Bluetooth leaves the door open to espionage

The Dutch General Intelligence and Security Service (AIVD) recently warned that our cars could spy on us: microphones, cameras and GPS in a car can be activated remotely, potentially via an app on your phone when it is connected to your car system. Researcher Fadi Mohsen of the University of Groningen investigates the security of phones, websites and computers, and he too warns that Bluetooth is a vulnerable technology. Recently, he showed that it is possible to steal large amounts of personal information and then use AI to generate user profiles.

FSE Science Newsroom | Charlotte Vlek

‘People so easily download a new application when they need something – like an app that can quickly record some audio for you, or something that shows the stats of your activity tracker in a nice way.’ But once you give permission to a trusted app to access your Bluetooth device, other nice but potentially untrustworthy apps can also connect. 

So, if someone wants to steal information from these Bluetooth devices, all they have to do is develop an attractive app, and then they can obtain all kinds of information – for instance, from your car system, that activity tracker or perhaps an insulin pump or hearing aids. Think location data, audio, video or medical information. 

Real-time fitness information

Mohsen investigates these kinds of attacks on Android, because this operating system has a large number of users, and because it’s rather easy for the researchers to upload their own app to the Play Store. A lot of Mohsen’s work consists of ethical hacking: developing malicious apps that demonstrate the vulnerable places in the technology. For instance, one of his students recently built an app that could steal personal data from a victim’s fitness tracker and stream it online in real time.

'Although other researchers have shown similar attacks before, this one was unique for two reasons,' Mohsen explains. 'First, the student disabled the notification that alerts users when an app uses Bluetooth, and second, the attack was heavily optimized so it left no memory or processing traces behind.' So: an app that appears to be doing something entirely different can actually look over your shoulder without you knowing it.

Design with care

There are actually recommendations in the literature to prevent this attack: When the manufacturer’s app for the Bluetooth device is designed with care, it is less susceptible to misuse by other apps. Because if someone wants to steal personal data, they often have to reverse engineer how the manufacturer accesses the Bluetooth device to imitate or interact with it. The manufacturer can build a security mechanism into that communication. 

‘Recently, we analyzed roughly 28,000 Android app versions that appeared to use Bluetooth Low Energy,’ Mohsen reports, ‘and found that many do not follow the recommendations for safer software, especially when writing data. Because ultimately, it’s a trade-off between user friendliness and security.’ On the other hand, Mohsen has been conducting research on the Android OS for over a decade, and during this time, he has seen major improvements in user privacy. For instance, nowadays, users have much more control over app permissions; they can assign them as the app is running instead of at installation time, and easily revoke them later.

Casting a wide net with AI

‘But now comes the most interesting part!’ Mohsen says. ‘Because I thought: what if I design a generic app, one that haphazardly tries to harvest information from various Bluetooth devices. Then, I no longer have to reverse engineer the manufacturer’s apps – I just cast a wide net and take whatever I can take. Can I then enter this into generative AI, like ChatGPT, for instance, and obtain some useful information?’

With such a haphazard collection of data, you might still be able to compile a user profile, was the idea. And that is something that advertisers are interested in. And indeed, the first results of Mohsen’s research show: an attack this way could be quite successful. ‘Oh well,’ says Mohsen, ‘sometimes you have to be the bad actor to demonstrate what can go wrong. And that sometimes involves a bit of hacking ourselves.’