BLEB: Bluetooth Low Energy Botnet for large scale individual tracking

This paper consider the problem of tracking user through the wireless fingerprint of their network interfaces. Bluetooth Low Energy (BLE) is one of these network interfaces and becomes more and more popular because of its energy efficiency and its improved security. The use of random MAC addresses and deep changes in the bluetooth communication procedure were expected to prevent the tracking of individuals through the BLE devices they carries. We reviewed popular devices and found that privacy preserving MAC address are rarely used, even when considering ubiquitous devices that are carried by users all the time. Combined with the new advertising procedure introduced in BLE, this constitute a serious flaw that can be used to track individuals. We investigate its exploitation by BLEB, a BLE Botnet comprise of smartphone and portable devices compromised by a tracking adversary. We investigate the multiple ways to implement it and show that with limited effort, an adversary using BLEB can achieve large scale, high precision and stealthy tracking. A BLEB attack can be more privacy threatening than the ones carried through WiFi or classic bluetooth during their early deployment.