously looking trackers than an Apple AirTag.
| saurik wrote:
| > What actually makes these tags interesting, I think, is the
| network.
|
| I mean, that mostly only makes them more interesting for the
| stalking use case, no? If you left your wallet at a
| restaurant, you don't need the network: you need your phone
| to notice it lost the connectivity to the wallet when you
| left the restaurant and you need the ability to find where in
| the restaurant it might be once you go back there to get it.
| I've been using Tile for years and have been extremely happy
| --hell: I end up using it every couple days to find something
| --despite never once having an interest in their "network".
___________________________________________________________________
(page generated 2023-05-09 23:01 UTC)