Mobile devices continuously beacon Bluetooth Low Energy (BLE) advertisement packets. This has created the threat of attackers identifying and tracking a device by sniffing its BLE signals. To mitigate this threat, MAC address randomization has been deployed at the link-layer in most BLE transmitters. However, attackers can bypass MAC address randomization using lower-level physical-layer fingerprints resulting from manufacturing imperfections of radios. In this work, we demonstrate a practical and effective method of obfuscating physical-layer hardware imperfection fingerprints. Through theoretical analysis, simulations, and field evaluations, we design and evaluate our approach to hardware imperfection obfuscation. By analyzing data from thousands of BLE devices, we demonstrate obfuscation significantly reduces the accuracy of identifying a target device. This makes an attack impractical, even if a target is continuously observed for 24 hours. Furthermore, we demonstrate the practicality of this defense by implementing it by making firmware changes to commodity BLE chipsets.

Software Defined Radios (SDRs) combine a universal radio frontend with flexible processing. The radio frontend can be tuned to capture various wireless signals, while software processing allows quick and scalable deployment for diverse applications. SDRs seem like a good fit for the ever-evolving needs of today's spectrum usage: SDRs can be deployed today, then managed and upgraded with software to support the needs of tomorrow. However, the prevailing architecture of SDRs prevent real-time observation of wideband RF signals due to backhaul and processing resource constraints.

Mobile devices increasingly function as wireless tracking beacons. Using the Bluetooth Low Energy (BLE) protocol, mobile devices such as smartphones and smartwatches continuously transmit beacons to inform passive listeners about device locations for applications such as digital contact tracing for COVID-19, and even finding lost devices. These applications use cryptographic anonymity that limit an adversary’s ability to use these beacons to stalk a user. However, attackers can bypass these defenses by fingerprinting the unique physical-layer imperfections in the transmissions of specific devices.We empirically demonstrate that there are several key challenges that can limit an attacker’s ability to find a stable physical layer identifier to uniquely identify mobile devices using BLE, including variations in the hardware design of BLE chipsets, transmission power levels, differences in thermal conditions, and limitations of inexpensive radios that can be widely deployed to capture raw physical-layer signals. We evaluated how much each of these factors limits accurate fingerprinting in a large-scale field study of hundreds of uncontrolled BLE devices, revealing that physical-layer identification is a viable, although sometimes unreliable, way for an attacker to track mobile devices.

On average, wireless electronics devices are replaced every 50 months. On average, a bridge is replaced every 50 years. As we begin to imagine integrating electronics and intelligence into the built environment, we need to to begin to think about electronic devices and systems on infrastructure timelines. This is not to say that every individual electronic device can, will, or should last for decades, but much like the ship of Theseus, the system that defines emerging Smart Cities will have a lifetime reaching into the century-scale. In this paper, we contemplate what the devices, gateways, network architectures, and their management might look like for a system designed to operate for decades. The result is a mixture of actionable insights for today and research questions for tomorrow, which culminates in the commencement of a 50-year experiment designed to see how long energy-harvesting sensors, without the implicit lifetime of batteries, can remain viable without human attention or intervention.