NZTA & Bluetooth (Beca/Blip Systems)

Forums › ICT Policies and Regulation › NZTA & Bluetooth (Beca/Blip Systems)

1080p

1332 posts

Uber Geek
+1 received by user: 152
Inactive user

#113699 24-Jan-2013 22:11

I saw this article and was interested in what others might think about it.

The article specifically states:

"The Bluetooth Address collected is not related to a specific device or an individual."

Which piqued my interest as I thought any sort of analysis between two points would require information relating to a particular device be collected, would it not?

Blip Systems' YouTube video shows that analysis of a particular Bluetooth device is measured between two points and the data is stored on a server and that data presented to the people collecting it.

Surely this is not a good idea, given that Google were recently stopped from doing pretty much the same thing globally with Wi-Fi network data.

The obvious response is, of course, "turn off your Bluetooth" but I think this is a case of implementing something wrong then telling people they can opt out.

freitasm

BDFL - Memuneh
80662 posts

Uber Geek
+1 received by user: 41086

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#750462 24-Jan-2013 22:16

Google's collection of WiFi data was different in that it was collecting a lot more than AP MAC addresses, location and strength. It was collecting payloads as well.

The only information required in this case is a device identifier. The device id is encrypted and stored. You only need the encrypted device id for comparison in two points, nothing else. There's nothing saying "this device id belongs to such individual".

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Technofreak

6657 posts

Uber Geek
+1 received by user: 3477

Trusted

#750464 24-Jan-2013 22:17

I gyess it can identify unique devices but cannot tell who the device belongs to.

I wonder if your have your bluetooth device hidden, which I do, if the system can see those devices?

Sony Xperia XA2 running Sailfish OS. https://sailfishos.org The true independent open source mobile OS
Samsung Galaxy Tab S6
Dell Inspiron 14z i5

BlipTrack

2 posts

Wannabe Geek

Trusted

BLIP Systems

#750477 24-Jan-2013 23:10

Hi!

I´m the Marketing Coordinator at BLIP Systems and will be more than happy to answer any questions concerning Bluetooth tracking.

For Bluetooth privacy concerns we have made this document:

http://issuu.com/blipsystems/docs/bluetooth_tracking_privacy_concerns

Please let me know what you think!

Regards,
Christian

1080p

1332 posts

Uber Geek
+1 received by user: 152
Inactive user

#750875 25-Jan-2013 16:53

BlipTrack: Hi!

I´m the Marketing Coordinator at BLIP Systems and will be more than happy to answer any questions concerning Bluetooth tracking.

For Bluetooth privacy concerns we have made this document:

http://issuu.com/blipsystems/docs/bluetooth_tracking_privacy_concerns

Please let me know what you think!

Regards,
Christian

Thanks for the reply, your link was most informative. The article posted at GeekZone, strictly speaking, is incorrect regarding the collection of device specific data (which is why I decided to investigate further) but of course this in no way translates into personally identifying data.

Do Beca/Blip Systems possess the necessary capability to decrypt the MAC address hashes at a later date for the purpose of, for example, law enforcement?

Re-hashing the original hash daily is a nice touch, I will admit. Good on ya ;-)

scuwp

3927 posts

Uber Geek
+1 received by user: 2510

#750882 25-Jan-2013 16:58

Ah...the paranoid brigade starts again. Quick everyone, put your tin foil hats on! Lol

Lazy is such an ugly word, I prefer to call it selective participation

BlipTrack

2 posts

Wannabe Geek

Trusted

BLIP Systems

#750945 25-Jan-2013 20:21

Dear 1080P

No, it is not possible to revert hash codes back to Bluetooth, when using a SHA-256 algorithm*.
* SHA-256 algorithm generates an almost-unique, fixed size 256-bit (32-byte) hash. This makes it suitable for password validation, challenge hash authentication, anti-tamper, digital signatures.

Regards,
Christian

Dyson

Shop now for Dyson appliances (affiliate link).

DarkShadow

1647 posts

Uber Geek
+1 received by user: 656

#751043 25-Jan-2013 23:46

Okay so I'm going to act paranoid here. :P

You don't need to decrypt the hashes, you just need too find which mac address generates which hash.

There's only 2^48 unique mac addresses out there. Less if you know which brand of Bluetooth chipset your target uses.

You can do 65 million sha256 hashes per second on a $200 GPU

2^48 / 65000000 = 4.3 x 10^6 seconds = 50 days

If you to buy a bunch of GPUs, then you can calculate the hash for each possible mac address with the daily salt every day. Right?