Proceedings on Privacy Enhancing Technologies ; 2019 (3):50–65

Johannes K Becker*, David Li, and David Starobinski

Tracking Anonymized Bluetooth Devices

Abstract: Bluetooth Low Energy (BLE) devices use regularly broadcasted in the clear, leading to major pri-
public (non-encrypted) advertising channels to an- vacy concerns over the possibility of unwanted track-
nounce their presence to other devices. To prevent track- ing [33]. This was addressed in the Bluetooth Core Spec-
ing on these public channels, devices may use a peri- ification 4.0 with the introduction of the Bluetooth Low
odically changing, randomized address instead of their Energy (BLE) standard also known as Bluetooth Smart.
permanent Media Access Control (MAC) address. In BLE allows device manufacturers to use temporary ran-
this work we show that many state-of-the-art devices dom addresses in over-the-air communication instead of
which are implementing such anonymization measures their permanent address to prevent tracking [38]. How-
are vulnerable to passive tracking that extends well be- ever, these anonymization features are defined in a way
yond their address randomization cycles. We show that that leaves a certain degree of flexibility to manufactur-
it is possible to extract identifying tokens from the pay- ers. The optionality of such privacy protecting features
load of advertising messages for tracking purposes. We is of special relevance, as the BLE standard was de-
present an address-carryover algorithm which exploits signed specifically to support low-energy devices such as
the asynchronous nature of payload and address changes smart watches and other wearable devices, which are an
to achieve tracking beyond the address randomization of attractive target for adversarial tracking of their users.
a device. We furthermore identify an identity-exposing BLE devices broadcast so-called advertisements on
attack via a device accessory that allows permanent, unencrypted, public channels in order to signal their
non-continuous tracking, as well as an iOS side-channel presence to other devices. Ideally, this public broadcast
which allows insights into user activity. Finally, we pro- contains all the required information to perform a de-
vide countermeasures against the presented algorithm vice function, while not leaking unnecessary private in-
and other privacy flaws in BLE advertising. formation about the device or its user. In some cases,
however, devices may broadcast data that exposes sen-
Keywords: Bluetooth, tracking, privacy, information
sitive details about themselves or even other devices.
leakage, side-channels, correlation attacks, traffic anal-
In this work, we show how even state-of-the-art
ysis.
devices such as Windows 10 computers and iPhones,
DOI 10.2478/popets-2019-0036 which do implement privacy protecting measures such
Received 2018-11-30; revised 2019-03-15; accepted 2019-03-16. as address randomization may be vulnerable to contin-
uous tracking. We first examine various types of ad-
vertising messages and identify so-called identifying to-
1 Introduction kens, which are unique to a device and remain static for
long enough to be used as secondary identifiers besides
Bluetooth technology has facilitated the ubiquity of the address. We present an online algorithm called the
instant wireless connectivity, ranging from personal address-carryover algorithm, which exploits the fact
connected accessories, to smart homes, and localized that identifying tokens and the random address do not
and personalized, location-based shopping experiences. change in sync, to continuously track a device despite
Since it was first adopted in mobile phones in the year implementing anonymization measures. To our knowl-
2000 [11], it has undergone five major Core Specification edge, this approach affects all Windows 10, iOS, and
revisions with numerous amendments [10]. macOS devices. The algorithm does not require mes-
In early versions of the Bluetooth specification, the sage decryption or breaking Bluetooth security in any
permanent Bluetooth MAC addresses of devices were way, as it is based entirely on public, unencrypted ad-
vertising traffic.
The Bluetooth 5 Specification extends usable com-
munication range to whole buildings or hundreds of
*Corresponding Author: Johannes K Becker: Boston
meters in line-of-sight transmissions [9, 26]. While the
University, E-mail: [email protected]
David Li: Boston University, E-mail: [email protected] tracking attack proposed in this paper considers track-
David Starobinski: Boston University, E-mail: [email protected] ing by a single adversary in such an operating radius,
 Tracking Anonymized Bluetooth Devices 51

previous work [22] suggests that local BLE tracking Bluetooth and Wi-Fi tracking concerns, as well as more
methods may be significantly compounded by coordi- BLE-specific techniques and utilities.
nating them in a botnet of adversaries, resulting in po- In 2007, Spill and Bittau [33] presented several
tentially global tracking capabilities. techniques for eavesdropping on Bluetooth 2.0 com-
The main contributions of this paper are as follows: munication using a GNU Radio-based Bluetooth snif-
fer and USRP software-defined radio hardware. Their
1. We describe a tracking vulnerability that affects work describes an approach for intercepting packets,
Windows 10, iOS, and macOS devices as long as and reverse-engineering all the parameters required to
they are continuously observed by the adversary. eavesdrop on Bluetooth communication [33]. However,
2. We develop a methodology that can be applied to these findings only concern the Bluetooth Classic im-
devices from various manufacturers, based on raw plementation, which is of decreasing relevance in light
BLE advertising log files. of BLE and Bluetooth 5.
3. We present an algorithm that allows tracking be- In 2015, Jameel and Dungen presented an open-
yond the address randomization of a device, and source library for scanning Bluetooth Low Energy (LE)
measure the resulting maximum tracking time and Active RFID advertising [24]. Their work sum-
(MTT). marizes different available Beacon protocols, which are
4. We identify other privacy vulnerabilities that exist proximity-based broadcast protocols [1, 18] and enable
on certain device types, which expose device identi- all kinds of localized interactions with smartphones and
fiers permanently via a peripheral, and which leak other Bluetooth devices via the BLE advertising chan-
activity information on iOS devices. nels. Furthermore, the authors published a library called
5. We provide recommendations and potential coun- advlib [29], which processes raw BLE advertising mes-
termeasures to the tracking vulnerabilities uncov- sages and decodes them into an open, portable data
ered in this work. format. This library enables software developers to eas-
ily integrate BLE advertising-based functionality into
The rest of this paper is structured as follows: Sec- their software, without having to manually decode low-
tion 2 discusses prior related work. Section 3 presents level protocols. The library further powers the open-
background information on the Bluetooth protocol nec- source “collaborative repository” Sniffypedia [30], which
essary to understand this work. In Section 4, we de- presents a large number of publicly known BLE adver-
scribe our adversarial model and the methodology used tising identifiers in a searchable and accessible format.
in this work, followed by the experimental setup in Sec- This platform can help classify Bluetooth device classes
tion 5. We present our results in Section 6, followed by for reconnaissance purposes, but does not offer device
recommendations for the avoidance of unwanted device tracking capabilities.
tracking in Section 7. We summarize our findings and Vanhoef et al. [34] present techniques to gain ac-
give an outlook on further research in Section 8. cess to permanent MAC addresses by exploiting probe
requests in Wi-Fi. They develop an algorithm which
relies on timing features and sequence numbers found
2 Related Work in Wi-Fi probe requests to identify devices regardless
of their MAC address. They further describe a variant
Privacy and security concerns over Bluetooth date back of the Karma Attack – exploiting the fact that many
to its very first release [23]. Anonymizing devices in pub- devices will expose information to supposedly known
lic channel communication only became available with and trusted networks [13] by creating a catch-all access
the introduction of BLE in Bluetooth 4.0 [6]. A lot of re- point [14] – which creates large numbers of popular Wi-
search regarding the effectiveness of MAC address ran- Fi networks in order to invite devices to connect, often
domization is focused on Wi-Fi, where the same privacy presenting their permanent MAC address in a suppos-
concern of broadcasting permanent identifiers exists, edly trusted context.
but vulnerabilities are often not easily transferable to Issoufaly and Tournoux [22] show that despite the
the Bluetooth case as they are based on different areas existence of privacy-preserving MAC address random-
specific to the Wi-Fi network stack. We will highlight ization in Bluetooth 4.0 LE, not all devices make use
some important works relating to more general cases of of this functionality and are therefore vulnerable to
tracking. Furthermore, they showed how maliciously
distributing suitable tracking software to a number of
 Tracking Anonymized Bluetooth Devices 52

mobile devices – a “BLE Botnet” – extends tracking

Scanning
capabilities far beyond the local transmission range of
regular Bluetooth communication. Combining BLE pri-
vacy with the notion of a potentially global botnet mo-
tivates our work as it extends the privacy threat from Advertising Standby Initiating
local presence detection to large-scale location tracking,
Sla r
which would be realistic to implement for nation-state ve ste
Ma
actors. While Issoufaly and Tournoux focus on track- Connection
ing devices that use static device addresses, our work
focuses on tracking devices that use dynamically ran-
Fig. 1. The Link Layer State machine [20, p. 15].
domized addresses. These addresses change depending
on regeneration parameters set by their manufacturers.
Along the same line, Martin et al. [27] show that 3.1 Physical Layer and Link Layer
MAC address randomization is often defeated by not be-
ing implemented properly or consistently, partly build- BLE operates on 40 physical channels spaced in 2 MHz
ing upon previous approaches [34]. Furthermore, they steps from 2402 MHz to 2480 MHz [8, p. 2535f.]. Three
show flaws in the address randomization of Android of these channels are so-called advertising channels at
phones, which allow the deduction of device types via 2402 MHz, 2426 MHz, and 2480 MHz – frequencies with
address prefixes, as well as their global MAC address minimal interference with other 2.4 GHz band traffic
via information found in broadcasted WPS attributes. (notably Wi-Fi) [24]. These channels are used to broad-
They also identify a control frame attack that exposes cast advertising messages, which may be simple pe-
the permanent Wi-Fi MAC address of a device with riodic, presence announcements, scanning requests to-
100% success rate [27, p. 280]. Our approach differs in wards other devices, beacons containing location-based
that we do not retrieve information through reversal metadata, and other public broadcast-type informa-
of hashes or other reverse-engineering methods, and we tion. The remaining channels are used primarily for
use entirely passive sniffing to generate insights which data transmissions between paired devices and employ a
allow device tracking. Our tracking method, based on pseudo-random channel hopping scheme, which is nego-
extracting identifying tokens in the payload of advertis- tiated between the two connected parties upon connec-
ing messages, leverages specific Bluetooth features and tion to avoid interference with other ISM band traffic.
differs from this previous line of work. On the link layer, Bluetooth defines different states,
shown in Figure 1. In the Advertising state, the link
layer creates Advertising Events which are broadcasted
on all advertising channels. These events contain differ-
3 Background ent types of Payload Data Units (PDU)1 . In our work,
the following PDU types are relevant:
Bluetooth is a wireless communication protocol on the
2.4 GHz ISM band. Our focus lies on the Low En- – the Connectable Directed Event using the
ergy specification, which was introduced in 2010 with ADV_DIRECT_IND PDU, which invites a specifically
Bluetooth 4.0 [6]. Bluetooth LE (BLE) is optimized addressed device to initiate a connection.
for small, often battery-powered devices with relatively – the Connectable and Scannable Undirected Event
strict energy restrictions, like connected wearables, wire- using the ADV_IND PDU, which allows any device
less smart sensors, or computer accessories like digital to respond with scanning requests or connection re-
pencils. The Bluetooth 5 Specification adds various fea- quests.
ture and performance improvements, notably a larger
communication range [9], which allows for up to 780 me- In the Scanning state, the link layer receives adver-
ters of line-of-sight connectivity [26]. tising messages without responding (passive scanning)
We focus on introducing the elements that are es- or responds with scan requests to inquire about further
sential for the experiments described in the following
Sections. We refer to Heydon [20, p. 7] for a general
high-level introduction to the Bluetooth 5 architecture
1 The full list of advertising event types and corresponding PDU
and the Bluetooth 5 Core Specification for details [8].
types can be found in [8, p. 2609, Table 4.1].
 Tracking Anonymized Bluetooth Devices 53

0 8 40 56 bit address 0 48 bit address

Access Address (4 byte)

PDU Header (2 byte)

AdvA TargetA
Preamble (1 byte)

(6 bytes) (6 bytes)

PDU Payload CRC

a)
(1-255 byte) (3 byte) Fig. 3. The PDU Payload format for the ADV_DIRECT_IND PDU
Type contains an Advertising Address (AdvA) and a Target Ad-
dress (TargetA). [8, p. 2570.].

0 48 bit address
0 4 5 6 7 8 bit address AdvA AdvData
a)
RxAdd (1 bit)
TxAdd (1 bit)
ChSel (1 bit)
RFU (1 bit)

(6 byte) (0-31 byte)

PDU Type Length
b)
(4 bit) (8 bit) 0 32 bit address

AD Structure 1 AD Structure 2 AD Structure n

b) ...
(≥ 3 byte) (≥ 3 byte) (≥ 3 byte)
Fig. 2. The BLE advertising packet format (Fig. 2.a)) and the
Advertising Channel PDU Header (Fig. 2.b)) [8, p. 2562, 2567].
0 8 16 bit address

AD Type (n byte)
Length (1 byte)
device details (active scanning) [8, p. 2633]. In the Ini-
tiating state, the link layer listens for advertising mes- AD Data
sages, and sends Connect Requests to advertising de- c) (Length − n byte)
vices. If the requested device responds, the devices can
enter a Connection state [8, p. 2637].
In the Connection State, devices implementing the
Fig. 4. PDU Payload format for ADV_IND and ADV_NONCONN_IND
so-called Central role can connect to up to 8 Periph- PDU Types (Fig. 4.a)), the AdvData format (Fig. 4.b)), and the
eral role devices as their Master, while Peripheral de- AD Structure format (Fig. 4.c)) [8, p. 2086, 2569ff.] [4].
vices can connect to one Central role device as a Slave.
Smartphones or PCs are typical Central role devices
vertising channel PDU itself consists of a header and
connecting to multiple wireless input devices, activity
a payload depending on the PDU Type defined in the
trackers or other wireless sensors. However, devices may
header [8, p. 2567] (see Figure 2.b)).
implement both roles and may therefore send advertis-
The PDU Payload of a directed advertising event
ing messages (Peripheral role) while scanning for adver-
contains an Advertising Address (AdvA) and a Target
tising messages (Central role)2 . In our work, we observe
Address (TargetA), as shown in Figure 3. Only devices
devices which are in the Advertising state using an ob-
with the matching Target Address can initiate a con-
server device which is in the Passive Scanning state.
nection by sending a Connect Request.
Indirected advertising allows any device receiving
the PDU to respond with a Scan Request (requesting
3.2 Advertising Packet Format
information about available features) or a Connect Re-
quest. The PDU Payload for this type of advertising is
We next provide details on the structure and contents
formatted as shown in Figure 4, containing an Advertis-
of advertising packets, since those will be exploited to
ing Address (AdvA) and Advertising Data (AdvData),
track and distinguish between different devices. Adver-
which may contain one or more AD Structures (see Fig-
tising packets follow a structure shown in Figure 2.a),
ures 4.b). Finally, AD Types define the content of the
consisting of a preamble, an Access Address (AA)3 , a
AD Data contained in each AD Structure (Figure 4.c).
Payload Data Unit (PDU) and a CRC field. The ad-
An overview of some AD Types that we will use
later in this paper is shown in Table 1, we refer to [4]
for the full list.
2 I.e., a BLE device can be in more than one state shown in
Most AD Types define simple numbers or strings.
Figure 1 at the same time.
3 The access address is always 0x8E89BED6 for advertising pay-
The Manufacturer Specific Data type is worth highlight-
loads [8, p. 2563]. ing, as it gives device manufacturers the flexibility to
 Tracking Anonymized Bluetooth Devices 54

0 8 16 32 bit address vice hardware, making them a vulnerability to long term

Manufacturer
Length 0xFF Manufacturer Data tracking if used in public communication.
ID
(1 byte)(1 byte) (Length − 3 byte) Random addresses (TxAdd = 1) may be static, in
(2 byte)
which case they are randomly generated whenever the
Fig. 5. The Manufacturer Specific Data AD Structure format device reboots or remain with the device permanently,
[3, 7]. which makes them vulnerable to long-term tracking.
Random private addresses prevent address-based track-
AD Type Name Description ing by regenerating periodically, essentially anonymiz-
0x01 Flags BLE capability flags ing the device identity [38]. Such random private ad-
0x06 List of 128-bit Service globally unique identifier dresses may either be an unresolvable address made of
Class UUIDs for a certain device service a random number, or they may be resolvable to a per-
0x09 Complete Local Name Device “friendly name”
manent address by trusted devices holding an Identity
0x16 Service Data Service UUID as per [5]
0xFF Manufacturer Specific custom data structure con- Resolving Key (IRK). This can be used to send directed
Data tainer (see Figure 5) advertising to a specific device without broadcasting its
permanent address in the clear and is further discussed
Table 1. An overview of some relevant AD Types [4] [8, Vol. 3, in Section 7 containing our Recommendations. Resolv-
Part C, Sections 8.1, 11.1, and 18] [7, Part A, Section 1]. able and unresolvable random addresses can be distin-
guished by their two most significant bits being set to
define further data structures within the AD Data field. 0b01 and 0b00, respectively [8, p. 2558].
Figure 5 shows a Manufacturer Specific Data AD Struc-
ture. This AD Type allows manufacturers to develop
their own advertising-based protocols that live within 4 Methodology
this data4 , which may contain data that our proposed
algorithm exploits.
4.1 Adversarial Model

This paper aims to uncover potential security and pri-

3.3 Advertising Addresses vacy flaws in BLE devices, as they appear “in the wild”.
We consider a local adversary 5 in the scanning link
The Bluetooth architecture generally refers to devices
layer state (see Section 3.1). As such, it is a passive,
that transmit advertising packets as advertisers. Devices
external adversary which reads continuously, but never
listening to advertising packets are referred to as scan-
adds, removes, or modifies ongoing BLE adversary traf-
ners if they listen without intention of connecting, and
fic. Specifically, the adversary never sends scan requests
as initiators if they intend to make Connect Requests
or connect requests, and remains entirely passive dur-
in response to suitable advertising events [8, p. 170].
ing the attack, i.e., there is no bi-directional interaction
The Advertising Address shown in Figures 3 and 4 is
with the target device. We assume that the adversary
the 48-bit MAC address of the advertiser transmitting
is capable of monitoring the ongoing advertising traffic
the advertising packet. This address may be a public
in order to be aware of changes in advertising messages
or random address depending on the TxAdd flag in the
as they occur over time.
PDU Header (see Fig. 2).
We do not make any assumptions about the victim
A public address (TxAdd = 0) is the standard IEEE-
devices, other than Bluetooth being turned on. Note
assigned 48-bit MAC address obtained from the IEEE
that devices may implement the Peripheral and Central
Registration Authority, in which the 24 least significant
roles at the same time, and thus remain in advertis-
bits are manufacturer-assigned, while the 24 most signif-
ing state for the Peripheral role despite ongoing connec-
icant bits represent the IEEE-assigned company ID [21].
tions as a Master device. Thus, the ability of tracking
These addresses are permanently attached to the de-
smartphones or computers via passive tracking mainly
depends on whether they implement the Peripheral role.

4 Widely adopted manufacturer-specific data protocols are the

Apple iBeacon protocol [1] or other open protocols like Google’s 5 Emphasized terms in this Section in line with the definitions
Eddystone [18] and Radius Networks’ AltBeacon [28]. of privacy metrics given in [37, Section 4].
 Tracking Anonymized Bluetooth Devices 55

The adversary only needs to observe Bluetooth ad- guish from a targeted user u [37, p. 57:9] [32, p. 5], i.e.:
vertising messages (which are sent in plain text), i.e.,
the adversary does not require the capability to read en- |ASu | = number of users indistinguishable
crypted data transmissions or follow channel hopping. from user u. (1)
The adversary implements a sniffing device (in our case,
The primary metric of interest in this paper is the
a Software-Defined Radio (SDR)) which listens to one
Maximum Tracking Time (M T T ), which is defined as
of the Bluetooth advertising channels (i.e., channels 37,
the cumulative time that a user u can be uniquely iden-
38, or 396 ). The packets are then broken down into their
tified [37, p. 57:30] [32, p. 5], that is:
elements as defined in the Bluetooth specification (see
also Figure 2) and further analyzed for any observable M T Tu = time during which |ASu | = 1
data which could be used to compromise user privacy.
for a user u. (2)
As advertising messages are sent in the clear and are
not authenticated, proving authenticity and integrity of We show that several types of devices have un-
an advertising message is not easy in most cases. As bounded M T T .
such, the methodology used in this paper considers be-
nign communication by devices which are oblivious to
potential privacy issues in their advertising patterns, 4.3 Device Tracking Algorithm
i.e., they neither forge the contents of their messages
nor change the traffic patterns for their messages in or- We propose a two-phase algorithm which allows track-
der to obfuscate their identity. ing of devices beyond their address randomization. The
This work assumes that an adversary will at some algorithm consists of an offline pre-processing phase and
point make a connection between an arbitrary identifier an online tracking phase.
in an advertising event and its real-world associated de-
vice, and will then continuously observe ongoing BLE
advertising traffic in order to track it without the user’s 4.3.1 Phase 1: Pre-Processing
consent for the longest time period possible. Adversary
success is defined as the adversary being able to hold on The pre-processing phase uses recorded log files con-
to a device identity beyond its address randomization taining decoded BLE advertising packets (see Figure 2)
using local, passive, continuous observation. and their PDU Payloads in raw format. All collected log
In this paper, we use the terms user and device syn- files are processed offline in order to identify potential
onymously. We assume that devices are being tracked identifying tokens occurring in advertising messages. An
with the intent of tracking their users, and the ability identifying token can be any sequence of bits contained
to track a device implies the ability to track its user. in an advertising message which allows distinguishing
We therefore do not consider devices that are shared one device from another – be it by design (such as the
between multiple users and would require such a logical advertising address) or by a side effect. As a general
distinction. rule, an identifying token for a given device should re-
main fixed over a certain period of time, while being
unique to one device (i.e., its values should not collide
4.2 Privacy Metrics with values produced by other devices within range over
time).
The applied metrics focus on the adversary’s ability to The set of useful identifying tokens for a class of de-
track a device over time due to some observable signa- vices depends on its operating system and other device-
ture. Specifically, let the anonymity set size ASu rep- specific hardware or software features, as all of these
resent the set of users that an adversary cannot distin- factors determine the structure and content of advertis-
ing messages.
In this sense, a universal MAC address [21, p. 22f.]
is a perfect identifying token as it is guaranteed to be
unique to a device, and is permanently linked to a de-
6 It is assumed that any of the available advertising channels vice. In a local context, these requirements can be re-
can be considered equivalent as advertising events are usually laxed as long as the distinction between the devices in
broadcast to all three channels in a round-robin fashion. range is still possible with high confidence.
 Tracking Anonymized Bluetooth Devices 56

Identifying tokens may be found either by look- D beyond the point where it randomizes its advertising
ing at the raw PDU Payload and isolating a byte se- address.
quence which fulfills the requirements laid out above, If the incoming message contains the right identify-
or by breaking down the PDU Payload according to the ing tokens for the class of devices that D belongs to, the
Bluetooth protocol specification and identifying suitable tokens are extracted (line 4). Then, if the incoming ad-
metadata elements. vertising address is identical to the existing advertising
In order to avoid collisions between identifying to- address (addr), we still know the device identity and
kens, it is important that the bit length n of the identi- we update the stored values of the identifying tokens
fying token be large enough. Formally, suppose an ad- if any changes are detected (line 7). Otherwise, if the
versary aims to track a Bluetooth device over a certain advertising address has changed, a match is attempted
period, say a week, in an area containing at most m using any of the available identifying tokens as a pseudo-
other Bluetooth devices with the same types of identify- identity – in case of a successful match, the address of
ing tokens (devices with different identifying tokens are device D can be updated with the incoming address and
trivial to distinguish). Furthermore, suppose that each address-carryover was successful (line 11). In either of
device changes its identifying token at a rate no faster these cases, the timeout counter is reset to indicate that
than once every 15 minutes (based on our experimental the device D is being tracked successfully. If neither ad-
data, 15 minutes appears to be an upper bound on the dress nor identifying token matches succeed for a certain
frequency of changes of identifying tokens). This means period of time Tmax , it is assumed that device tracking
that the targeted device will generate at most k = 672 has failed and the algorithm terminates.
tokens in a week. The algorithm requires an amount of memory and
Assume that each identifying token is generated computation that are linear in the size of the set of
uniformly at random (a reasonable assumption based identifying tokens. Since there is only a handful of iden-
on our experimental data). The probability that an- tifying tokens, the algorithm can be run in real-time
other Bluetooth device produces tokens that do not con- without limitation.
flict with one of these k tokens is at least (1 − k/2n )k .
Hence, the probability that all the other m devices pro-
duce different tokens than the targeted device is at
least (1 − k/2n )mk ≥ 1 − mk 2 /2n , where the latter
5 Experimental Setup
inequality is obtained by applying Bernoulli’s inequal-
The experimental setup used in this work consists of
ity [17]. Therefore, by choosing 1 − mk 2 /2n ≥ 1 − p or
monitoring one of the BLE advertising channels for a
n ≥ dlog2 (mk 2 /p)e, we can ensure a collision probabil-
certain amount of time and analyzing the content of
ity smaller than p. As an example, for m = 1000 devices
advertising events that are broadcast by devices within
and p = 10−3 , we obtain n ≥ 39 bits. Consequently,
typical Bluetooth proximity.
identifying tokens that have a length of at least 40 bits
We use a modified version of Xianjun Jiao’s SDR-
(i.e., 5 bytes), satisfy this inequality.
based BLE sniffer [25] for all experiments. The col-
Note that performing pre-processing is only re-
lected log files contain advertising messages according
quired once per device class. Once a suitable set of iden-
to Figure 2, with all metadata decoded and the PDU
tifying tokens has been found for a class of devices, it
payload in raw hexadecimal ASCII characters. In the
can be applied to track any individual device in this
pre-processing phase, we decode them according to the
class.
structure shown in Figures 2, 4, and 5, where applica-
ble. The system used for all experiments is based on a
Ubuntu Xenial-based PC and the HackRF One SDR.
4.3.2 Phase 2: Tracking
We chose to use an SDR-based Bluetooth sniffer
over a sniffer based on the regular Bluetooth stack to
The address-carryover algorithm (Algorithm 1) is
remain independent of variations in Bluetooth imple-
an online algorithm that continuously observes changes
mentations on different hardware and OSes, to be able
in the address as well as any other relevant identifying
to observe raw data which is typically discarded by the
tokens found in the pre-processing phase.
low-level network stack, and in order to facilitate future
The algorithm listens to incoming advertising mes-
consideration of physical layer metrics in our research.
sages mi as they are broadcast on one of the BLE adver-
tising channels with the goal of tracking a target device
 Tracking Anonymized Bluetooth Devices 57

Algorithm 1: Address-carryover algorithm

Input : stream of advertising messages m1 , m2 , . . .
Variable : addr is an advertising address for device D
Variable : A is a list of identifying tokens [a1 , a2 , ...] for device D
Variable : Tmax is the maximum time tracking will be attempted
Variable : timeout is a time counter
Initialize: addr to the current random address of the target device D, A to the currently broadcast
values of A for device D. Set timeout to zero and begin counting.
1 while timeout < Tmax do
2 receive message mi ;
3 if message mi contains at least one identifying token then
4 extract incoming addr all contained identifying tokens from message mi ;
5 if incoming addr = existing addr then
6 if any incoming token values differ from existing token values in A then
7 update A to reflect new values of tokens;
8 reset timeout ; // D is known (address unchanged)
9 else unknown address:
10 if the value of any identifying token in mi matches the corresponding value in A then
11 addr := incoming address;
12 update A to reflect new values of tokens;
13 reset timeout; // D is known (address carried over)
Result: Successfully tracked device D, new address is <addr>.
14 end
/* timeout exceeds T_max: D is lost */

However, advanced knowledge of SDR is not required 5.1 OS Advertising

for this paper.
Once we ensure that Bluetooth is enabled, the de- This scenario describes BLE advertising events which
vice is allowed to go to lock screen or be casually used, are periodically transmitted by an operating system
i.e., we do not require the Bluetooth settings to remain when a device is in a Bluetooth-enabled state, with-
open during the attack. The sniffer passively listens to out being triggered by a particular user action. In this
Bluetooth advertisements and does not actively engage scenario, the observer passively listens to a Bluetooth-
in communication. We perform four weeks worth of 1- enabled device while it is active for a certain amount of
2 hour long daily recordings and additional 15 longer time. During our daily recordings over the period of four
recordings ranging from 5 hours to multiple days. weeks, we identify whether advertising messages contain
We consider two types of advertising messages: long-term static components.
We examine the following types of devices – all of
OS Advertising, i.e., regular BLE advertising activ- which are owned and operated by the authors:
ity for each considered OS (Section 5.1).
Accessory Activation, i.e., traffic originating from Windows 10 devices. We passively record advertis-
typical BLE-based accessories (Section 5.2). ing events, while the Bluetooth in Windows 10 is en-
abled. We measure data generated by one Microsoft
Note that the sniffer also records advertising mes- Surface Pro 5, two laptops and one desktop PC from
sages of other (non-tracked) devices in proximity, which other OEMs, all running an up-to-date Windows 10.
are ignored. macOS and iOS devices. We passively record ad-
vertising events, while Bluetooth in macOS / iOS
is enabled. Additionally, the Airdrop sharing fea-
ture is launched on the respective devices, and the
resulting advertising events are recorded. We mea-
sure data generated by various up-to-date iPhones
 Tracking Anonymized Bluetooth Devices 58

(iPhone 5s, iPhone 8, iPhone X, running iOS 11), OS Prevalent Type Prevalent Content
two iPads (iPad, iPad Pro running iOS 12), and Windows 10 ADV_NONCONN_IND Company Identifier 0x0006
two Macs (iMac A1419 and Macbook Pro A1502 macOS, iOS ADV_IND Company Identifier 0x004c
Android SCAN_REQ Target Address
running macOS 10.13).
Fitbit ADV_IND Fitbit Service Class UUID
Android devices. We passively record advertising Surface Pen ADV_DIRECT_IND Target Address
events, while Bluetooth in Android is enabled. We
measure data generated by two different Android Table 2. Typical advertising features per operating system.
devices (Samsung Galaxy S5, Google Nexus 4).
Smartwatches. We connect each smartwatch to its
respective app on a smartphone and then deacti- 6 Results
vate Bluetooth on the smartphone. This triggers
the smartwatch to advertise its presence. We sample 6.1 Pre-Processing
data from two Fitbit Charge 2 smartwatches inter-
mittently over the course of multiple months. Ad- In the pre-processing phase, we seek to identify suitable
ditionally, one of the smartwatches is subjected to identifying tokens which may be used to track devices
both a restart and a factory reset to find out if these beyond their address randomization.
actions affect its behavior. Operating system vendors implement widely differ-
ing strategies when it comes to implementing Bluetooth
advertisements, driven by overall system architecture
5.2 Accessory Activation and ecosystem considerations. Therefore, different op-
erating systems behave in different ways in order to an-
This scenario describes advertising events triggered by nounce their presence to nearby devices, and the OS
the use of BLE-based accessories. Our work considers origin is typically easily distinguishable by some high-
two types of touch-sensitive BLE-enabled pencils. level features in the broadcasted advertising messages.
Identifying the major OS vendors and device types
Microsoft Surface Pen. The Microsoft Surface Pro is fairly straightforward, as Apple and Microsoft de-
tablet can be used with a Microsoft Surface Pen. vices advertise using manufacturer-specific data, which
This digital pen is connected to the device via BLE is always prepended by an officially assigned Com-
in order to transmit pressure sensitivity data and pany ID [3]. In other cases where this approach is not
furthermore transmit signals from its two buttons. used, the vendor can typically be found out by in-
Our experiment consists of disconnecting and re- specting other specific characteristics like Service Class
connecting the pen in order to clarify whether the UUIDs [7, pp. 10, 12f., 18] or Service UUIDs [5].
Surface Pro, or the pen use a static address or oth- The advertising message features shown in Table 2
erwise leaks privacy-relevant information. Further- allow for such a high-level classification of messages
more, we examine the effect of button actuation for based on the considered devices.
the same goal.
iPad Pro Pen. The iPad Pro can be used with the
Apple Pencil pen. This pen is connected to the iPad 6.1.1 Windows 10 devices
via BLE in order to transmit pressure sensitivity
data. Our experiment consists of disconnecting and Windows 10 devices typically advertise a PDU Payload
reconnecting the pen in order to find out whether with only a single AD Structure of type Manufacturer
the iPad Pro, or the pen leak any privacy-relevant Specific Data, as shown in Figure 6.
information. After recording for an extended period of time, we
find the advertising address to regenerate approximately
every 960 seconds, i.e., giving an adversary an average
tracking time of approximately 16 minutes based on the
address until the device is lost. This shows that Win-
dows 10 implements random private addresses (see Sec-
tion 3.3).
The Manufacturer Specific Data contained in the
payload starts with the Company Identifier for Mi-
 Tracking Anonymized Bluetooth Devices 59

AdvA: <48bit random address> AdvA: <48bit random address>

AdvData: 1 AD Structure: AdvData: 2 AD Structures:
0xFF → Manufacturer Specific Data: 0x01 → Flags: 0x1a
Company Identifier: 0x0006 → “Microsoft” 0xFF → Manufacturer Specific Data:
Data: <27 bytes of data> Company Identifier: 0x004c → “Apple”
Data: (nearby or handoff or both)
nearby (0x10) <5 bytes of data>
Fig. 6. A a typical Windows 10 advertisement PDU Payload,
handoff (0x0c) <14 bytes of data>
containing a single "Manufacturer Specific Data" AD Structure
(see Figure 5).
Fig. 7. A a typical Apple device advertisement PDU Payload,
containing a single "Manufacturer Specific Data" AD Structure
crosoft [3] 0x0006 and 27 bytes of proprietary data (see (see Figure 5).
Figure 6), comprised of four fixed bytes followed by 23
variable bytes7 . The first fixed bytes do not differ be- Description iBeacon AirDrop Airpods Airplay Handoff Nearby
tween computers, i.e., they are not suitable to be used as Source
identifying tokens. The 23 variable bytes, however, ap- Type 0x02 0x05 0x07 0x0a 0x0c 0x10
pear uniformly random and, in fact, seem to be unique Occurrence 4,762 4,649 2,151 13,846 79,001 87,598

per device.
Furthermore, the payload is observed to remain
Table 3. Occurrences of the most common data types observed in
static for approximately one hour. We observed no iOS/macOS advertising messages.
differences in advertising behavior between the ob-
served devices that would indicate manufacturer-
specific, rather than OS-specific behavior. We therefore types. Of the data types observed, the nearby and hand-
retain the following identifying token for Windows 10 off types are by far the most frequent.
devices: The handoff data structure consists of 14 bytes of
data, in which the first bytes seems to be always zero
AW in10 = [Manufacturer Specific Data[-23:]]. (3) and the remaining bytes may take arbitrary values. This
data structure changes its value based on multiple fac-
tors, some of which we identify in Section 6.3.2. None
6.1.2 Apple (macOS and iOS) Computers and of the observed values showed collisions between devices
Smartphones and the data has a sufficient length, making this a good
candidate for an identifying token.
MacOS and iOS devices regularly advertise their pres- The nearby data structure consists of 5 bytes of
ence as well. The advertising rates in macOS and iOS data. Within these 5 bytes, the first two bytes do not
are much higher than in Windows 10, at up to two ad- seem to be fully random, reducing our useful length be-
vertising events per second. Address lifetimes are highly low the threshold set in Section 4.3.1, i.e., the number of
variable, ranging from seconds up to around two hours bits is smaller than what we would want to avoid iden-
in rare edge cases, with an average of around 20 minutes. tity collisions. In practice, we have not observed values
The typical message format contains, similar to colliding, and have successfully been using nearby data
the Windows 10 payload, a manufacturer-specific data in our experiments as a second token to the handoff
field. However, Apple devices can be further distin- data. We conclude that while it is of practical useful-
guished by advertising an additional flags data struc- ness to our algorithm, it should not be relied on as a
ture which Windows 10 does not use (see Figure 7). The single identifying token.
manufacturer-specific data may contain one or more of Clearly, types of data which rarely appear in adver-
Apple-specific data types, which are used for specific tising messages are not suitable identifying tokens. We
functionality in iOS and macOS which is facilitated by therefore consider the nearby and handoff data struc-
BLE. Table 3 shows an overview of the encountered data tures as the best candidates, since they appear an order
of magnitude more often than any other data type (see
Table 3).
An additional data type worth mentioning is the
7 Example payload:
Airdrop data type. Airdrop allows users to share files
|01092002 | {z }.
{z } d70d650aac181b8397b8588f3a62de55810d23db56f176 with a nearby friend using an Apple-specific combina-
fixed bytes variable bytes
 Tracking Anonymized Bluetooth Devices 60

well as some Device Information data (see Figure 8).

AdvA: <48bit random address>
AdvData: 3 AD Structures: The smartwatch advertises approximately once every 7
0x01 → Flags: 0x06 seconds using this format.
0x06 → Incompl.List of 128-bit Service Class UUIDs: While the TxAdd flag indicates that the devices use
adabfb006e7d4601bda2bffaa68956ba random addresses, the addresses actually never change
0x16 → Service Data:
(which has previously been analyzed in depth by Cyr et
uuid: 0x180a → “Device Information”
data: <5 bytes of data> al. [12] and Das et al. [16]). In the tracking section, we
provide some additional insights on this behavior, since
such permanent trackability raises considerable privacy
Fig. 8. A typical Fitbit PDU Payload (relevant AD Types are
defined in [7, p. 10,p. 12f.,p. 18]). concerns.
The advertised 128-bit Service Class UUID
adabfb006e7d4601bda2bffaa68956ba is specific to the
tion of Wi-Fi and Bluetooth for peer-to-peer file trans- watch model [30, 35], and is identical for the two
fer. Airdrop produces a significant amount of advertis- recorded watches. Service Class UUIDs are therefore not
ing events, which are triggered whenever a user taps or suitable identifying tokens, as their value does not iden-
clicks a native share button in the respective OS. Inter- tify individual devices.
estingly, Airdrop uses a separate randomized advertis- The Device Information data seems to be differ-
ing address for this purpose, which cannot be associated ent for different smartwatches8 , and changes over time
with the regular address used for other advertising – in the scale of weeks or months. We observed changes
making it unsuitable as an identifying token. within one device which only concerned a single bit in
Overall, we observed no differences in advertising the Device Information data, whereas differences be-
behavior between the observed iOS or macOS devices tween the observed devices differed in 7 different bits.
that would indicate noteworthy behavioral differences More measurements on different devices would have to
between iOS 11, 12, or macOS 10.13. We therefore retain be conducted to conclude its fitness as an identifying to-
the identifying tokens ken – given the above-mentioned trivial case of a never-
changing address, we did not explore this further.
AApple = AiOS = AmacOS = [nearby, handoff].(4)

6.2 Device Tracking

6.1.3 Android smartphones

Applying phase 2 of the algorithm reveal that multi-

We observed Android advertising addresses to change in
ple classes of devices are vulnerable to tracking beyond
intervals of about 15-45 minutes. However, the observed
address randomization.
Android smartphones use a completely different adver-
Windows 10 devices are vulnerable to the
tising approach than Windows or iOS/macOS, making
address-carryover algorithm because the advertising ad-
them immune to the address-carryover algorithm. The
dress and the identifying token AW in10 ’s value changes
tested Android phones never send out manufacturer-
occur at different intervals and out of sync. This allows
specific data or other potentially device-identifying data
the algorithm to either update the payload while the
in regular intervals. Instead the OS scans for advertise-
address is known, or vice versa. Figure 9 shows how we
ments of other devices when the Bluetooth settings are
are able to track the device with the initial advertising
opened by the user. Due to the lack of active, contin-
address 1da6aa6d7b4e and associate it with the device
uous advertising, identifying tokens cannot be assem-
2662e1021647 almost four hours later, and after 12 ad-
bled, making the observed Android devices immune to
dress randomizations. The longest observed M T TW in10
the carry-over algorithm.
is 11.2 hours of continous tracking. However, assum-
ing an always-on target device there is no clear upper
bound, i.e., M T TW in10 ∈ [11.2 hours, ∞).
6.1.4 Smartwatches

We analyze Fitbit smartwatches which use random ad-

dresses (according to their TxAdd flag) for advertising
8 We did not have access to a sufficient amount of watches of
and provide a constant 128-bit Service Class UUID as
this type to make a strong claim about its uniqueness
 Tracking Anonymized Bluetooth Devices 61

payload: d2f263ca...4b9cdc9a bd0810ce...f54dedfc dfdceea9...514feee1 4883de9d...cdc5fce7 3b53acb2...feffa92a

address: 1da6aa6d7b4e
0265aa31d96c
09940c1c007e
3980a7d67479
14ad7b127162
0029374df401
1ac7364f46cf
2f507edc63d8
049728a906d7
0b43fca53582
39e2218858c1
20891f7e96c7
3b567a4cade4
3e02757912e7
0dfc4c7aab34
2662e1021647

time
09:48:41

09:56:00

10:12:00

10:27:58
10:31:21

10:43:58

10:59:57

11:15:56

11:31:20
11:31:57

11:47:55

12:03:55

12:19:55

12:31:22

12:35:54

12:51:53

13:07:52

13:23:55

13:31:20

13:39:51
Fig. 9. An experiment illustrating the carry-over effect on Windows 10 devices. Asynchronous value changes allow updating the device
identity whenever it changes.

nearby: 0b1...e20

handoff: 003...10c 003...953 004...647

address: 488d4dbaa162 5f4cb95c9be6 50889aae1b43 40514e890446 7fb552cfec20

time
12:26:24
12:27:08
12:27:32

12:30:57
12:32:03

12:34:02
12:34:57
12:36:21

12:41:30

12:44:16

12:46:46
12:47:11
12:49:16
12:50:16
12:51:30

12:53:49

12:56:19

12:58:07
12:58:53
12:59:27

13:01:53

13:04:22
13:05:10

13:07:06
13:08:04

13:15:32

13:18:07
13:19:07
13:20:19
Fig. 10. This timeline shows address-carryover across 5 random addresses on iOS. The first three hops occur via the handoff identify-
ing token, the last one occurs via the nearby token. Different colors denote different values.

iOS or macOS devices have two identifying tokens is no user-accessible way to anonymize the device iden-
(nearby, handoff) which change in different intervals. In tity periodicity, we conclude that there is no upper limit
many cases, the values of the identifying tokens change for the trackability of a Fitbit smartwatch of the type
in sync with the address. However, in some cases the to- discussed, i.e., M T TF itbit = ∞.
ken change does not happen in the same moment, which Android devices do not appear to be vulnerable to
allows the carry-over algorithm to identify the next ran- our passive sniffing algorithm, as they typically do not
dom address. Figure 10 shows such a carry-over chain, in send advertising messages containing suitable identify-
which a device is trackable across five address random- ing tokens.
izations. In contrast to the Windows 10 implementation,
synchronized value changes appear to be more preva-
lent than asynchronous changes, the latter representing 6.3 Other Vulnerabilities
carry-over opportunities. M T TApple = 53 minutes is the
longest time we were able to track during our experi- This Section summarizes additional findings which do
ments; additional tests may yield a longer time. not directly result from the application of our algorithm,
Prior findings by other groups [12, 16] indicate that but were discovered in the process.
Fitbit smartwatches advertising addresses do not peri-
odically randomize. However, since the address carries
the flag indicating a random address, we seek to further 6.3.1 Accessory Activation
investigate its nature by subjecting the smartwatch to
different conditions which may trigger a new random We look into the effect of BLE-connected accessories,
address. Our tests include: specifically pencils of touch-enabled laptops and tablets.
The Microsoft Surface Pen has a button which
– Draining the battery; can be configured to launch the note-taking (or any
– Performing a hard reset; other) application to facilitate activities which make use
– Performing a factory reset. of handwritten input. Whenever that button is pressed,
the pen sends an ADV_DIRECT_IND request to its con-
None of these measures resulted in a change of the ob- nected Surface device. These types of messages contain
served advertising address, leading to permanent non- the device’s own advertising address as well as the tar-
continuous trackability despite active attempts to re- get address. In the case of the Surface Pen, this target
generate the address. Hence, by confirming that there address uses the public static address of the device it is
 Tracking Anonymized Bluetooth Devices 62

handoff: 004b16627c02. . . 004c169f562d. . .

AdvA: <48bit random address> nearby: 031c6b0e3b 0b1c6b0e3b 031c6b0e3b 0b1c6b0e3b
AdvData: 2 AD Structures: time
0x01 → Flags: 0x06 unlock phone lock phone unlock phone lock phone
0x09 → Complete Local Name:
“Apple Pencil<13 Unicode Nullbytes>”
Fig. 12. The handoff data structure appears whenever an iOS
Fig. 11. Apple Pencil advertising during connection procedure.. device is unlocked.

handoff: H1 H2 H3 H4 H5
associated to. The Surface Pen also features a magnetic nearby: 0b1c6b0e3b
time
connector which allows it to be attached to the Surface. open link #1 link #2 link #3 close
When the Surface Pen is detached from the Surface, it
sends the same kind of address-leaking directed adver-
Fig. 13. The handoff payload changes correlate closely with cer-
tising as well.
tain user activity on iOS.
This means that even if the Surface computer itself
never discloses its public static address, the pen will ex-
pose it. The fact that it is a permanent identifier leads sages containing the handoff data structure every time
to the Surface computer being trackable permanently an iPhone is unlocked.
via active probing. Once the public address becomes The handoff feature on macOS and iOS devices al-
known, an adversary could periodically probe the Sur- lows a user to continue one activity on another device.
face device directly using its permanent address. The For example, it allows browsing a website on an iPhone
response to such a directed advertising message (or ab- and then continuing to browse it on a computer running
sence thereof) results in indefinite presence tracking of macOS, when the two devices are in proximity. As such,
the Surface device, i.e., M T TSurf ace,leaked = ∞. this feature is inherently dependent on content and con-
We tested whether the Apple Pencil has similar text of the user activity. It can be shown that handoff
issues, but it uses an entirely different approach. When data changes highly correlate with user navigation using
it first connects to an iOS device, it emits a short burst the Safari browser in iOS (see Figure 13).
of ADV_IND messages containing a random address, ca-
pability flags and a Complete Local Name field of value
Apple Pencil (see Figure 11). After this initial advertis-
ing, the pen does not emit any advertising messages as
7 Recommendations
long as it is paired with the iOS device. Every time the
Device implementations should follow a few simple rules
pen is set up again, the random address changes.
in order to protect themselves against address-carryover
tracking.

6.3.2 Activity Side-Channel on iOS Synchronize payload changes with address ran-
domizations. If the advertising message payload
The handoff data structure only appears in certain pat- contains any type of data that could be used as an
terns. Closer inspection reveals the following two char- identifying token (see Section 4.3.1), the payload
acteristics: should change in sync with the address to prevent
extended tracking. While there may be technical
– The handoff payload is triggered when a device gets
reasons for keeping certain payloads around longer
activated;
than the default address randomization frequency
– The handoff payload changes depending on context
of a given operating system, it should be ensured
or content of the active application.
programmatically that there is no continuous car-
Both of these characteristics present a side channel ryover, as shown to be the case in Windows 10 and
which allows a passive observer to deduct activity pat- to a certain degree in iOS and macOS.
terns of the user using the target device. Figure 12 Implement address randomization for low-
illustrates the presence of a burst of advertising mes- powered devices. For some devices, especially
wearables and other battery-powered sensor de-
vices, frequently randomizing the address may be
 Tracking Anonymized Bluetooth Devices 63

at conflict with energy constraints. In these situ-

State 6= Disable
ations, device states which are not concerned by Bluetooth yes yes
start Connec- Bluetooth
active?
these constraints should be leveraged to change the tion? Device
address, e.g., when charging the battery or when a no
no
power cycle or other maintenance activity is per-
formed. For example, wearables typically have to be Enable
Timeout
stop Bluetooth
recharged weekly or even every few days, which – x seconds
Device
even though far from perfect – will at least prevent
trivial address-based tracking for the lifetime of the Fig. 14. A proposed workaround which breaks tracking via the
device. address-carryover algorithm on Windows 10 and iOS/macOS
devices.
Implement reconnection addresses. BLE allows
devices to exchange Identity Resolving Keys (IRK)
which enable them to use resolvable random pri-
vate addresses of each other (see Section 3.3). This
8 Conclusion
allows for secure directed advertisement and con-
Device manufacturers have flexibility in how to imple-
nection initiation that does not leak permanent
ment address randomization supported by BLE, and
identifiers to the public [8, pp. 1251f., 2738]. De-
may be compelled to take shortcuts for various reasons
vices which currently use an advertising approach
– be it energy or memory constraints on the device level,
involving static addresses (such as the Microsoft
software complexity or just for the sake of cutting de-
Surface Pen) should consider integrating this pro-
velopment cost.
tocol feature into their software architecture.
We showed that most computer and smartphone op-
erating systems do implement address randomizations
by default as a means to prevent long-term passive
7.1 Workaround for Windows 10 devices
tracking, as permanent identifiers are not broadcasted.
However, we identified that devices running Win-
Our investigation showed that simply turning the Blue-
dows 10, iOS or macOS regularly transmit advertis-
tooth setting in the Windows 10 Settings Panel off and
ing events containing custom data structures which are
on did not regenerate the payload and address used for
used to enable certain platform-specific interaction with
Bluetooth advertising, instead merely paused advertis-
other devices within BLE range. By observing typi-
ing activity.
cal advertising behaviors of these operating systems,
As Windows 10 is closed-source, a real fix has to
we identified that parts of these data structures allow
be implemented by the manufacturer. However, it is
an adversary to abuse them as a temporary, secondary
still possible to break address-carryover tracking on the
pseudo-identity. These identifying tokens can be inte-
user side by completely disabling the Bluetooth device
grated into an algorithm which allows device tracking
through the Windows Device Manager and re-enabling
beyond address randomization.
it again. Contrary to the Windows 10 Settings page,
The address-carryover algorithm exploits the
disabling the Bluetooth device in this manner will reset
asynchronous nature of address and payload change,
both the advertising address and the payload, thereby
and uses unchanged identifying tokens in the payload
breaking the chain. Figure 14 shows an approach which
to trace a new incoming random address back to a
practically achieves protection from our algorithm by
known device. In doing so, the address-carryover algo-
cyclically performing this reset every x seconds when-
rithm neutralizes the goal of anonymity in broadcasting
ever the device is not in the Connection state (in order
channels intended by frequent address randomization.
to not break ongoing communication).
The main findings of this work are summarized in
Table 4. The algorithm succeeds consistently on Win-
dows 10 and sometimes on Apple operating systems. In
7.2 Workaround for iOS / macOS
both cases, the respective identifying tokens change out
of sync with the advertising address. In the Windows 10
For iOS and macOS, the same approach shown in Fig-
case, there is no evidence of any synchronization by de-
ure 14 applies. Switching Bluetooth off and on in the
sign. In the Apple case, it seems that there exist mecha-
System Settings (or in the Menu Bar on macOS) will
randomize the address and change the payload.
 Tracking Anonymized Bluetooth Devices 64

Type ∅ Address life M T T∗ Adversary Mechanism

Windows 10 16 min unbounded continuous carry-over algorithm
macOS, iOS 20 min 53 min9 continuous carry-over algorithm
Android 15-45 min no vuln. identified continuous carry-over algorithm
Fitbit Charge static unbounded non-continuous vendor implementation
Microsoft Surface 16 min unbounded non-continuous identifier leak via Pen

Table 4. Trackability summary of the observed devices.

nisms to synchronize updates of identifying tokens with 8.1 Further Research

address randomization, but they occasionally fail.
The Android devices that we tested are not affected In this work, we entirely focused on the existence of data
by the address-carryover algorithm, as they do not con- fields which could be re-purposed as pseudo-identifiers.
tinuously send advertising messages. This is consistent The discoveries presented in this work do not require
with the BLE Central role (see Section 3.1), which scans an SDR-based setup and should be reproducible using
for advertising from nearby Peripheral devices instead of common Bluetooth communication hardware.
advertising itself. Note that the Android SDK contains Future work may focus on additional factors such
functionality for implementing BLE advertising [19], as the consideration of advertising message timing,
but it does not seem to be used by the OS by default in which may make the address-carryover algorithm even
the devices we tested. more powerful. Another interesting factor would be
Fitbit has not fixed the trackability issue, despite physical layer device fingerprinting using SDR, simi-
it being known for years [12, 16]. This is concerning lar to previous work done on other wireless technolo-
since such activity trackers are by design worn and car- gies [2, 15, 36, 39], which may allow tracking despite
ried around in daily life, and there is no way to prevent immunity from the address-carryover algorithm to cer-
sniffing their permanent addresses. tain extents.
Any device which regularly advertises data contain- Furthermore, our current approach may be comple-
ing suitable advertising tokens will be vulnerable to the mented by active attacks previously considered for Wi-
carry-over algorithm if it does not change all of its iden- Fi [22, 27, 34], and adapted to Bluetooth where applica-
tifying tokens in sync with the advertising address. As ble. This includes Connection-based attacks which are
Bluetooth adoption is projected to grow from 4.2 to based on the data channels rather than just the BLE
5.2 billion devices between 2019 and 2022 [9, p. 11], with advertising channels.
over half a billion amongst them wearables and other
data-focused connected devices [9, p. 15], establishing
tracking-resistant methods, especially on unencrypted Responsible Disclosure
communication channels, is of paramount importance.
This privacy concern is compounded by the realistic fea- Vulnerability to the address-carryover algorithm discov-
sibility of BLE-based botnets [22] and complementary ered in Microsoft and Apple software was disclosed with
threats such as large-scale tracking of users via compro- the companies in November 2018. Additional findings
mised Wi-Fi routers [31], which amplify trackability to regarding the Microsoft Surface Pen and iOS activity
a global scale. It can further be imagined that additional side channel were subsequently disclosed to the respec-
metadata such as electronic purchase transactions, fa- tive companies during the ongoing correspondence.
cial recognition and other digital traces could be com-
bined with Bluetooth tracking to generate a fine-grained
location profile of a victim. Acknowledgment

This research was supported in part by NSF under grant

CCF-1563753 and by the Boston University UROP pro-
gram. The authors also thank Jed Crandall for shep-
herding the paper and the anonymous reviewers for their
constructive suggestions.
9 Longer tracking may be possible, but did not occur in our
experiments.
 Tracking Anonymized Bluetooth Devices 65

Applications, NextComp 2017, pages 115–120, 2017.

References [23] Markus Jakobsson and Susanne Wetzel. Security Weak-
nesses in Bluetooth. In David Naccache, editor, Topics in
[1] Apple Inc. iBeacon, 2014. Cryptology — CT-RSA 2001, pages 176–191, Berlin, Heidel-
[2] Gianmarco Baldini, Raimondo Giuliani, Gary Steri, and Ri- berg, 2001. Springer.
cardo Neisse. Physical Layer Authentication of Internet of [24] Mohamed Imran Jameel and Jeffrey Dungen. Low-Power
Things Wireless Devices Through Permutation and Disper- Wireless Advertising Software Library for Distributed M2M
sion Entropy. In 2017 Global Internet of Things Summit and Contextual IoT. In 2015 IEEE 2nd World Forum on In-
(GIoTS), pages 1–6. IEEE, 6 2017. ternet of Things (WF-IoT), pages 597–602. IEEE, 12 2015.
[3] Bluetooth Special Interest Group (SIG). Company Identi- [25] Xianjun Jiao. BTLE, 2014.
fiers. [26] Heikki Karvonen, Carlos Pomalaza-Ráez, Konstantin
[4] Bluetooth Special Interest Group (SIG). Generic Access Mikhaylov, Matti Hämäläinen, and Jari Iinatti. Experimental
Profile. Performance Evaluation of BLE 4 Versus BLE 5 in Indoors
[5] Bluetooth Special Interest Group (SIG). Service Discovery. and Outdoors Scenarios. In Giancarlo Fortino and Zhelong
[6] Bluetooth Special Interest Group (SIG). Bluetooth Core Wang, editors, Advances in Body Area Networks I, pages
Specification. v4.0. Bluetooth Special Interest Group (SIG), 235–251. Springer, Cham, 2019.
2010. [27] Jeremy Martin, Travis Mayberry, Collin Donahue, Lucas
[7] Bluetooth Special Interest Group (SIG). Supplement to the Foppe, Lamont Brown, Chadwick Riggins, Erik C. Rye, and
Bluetooth Core Specification. Bluetooth Special Interest Dane Brown. A Study of MAC Address Randomization in
Group (SIG), 2015. Mobile Devices and When it Fails. Proceedings on Privacy
[8] Bluetooth Special Interest Group (SIG). Bluetooth Core Enhancing Technologies, 2017(4):365–383, 10 2017.
Specification. v5.0. Bluetooth Special Interest Group (SIG), [28] Radius Networks. AltBeacon, 2015.
2016. [29] reelyActive. reelyActive-git.
[9] Bluetooth Special Interest Group (SIG). Bluetooth Market [30] reelyActive. Sniffypedia, 2018.
Update 2018. Technical report, Bluetooth Special Interest [31] Pierre Rouveyrol, Patrice Raveneau, and Mathieu Cunche.
Group (SIG), 2018. Large Scale Wi-Fi Tracking Using a Botnet of Wireless
[10] Bluetooth Special Interest Group (SIG). Core Specifications, Routers. Workshop on Surveillance & Technology, 2015.
2018. [32] Krishna Sampigethaya, Leping Huang, Mingyan Li, Radha
[11] Bluetooth Special Interest Group (SIG). Our History, 2018. Poovendran, Kanta Matsuura, and Kaoru Sezaki. CARA-
[12] Britt Cyr, Webb Horn, Daniela Miao, and Michael Specter. VAN: Providing Location Privacy for VANET. Technical
Security Analysis of Wearable Fitness Devices (Fitbit). Mas- report, Washington Univ Seattle Dept of Electrical Engineer-
sachusetts Institute of Technology, pages 1–14, 2014. ing, 2005.
[13] D.A. Dai Zovi and S.A. Macaulay. Attacking Automatic [33] Dominic Spill and Andrea Bittau. BlueSniff: Eve meets Alice
Wireless Network Selection. In Proceedings from the Sixth and Bluetooth. WOOT ’07 Proceedings of the first USENIX
Annual IEEE Systems, Man and Cybernetics (SMC) Infor- workshop on Offensive Technologies, page 10, 2007.
mation Assurance Workshop, 2005., volume 2005, pages [34] Mathy Vanhoef, Célestin Matte, Mathieu Cunche,
365–372. IEEE, 2005. Leonardo S. Cardoso, and Frank Piessens. Why MAC Ad-
[14] Dino A Dai Zovi. KARMA Attacks Radioed Machines Auto- dress Randomization is not Enough. In Proceedings of the
matically, 2005. 11th ACM on Asia Conference on Computer and Communi-
[15] Boris Danev, Davide Zanetti, and Srdjan Capkun. On cations Security - ASIA CCS ’16, pages 413–424, New York,
Physical-Layer Identification of Wireless Devices. ACM New York, USA, 2016. ACM Press.
Computing Surveys, 45(1):1–29, 2012. [35] virtualabs. probeZero, 2016.
[16] Aveek K. Das, Parth H. Pathak, Chen-Nee Chuah, and Pras- [36] Tien Dang Vo-Huu, Triet Dang Vo-Huu, and Guevara
ant Mohapatra. Uncovering Privacy Leakage in BLE Net- Noubir. Fingerprinting Wi-Fi Devices Using Software De-
work Traffic of Wearable Fitness Trackers. In Proceedings fined Radios. In Proceedings of the 9th ACM Conference on
of the 17th International Workshop on Mobile Computing Security & Privacy in Wireless and Mobile Networks - WiSec
Systems and Applications - HotMobile ’16, pages 99–104, ’16, pages 3–14, New York, New York, USA, 2016. ACM
New York, New York, USA, 2016. ACM Press. Press.
[17] Byron C Drachman and Michael J Cloud. Inequalities: With [37] Isabel Wagner and David Eckhoff. Technical Privacy Met-
Applications to Engineering. Springer-Verlag, 1998. rics. ACM Computing Surveys, 51(3):1–38, 2018.
[18] Google. Eddystone. [38] Martin Woolley. Bluetooth Technology Protecting Your
[19] Google Developers. BluetoothLeAdvertiser. Privacy, 2015.
[20] Robin Heydon. An Introduction to Bluetooth Low Energy, [39] Qiang Xu, Rong Zheng, Walid Saad, and Zhu Han. De-
2013. vice Fingerprinting in Wireless Networks: Challenges and
[21] IEEE Computer Society. IEEE Standard for Local and Opportunities. IEEE Communications Surveys & Tutorials,
Metropolitan Area Networks - Link Aggregation. IEEE Stan- 18(1):94–104, 2016.
dards Association, 2008.
[22] Taher Issoufaly and Pierre Ugo Tournoux. BLEB: Bluetooth
Low Energy Botnet for large scale individual tracking. 2017
1st International Conference on Next Generation Computing