Physical-Layer BLE Location Tracking Attacks On Mobile Devices.pdf

While cryptographic anonymity measures protect against content-based tracking, attackers can employ physical-layer fingerprinting to identify devices by their unique transmission imperfections.

Key Findings:

1. Practicality of Physical-Layer Fingerprinting: The authors developed a tool to recover Carrier Frequency Offset (CFO) and I/Q offset—key physical-layer imperfections—from BLE packets, demonstrating the feasibility of identifying devices in a lab setting.

2. Field Study Challenges: They conducted large-scale field experiments with uncontrolled BLE devices and identified four main challenges:
- Hardware Diversity: Different BLE chipsets have distinct hardware implementations, making general fingerprinting difficult.
- Transmit Power Variations: Applications can configure transmit power levels, leading to varying signal strengths that affect fingerprint accuracy.
- Temperature Effects: Temperature variations significantly impact physical-layer impairments.
- Inexpensive Radios: Low-cost receivers used by attackers are not substantially less accurate than lab tools.

3. Feasibility and Limitations: Despite these challenges, the study found that tracking specific BLE devices by their physical-layer fingerprint is possible in controlled environments with stable conditions and unique device fingerprints. However, misidentification rates increase due to similar fingerprints among devices and temperature fluctuations.

Conclusion:

While physical-layer tracking of BLE devices is technically feasible, its reliability is limited by the factors mentioned above. The study highlights the need for stronger privacy protections in BLE technologies to mitigate these risks.