458

Police Bluetooth advertising packets rule (lemmy.blahaj.zone)

submitted 5 months ago by ackshewally@lemmy.blahaj.zone to c/196@lemmy.blahaj.zone

59 comments fedilink hide all child comments

00:25:DF:*

you are viewing a single comment's thread
view the rest of the comments

[-] Gormadt@lemmy.blahaj.zone 98 points 5 months ago* (last edited 5 months ago)

I too would like to know how to make a hog finder

Edit: Okay I think I figured it out. Using an app called BLE Radar (F-Droid Link and Google Play link) you can scan nearby Bluetooth devices passively. You can use the app to setup filters to send notifications when specific devices or addresses are nearby.

[-] ackshewally@lemmy.blahaj.zone 83 points 5 months ago* (last edited 5 months ago)

Yup, that's it. BLE Radar is the best app I've found so far. Someone go make a PR for playing a sound when a profile matches though...

Tasers, bodycams and holsters among other things made by Taser are constantly spamming advertising packets over BLE in order to be able to link to each other quickly (ie if a taser or gun is drawn, turn on the body cam). These devices are almost all made by one company and per the Bluetooth specification, the manufacturer ID is the first three bytes of the device ID, 00:25:DF: the address for Axon International Torture Devices.

Credit to Nullagent/rfparty for discovering the vulnerability. https://www.engadget.com/how-hackers-are-using-bluetooth-to-track-police-activity-140012717.html

A couple notes in practice: without dedicated hardware BLE advertising packets are very random, your phone can only sense one of the three advertising channels at once and it rotates though them. Additionally local band conditions (how many innocuous BLE devices are also around, WiFi, unrelated ISM stuff, other factors) can change sensitivity. BLE is a chaotic spammy protocol that likes to shout over itself. As a result, detections can happen the instant someone gets within ~100m of you, or they may not be detected for several seconds. Some departments may not even use Axon hardware at all, though the majority seem to. You may be able to use the WiGLE database to get a sense for your locale, but I haven't dug into that yet.

Further research: This has a lot of potential for protest/protected first amendment activities. As stated, the ability to cue an audio alert. Apps that can trigger audio/video recording when cops are very close (high RSSI). Apps that can alert a friend that lots of cops are very close and the user is unable to halt a countdown. Apps that can wipe/lock/turn off a phone if lots of cops are very close or around for an extended period of time (in custody).

[-] Gormadt@lemmy.blahaj.zone 31 points 5 months ago

One thing I'm curious about is of using a micro controller with a much larger receiver would extend BLE sniffing capabilities.

Or setting up some LoRa equipped micro controllers to do sniffing in an area and syncing that data using a LoRa mesh to an active database of some kind. (Like utilize something similar to (or in fact) Meshtastic)

[-] ackshewally@lemmy.blahaj.zone 24 points 5 months ago* (last edited 5 months ago)

Meshtastic is awesome, everyone go play with it, it's getting more accessible by the day.

There's a lot you can do on the hardware side. A device with three BLE chips supporting the appropriate modes would be able to sniff all three advertising channels at once, greatly increasing acquisition speed. High gain directional antennas would massively increase range. If you were especially squirrelly you could build in a GPS with high precision timing (~$25-100) and geolocate the packets via MLAT (https://en.m.wikipedia.org/wiki/Pseudo-range_multilateration). Moving up to a GPSDO you could start to do things like determine the speed and direction of travel of the sender.

[-] princessnorah@lemmy.blahaj.zone 12 points 5 months ago

I'd love a community here on lemmy for Meshtastic.

[-] cypherpunks@lemmy.ml 15 points 5 months ago

I’d love a community here on lemmy for Meshtastic.

There are two:

/c/meshtastic@mander.xyz
/c/meshtastic@lemmy.ml

[-] princessnorah@lemmy.blahaj.zone 8 points 5 months ago

Sorry, I should have been more specific. I'd love an active community here on lemmy for Meshtastic. One of those hasn't had a post for 2 months and the other has a single post from an admin and that's it.

[-] cypherpunks@lemmy.ml 5 points 5 months ago* (last edited 5 months ago)

yeah, they aren't very active, but (presumably due to federation bugs) there is more there than your instance is showing you: from my perspective the most recent post on the mander community is from one month ago and the lemmy.ml community has three posts including one that isn't from a mod.

you might be able to pull those posts into your instance by searching for their permalinks there (which you can find from the fediverse icons on each post in the web view of those communities on another instance).