Researchers have shown how simple it is to monitor and record Bluetooth low energy signals transmitted by phones and wearable devices, allowing the user to be easily identified and tracked.
Researchers at Context Information Security have demonstrated how easy it is to monitor and record Bluetooth Low Energy signals transmitted by many mobile phones, wearable devices and iBeacons, including the iPhone and leading fitness monitors, raising concerns about privacy and confidentiality. The researchers have even developed an Android app that scans, detects and logs wearable devices.
The app can be downloaded along with a detailed blog explaining the research at: www.contextis.co.uk/resources/blog/emergence-bluetooth-low-energy
The Context findings follow recent reports that soldiers in the People’s Liberation Army of China have been warned against using wearables to restrict the possibility of cyber-security loopholes. “Many people wearing fitness devices don’t realise that they are broadcasting constantly and that these broadcasts can often be attributed to a unique device,” said Scott Lester, a senior researcher at Context. “Using cheap hardware or a smartphone, it could be possible to identify and locate a particular device – that may belong to a celebrity, politician or senior business executive – within 100 metres in the open air. This information could be used for social engineering as part of a planned cyber attack or for physical crime by knowing peoples’ movements.”
Bluetooth Low Energy (BLE) was released in 2010 specifically for a range of new applications that rely on constantly transmitting signals without draining the battery. Like other network protocols it relies on identifying devices by their MAC addresses; but while most BLE devices have a random MAC address, Context researchers found that in most cases the MAC address doesn’t change. “My own fitness tracker has had the same MAC address since we started the investigation, even though it’s completely run out of battery once,” said Lester. Sometimes the transmitted packets also contain the device name, which may be unique, such as the ‘Garmin Vivosmart #12345678′, or even give the name of the user, such as ‘Scott’s Watch’.
BLE is also increasingly used in mobile phones and is supported by iOS 5 and later, Windows Phone 8.1, Windows 8, Android 4.3 and later, as well as the BlackBerry 10. The Bluetooth Special Interest Group (SIG) has predicted that, “By 2018, more than 90 percent of Bluetooth enabled smartphones are expected to be Smart Ready devices,” supporting BLE; while the number of Bluetooth enabled passengers cars is also predicted to grow over to 50 million by 2016.
iBeacons, which also transmit BLE packets in order to identify a location, are already used in Apple Stores to tailor notifications to visiting customers, while BA and Virgin use iBeacons with their boarding pass apps to welcome passengers walking into the lounge with the WiFi password. House of Fraser is also trialling iBeacons on manikins to allow customers to look at the clothes and their prices on their phones. The current model for iBeacons is that they should not be invasive; you have to be running the application already, for it to detect and respond to a beacon. But the researchers have concerns: “It doesn’t take much imagination to think of a phone manufacturer providing handsets with an iBeacon application already installed, so your phone alerts you with sales notifications when you walk past certain shops,” said Lester.
The current version 4.2 of the Bluetooth Core Specification makes it possible for BLE to implement public key encryption and keep packet sizes down, while also supporting different authentication schemes. “Many BLE devices simply can’t support authentication and many of the products we have looked at don’t implement encryption, as this would significantly reduce battery life and increase the complexity of the application,” said Lester.
“It is clear that BLE is a powerful technology, which is increasingly being put to a wide range of uses,” concludes Context’s Lester. “While the ability to detect and track devices may not present a serious risk in itself, it certainly has the potential to compromise privacy and could be part of a wider social engineering threat. It is also yet another demonstration of the lack of thought that goes into security when companies are in a rush to get new technology products to market.”
* Follow Gadget on Twitter on @GadgetZA
Huawei Mate 20 unveils ‘higher intelligence’
The new Mate 20 series, launching in South Africa today, includes a 7.2″ handset, and promises improved AI.
Huawei Consumer Business Group today launches the Huawei Mate 20 Series in South Africa.
The phones are powered by Huawei’s densest and highest performing system on chip (SoC) to date, the Kirin 980. Manufactured with the 7nm process, incorporating the Cortex-A76-based CPU and Mali-G76 GPU, the SoC offers improved performance and, according to Huawei, “an unprecedented smooth user experience”.
The new 40W Huawei SuperCharge, 15W Huawei Wireless Quick Charge, and large batteries work in tandem to provide users with improved battery life. A Matrix Camera System includes a Leica Ultra Wide Angle Lens that lets users see both wider and closer, with a new macro distance capability. The camera system adopts a Four-Point Design that gives the device a distinct visual identity.
The Mate 20 Series is available in 6.53-inch, 6.39-inch and 7.2-inch sizes, across four devices: Huawei Mate 20, Mate 20 Pro, Mate 20 X and Porsche Design Huawei Mate 20 RS. They ship with the customisable Android P-based EMUI 9 operating system.
“Smartphones are an important entrance to the digital world,” said Richard Yu, CEO of Huawei Consumer BG, at the global launch in London last week. “The Huawei Mate 20 Series is designed to be the best ‘mate’ of consumers, accompanying and empowering them to enjoy a richer, more fulfilled life with their higher intelligence, unparalleled battery lives and powerful camera performance.”
The SoC fits 6.9 billion transistors within a die the size of a fingernail. Compared to Kirin 970, the latest chipset is equipped with a CPU that is claimed to be 75 percent more powerful, a GPU that is 46 percent more powerful and an NPU (neural processing unit) that is 226 percent more powerful. The efficiency of the components has also been elevated: the CPU is claimed to be 58 percent more efficient, the GPU 178 percent more efficient, and the NPU 182 percent more efficient. The Kirin 980 is the world’s first commercial SoC to use the Cortex-A76-based cores.
Huawei has designed a three-tier architecture that consists of two ultra-large cores, two large cores and four small cores. This allows the CPU to allocate the optimal amount of resources to heavy, medium and light tasks for greater efficiency, improving the performance of the SoC while enhancing battery life. The Kirin 980 is also the industry’s first SoC to be equipped with Dual-NPU, giving it higher On-Device AI processing capability to support AI applications.
Read more about the Mate 20 Pro’s connectivity, battery and camera on the next page.
How Quantum computing will change … everything?
Research labs, government agencies (NASA) and tech giants like Microsoft, IBM and Google are all focused on developing quantum theories first put forward in the 1970s. What’s more, a growing start-up quantum computing ecosystem is attracting hundreds of millions of investor dollars. Given this scenario, Forrester believes it is time for IT leaders to pay attention.
“We expect CIOs in life sciences, energy, defence, and manufacturing to see a deluge of hype from vendors and the media in the coming months,” says Forrester’s Brian Hopkins, VP, principal analyst serving CIOs and lead author of a report: A First Look at Quantum Computing. “Financial services, supply-chain, and healthcare firms will feel some of this as well. We see a market emerging, media interest on the rise, and client interest trickling in. It’s time for CIOs to take notice.”
The Forrester report gives some practical applications for quantum computing which helps contextualise its potential:
- Security could massively benefit from quantum computing. Factoring very large integers could break RSA-encrypted data, but could also be used to protect systems against malicious attempts.
- Supply chain managers could use quantum computing to gather and act on price information using minute-by-minute fluctuations in supply and demand
- Robotics engineers could determine the best parameters to use in deep-learning models that recognise and react to objects in computer vision
- Quantum computing could be used to discover revolutionary new molecules making use of the petabytes of data that studies are now producing. This would significantly benefit many organisations in the material and life sciences verticals – particularly those trying to create more cost-effective electric car batteries which still depend on expensive and rare materials.
Continue reading to find out how Quantum computing differs.