If law enforcement officers can use technology to track people, then people ought to be able to return the favor, according to a robotics hacker who created a service enabling people to monitor police activity using Bluetooth.<\/p>\n\n\n\n\n\n\n\n
Alan Meekins, aka Nullagent, explained at the Def Con conference this summer how a major equipment provider to law enforcement, Axon, uses Bluetooth to tie together hardware like body cameras, Tasers, firearms, and dash cameras.<\/p>\n\n\n\n
\u201cAxon has its fingers into every part of police life, from how you charge these devices at home or at the office to interrogation rooms,\u201d he said at his Def Con session titled \u201cSnoop Unto Them as They Snoop Unto Us.\u201d<\/p>\n\n\n\n
He explained that just by reading the documentation for the hardware used by police, he discovered how Bluetooth is used to activate bodycams when Tasers are deployed, and guns are drawn from their holsters, as well as activate dashcams when the sirens and flashing lights are turned on in a police car.<\/p>\n\n\n\n
Accessing Bluetooth data, like the MAC address of a bodycam, would be valuable to citizens, he maintained.<\/p>\n\n\n\n
\u201cIf you read the news in the last couple of years, you\u2019ll find out that sometimes police departments can be cagey to release potentially damaging body cam footage,\u201d he said. \u201cIt\u2019s hard to compel them because they like to beat around the bush.\u201d<\/p>\n\n\n\n
\u201cIf you have a way to say, \u2018I know this MAC address was in the vicinity, at a particular event or particular occurrence of potential police misconduct\u2019, you can more directly light a fire under their butts,\u201d he added.<\/p>\n\n\n\n
Such information, however, might be valuable to cybercriminals, too. \u201cYou could tightly detect the distance that a cop is to your computer, and the computer can self-destruct automagically,\u201d Meekins said.<\/p>\n\n\n\n
His RFParty service isn\u2019t designed to track police, but because it maps common internet of things devices, police objects, like bodycams, can be detected.<\/p>\n\n\n\n
\u201cWhat we\u2019re pointing out here is that every device is an AirTag,\u201d he noted. \u201cWe need a way to detect all Bluetooth devices.\u201d<\/p>\n\n\n\n
\u201cWe don\u2019t need one-off solutions that only work on iPhones and take three years for Android to catch up and leave everyone that runs Linux completely in the lurch,\u201d he continued. \u201cWe actually need a solution for everyone and for every possible device.\u201d<\/p>\n\n\n\n
While Bluetooth connections offer a broader attack surface than wired connections, that doesn\u2019t mean the technology is inherently insecure, asserted Casey Ellis, CTO and co-founder of Bugcrowd<\/a>, which operates a crowdsourced bug bounty platform.<\/p>\n\n\n\n \u201cIt\u2019s more a comment on the accessibility differences between wire and air,\u201d he told TechNewsWorld. \u201cThat said, vulnerabilities in Bluetooth are discovered on a semi-regular basis, which can compromise the privacy of the communications, or even the device itself.\u201d<\/p>\n\n\n\n Bluetooth security can vary, depending on the version of the communications technology being used, explained Roger Grimes, a defense evangelist at KnowBe4<\/a>, a security awareness training provider in Clearwater, Fla.<\/p>\n\n\n\n \u201cIn older devices, with earlier versions of Bluetooth, someone sniffing the Bluetooth signal could often eavesdrop on whatever information was being sent or received,\u201d he told TechNewsWorld.<\/p>\n\n\n\n \u201cThese days, with newer versions of Bluetooth, more information is encrypted by default and less prone to eavesdropping,\u201d he continued. \u201cBut in general, someone sniffing a Bluetooth connection is going to learn the MAC address, can look up the vendor associated with that MAC address, and know if the Bluetooth device is active and transmitting information.\u201d<\/p>\n\n\n\n \u201cDepending on the attack scenario, there can be times when someone can transmit spam to the receiving device,\u201d he added. \u201cThere are even rare scenarios where someone could eavesdrop on information being sent to or from a particular device, although these scenarios are often patched, so as long as the holder has the most recent Bluetooth or OS update, the eavesdropping attacks aren\u2019t viable.\u201d<\/p>\n\n\n\n If Bluetooth can be used to track cops, it can be used to track consumers, too, but Grimes discounted that threat. \u201cWe\u2019ve been told to be scared about Bluetooth attacks for decades, and no significant attack has ever occurred to warrant most consumers worrying about them,\u201d he said.<\/p>\n\n\n\n \u201cIt\u2019s not to say that Bluetooth attacks aren\u2019t possible, but when they are discovered, they are fixed and patched,\u201d he added. \u201cI think consumers have a lot bigger worries than what is happening to their Bluetooth device.\u201d<\/p>\n\n\n\n Every person needs to do their own \u201cthreat assessment\u201d of their use of Bluetooth devices, recommended Paul Kincaid, acting CISO and vice president of information security products at SecureAuth<\/a>, an identity access management security solutions maker in Irvine, Calif.<\/p>\n\n\n\n \u201cIf you are a journalist that reports on sensitive or controversial topics, you probably should not use Bluetooth earbuds to talk to sources,\u201d he told TechNewsWorld.<\/p>\n\n\n\n \u201cHowever,\u201d he continued, \u201cif you are just someone listening to music with your earbuds, you probably do not have to worry too much.\u201d<\/p>\n\n\n\n \u201cMaintaining good security hygiene \u2014 updating your device when available, not accepting unknown or unexpected pairing requests \u2014 and if you are not using Bluetooth at the time or at all, disable it on your device,\u201d he added.<\/p>\n\n\n\nMarginal Consumer Threat<\/h3>\n\n\n\n
Maintain Good Security Hygiene<\/h3>\n\n\n\n