Lost and found: Stopping bluetooth finders from leaking private information

Mira Weller; Jiska Classen; Fabian Ullrich; Denis Waßmann; Erik Tews

doi:10.1145/3395351.3399422

Lost and found: Stopping bluetooth finders from leaking private information

Mira Weller, Jiska Classen, Fabian Ullrich, Denis Waßmann, Erik Tews

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

5 Citations (Scopus)

143 Downloads (Pure)

Abstract

A Bluetooth finder is a small battery-powered device that can be attached to important items such as bags, keychains, or bikes. The finder maintains a Bluetooth connection with the user's phone, and the user is notified immediately on connection loss. We provide the first comprehensive security and privacy analysis of current commercial Bluetooth finders. Our analysis reveals several significant security vulnerabilities in those products concerning mobile applications and the corresponding backend services in the cloud. We also show that all analyzed cloud-based products leak more private data than required for their respective cloud services. Overall, there is a big market for Bluetooth finders, but none of the existing products is privacy-friendly. We close this gap by designing and implementing PrivateFind, which ensures locations of the user are never leaked to third parties. It is designed to run on similar hardware as existing finders, allowing vendors to update their systems using PrivateFind.

Original language	English
Title of host publication	WiSec 2020 - Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks
Publisher	Association for Computing Machinery
Pages	184-194
Number of pages	11
ISBN (Electronic)	9781450380065
DOIs	https://doi.org/10.1145/3395351.3399422
Publication status	Published - 8 Jul 2020
Event	13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2020 - Linz, Virtual, Austria Duration: 8 Jul 2020 → 10 Jul 2020 Conference number: 13

Conference

Conference	13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2020
Abbreviated title	WiSec 2020
Country/Territory	Austria
City	Linz, Virtual
Period	8/07/20 → 10/07/20

Keywords

bluetooth
internet of things
localization
privacy
22/2 OA procedure

Access to Document

10.1145/3395351.3399422

Weller-2020-Lost-and-foundFinal published version, 2.31 MBLicence: Taverne

Cite this

@inproceedings{8281153131f8421685540405e45a141e,

title = "Lost and found: Stopping bluetooth finders from leaking private information",

abstract = "A Bluetooth finder is a small battery-powered device that can be attached to important items such as bags, keychains, or bikes. The finder maintains a Bluetooth connection with the user's phone, and the user is notified immediately on connection loss. We provide the first comprehensive security and privacy analysis of current commercial Bluetooth finders. Our analysis reveals several significant security vulnerabilities in those products concerning mobile applications and the corresponding backend services in the cloud. We also show that all analyzed cloud-based products leak more private data than required for their respective cloud services. Overall, there is a big market for Bluetooth finders, but none of the existing products is privacy-friendly. We close this gap by designing and implementing PrivateFind, which ensures locations of the user are never leaked to third parties. It is designed to run on similar hardware as existing finders, allowing vendors to update their systems using PrivateFind. ",

keywords = "bluetooth, internet of things, localization, privacy, 22/2 OA procedure",

author = "Mira Weller and Jiska Classen and Fabian Ullrich and Denis Wa{\ss}mann and Erik Tews",

year = "2020",

month = jul,

day = "8",

doi = "10.1145/3395351.3399422",

language = "English",

pages = "184--194",

booktitle = "WiSec 2020 - Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks",

publisher = "Association for Computing Machinery",

note = "13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2020, WiSec 2020 ; Conference date: 08-07-2020 Through 10-07-2020",

}

Weller, M, Classen, J, Ullrich, F, Waßmann, D & Tews, E 2020, Lost and found: Stopping bluetooth finders from leaking private information. in WiSec 2020 - Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks. Association for Computing Machinery, pp. 184-194, 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2020, Linz, Virtual, Austria, 8/07/20. https://doi.org/10.1145/3395351.3399422

Lost and found : Stopping bluetooth finders from leaking private information. / Weller, Mira; Classen, Jiska; Ullrich, Fabian et al.

WiSec 2020 - Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks. Association for Computing Machinery, 2020. p. 184-194.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Lost and found

T2 - 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2020

AU - Weller, Mira

AU - Classen, Jiska

AU - Ullrich, Fabian

AU - Waßmann, Denis

AU - Tews, Erik

N1 - Conference code: 13

PY - 2020/7/8

Y1 - 2020/7/8

N2 - A Bluetooth finder is a small battery-powered device that can be attached to important items such as bags, keychains, or bikes. The finder maintains a Bluetooth connection with the user's phone, and the user is notified immediately on connection loss. We provide the first comprehensive security and privacy analysis of current commercial Bluetooth finders. Our analysis reveals several significant security vulnerabilities in those products concerning mobile applications and the corresponding backend services in the cloud. We also show that all analyzed cloud-based products leak more private data than required for their respective cloud services. Overall, there is a big market for Bluetooth finders, but none of the existing products is privacy-friendly. We close this gap by designing and implementing PrivateFind, which ensures locations of the user are never leaked to third parties. It is designed to run on similar hardware as existing finders, allowing vendors to update their systems using PrivateFind.

AB - A Bluetooth finder is a small battery-powered device that can be attached to important items such as bags, keychains, or bikes. The finder maintains a Bluetooth connection with the user's phone, and the user is notified immediately on connection loss. We provide the first comprehensive security and privacy analysis of current commercial Bluetooth finders. Our analysis reveals several significant security vulnerabilities in those products concerning mobile applications and the corresponding backend services in the cloud. We also show that all analyzed cloud-based products leak more private data than required for their respective cloud services. Overall, there is a big market for Bluetooth finders, but none of the existing products is privacy-friendly. We close this gap by designing and implementing PrivateFind, which ensures locations of the user are never leaked to third parties. It is designed to run on similar hardware as existing finders, allowing vendors to update their systems using PrivateFind.

KW - bluetooth

KW - internet of things

KW - localization

KW - privacy

KW - 22/2 OA procedure

UR - http://www.scopus.com/inward/record.url?scp=85091960234&partnerID=8YFLogxK

U2 - 10.1145/3395351.3399422

DO - 10.1145/3395351.3399422

M3 - Conference contribution

AN - SCOPUS:85091960234

SP - 184

EP - 194

BT - WiSec 2020 - Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks

PB - Association for Computing Machinery

Y2 - 8 July 2020 through 10 July 2020

ER -

Lost and found: Stopping bluetooth finders from leaking private information

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this