Tracking You from a Thousand Miles Away! Turning a Bluetooth Device into...
summary
A new method called nRootTag converts unprivileged Linux/Windows/Android machines into trackable AirTags by abusing Find My’s acceptance of public-address BLE adverts and BlueZ’s API that lets unprivileged apps advertise a public MAC. The team precomputes private keys per OUI into a rainbow table (20 TB) or uses rented GPUs (200× RTX 3080) to brute force with 90% in ~2.76 minutes at a few dollars cost. End-to-end tests show location reports arrive in ~7–8 minutes with ~10 ft median accuracy; Apple issues patches.
AI-written summary · about
chapters (11)
- 0:00Bluetooth tracking risks
- 1:52IP vs Wi-Fi tracking limits
- 3:17Apple's Find My network
- 6:25Bluetooth MAC vulnerabilities
- 8:56Address misconfiguration flaw
- 11:25Tracking attack core idea
- 11:47Linux device feasibility
- 12:30Android & Windows challenges
- 13:32Attack cost and performance
- 14:57Real-world tracking results
- 15:17Apple's response and risks
related talks
48mNonconsensual Tracking and Victim Safety: A Case Study in Abusability
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
40mAll Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices
42mBreakMi: Reversing, Exploiting & Fixing Fitness Tracking Ecosystems
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
40mGattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool
36mAll your GPS Trackers belong to US
40mTrust in Apple's Secret Garden: Exploring & Reversing Apple's Continuity Protocol