Cracking the Code: A Deep Dive into Bluetooth Tracking and the World of Find My Devices
0:01:17 Introduction to Tracking Systems: The talk focuses on two systems with similar names and uses a regex-inspired title due to their resemblance, aiming to discuss their underlying technologies through a problem-solution approach.
0:03:26 Core Functionality: These systems use battery-powered beacons emitting local radio signals, coupled with a network for global tracking.
0:04:17 Evolution of Tracking: The talk traces the development from basic GPS trackers to sophisticated systems like "Find My iPhone," introduced in 2009, which actively transmit location data to central servers.
0:05:42 Introduction of Bluetooth Low Energy (BLE): BLE, introduced around the same time as "Find My iPhone", revolutionized tracking with its energy-efficient design, where devices send more than they receive to conserve power.
0:07:01 Apple's iBeacon and Google's Eddystone: Apple's iBeacon (2013) utilized BLE to broadcast data, while Google's Eddystone (2015, discontinued in 2018) offered a similar functionality.
0:08:06 Tile's Community Find: Introduced in 2015, it enabled users to leverage other phones in the network to locate lost items, raising privacy concerns.
0:09:59 Apple's "Find My" Network: Launched in 2019, it combined "Find My iPhone," "Find My Mac," and "Find My Friends" into a unified, privacy-focused system.
0:10:32 BLE's Energy Efficiency: Achieved by having devices primarily send advertisement frames, reducing the time spent in the power-hungry receiving mode.
0:12:22 Global Tracking Network: Accessories broadcast beacons with IDs; non-owner phones report these IDs and their locations to a central server, which the owner's phone can access.
0:13:06 Privacy Challenges: Globally unique MAC addresses pose a privacy risk, as they can be correlated across sightings. BLE offers a partial solution with random, resolvable MAC addresses, but this doesn't work globally.
0:14:28 Encrypted Location Reports: To enhance privacy, location reports are encrypted using public keys broadcast by the accessories, preventing the central server from accessing the location data.
0:15:58 Rotating Public Keys: To prevent tracking via static public keys, the system employs a mechanism to regularly change the broadcast public key, while owner devices can still decrypt reports using a shared secret.
0:16:51 Apple's "Find My" Network (FMN) vs. Google's "Find My Device" Network (FMDN): Both offer similar functionality but differ in implementation details. Tile and Samsung are also mentioned as players in the market.
0:18:23 OpenHaystack: An independent implementation of Apple's "Find My" protocol.
0:19:43 Google's "Find My Device" Network: Leverages the existing Google Fast Pair service and uses a shorter elliptic curve with Eddystone format.
0:24:03 Abuse and Countermeasures: The talk discusses the potential for abuse, such as stalking, and the countermeasures implemented by manufacturers, including beeping and reducing identity rotation frequency when a device is away from its owner.
0:25:45 Detecting Unwanted Location Trackers (DULT): An IETF working group focused on detecting unwanted tracking, defining a bit to indicate if the owner has knowledge of the device's location.
0:27:31 Non-Owner Device Interaction: Devices in "away" mode can be interacted with by non-owner devices, allowing them to be made to beep for easier location.
0:28:33 Tools for Receiving and Analyzing Signals: Software-defined radios (SDRs) like HackRF and specialized tools like Nordic's nRF Connect can be used to receive and analyze Bluetooth signals, including those from tracking devices.
0:32:40 Reverse Engineering and Further Research: The speaker encourages the audience to explore further, including reverse engineering the Android app and integrating with home automation systems.
0:35:33 Q&A: Clarifies questions regarding location reporting with mocked locations, device behavior when away from the owner, and accessing Apple's API for custom trackers.