Venom

Abstract

The Bluetooth Low Energy (BLE) protocol is being included in mobile devices such as smartphones, headphones and smartwatches. As part of the BLE service discovery mechanism, devices announce their presences by broadcasting radio signals called advertisement packets that can be collected with off-the-shelf hardware and software. To avoid the risk of tracking based on those messages, BLE features an address randomization mechanism substituting the device MAC address with random temporary pseudonyms. However, the payload of advertisement packets still contains fields that can negate the randomization mechanism by exposing static identifiers. In this paper, we present Venom (Visual and ExperimeNtal Bluetooth Low Energy tracking systeM), an experimental tracking platform aiming to raise public awareness about physical tracking technologies and experiment privacy-preserving mechanisms. Venom tracks users by collecting advertisement packets broadcasted by their BLE-enabled devices, and displays related information.