With the prevalence of personal Bluetooth devices, potential breach of user privacy has been an increasing concern. To date, sniffing Bluetooth traffic has been widely considered an extremely intricate task due to Bluetooth's indiscoverable mode, vendor-dependent adaptive hopping behavior, and the interference in the open 2.4 GHz band. In this paper, we present BlueEar-a practical Bluetooth traffic sniffer. BlueEar features a novel dual-radio architecture where two Bluetooth-compliant radios coordinate with each other on learning the hopping sequence of indiscoverable Bluetooth networks, predicting adaptive hopping behavior, and mitigating the impacts of RF interference. We built a prototype of BlueEar to sniff on Bluetooth classic traffic. Experiment results show that BlueEar can maintain a packet capture rate higher than 90% consistently in real-world environments, where the target Bluetooth network exhibits diverse hopping behaviors in the presence of dynamic interference from coexisting 802.11 devices. In addition, we discuss the privacy implications of the BlueEar system, and present a practical countermeasure that effectively reduces the packet capture rate of the sniffer to 20%. The proposed countermeasure can be easily implemented on Bluetooth master devices while requiring no modification to slave devices such as keyboards and headsets.

With the prevalence of personal Bluetooth devices, potential breach of user privacy has been an increasing concern. To date, sniffing Bluetooth traffic has been widely considered an extremely intricate task due to Bluetooth's indiscoverable mode, vendor-dependent adaptive hopping behavior, and the interference in the open 2.4 GHz band. In this paper, we present BlueEar -a practical Bluetooth traffic sniffer. BlueEar features a novel dual-radio architecture where two Bluetooth-compliant radios coordinate with each other on learning the hopping sequence of indiscoverable Bluetooth networks, predicting adaptive hopping behavior, and mitigating the impacts of RF interference. Experiment results show that BlueEar can maintain a packet capture rate higher than 90% consistently in real-world environments, where the target Bluetooth network exhibits diverse hopping behaviors in the presence of dynamic interference from coexisting Wi-Fi devices. In addition, we discuss the privacy implications of the BlueEar system, and present a practical countermeasure that effectively reduces the packet capture rate of the sniffer to 20%. The proposed countermeasure can be easily implemented on the Bluetooth master device while requiring no modification to slave devices like keyboards and headsets.

Despite the widespread use of Bluetooth technology, identity management of Bluetooth devices remains a significant challenge because the MAC address and name of Bluetooth device are easy to forge. In this paper, we present BlueID - a practical system that identifies Bluetooth devices by fingerprinting their clocks. Previous approaches to clock fingerprinting exclusively rely on the timestamps carried by packet headers, which can be easily spoofed by hacking the user-space device driver. In comparison, BlueID performs clock fingerprinting based on the temporal feature of Bluetooth frequency hopping, which is impossible to forge without a customized baseband. Due to the proprietary nature of chipset firmware that implements baseband on commodity Bluetooth devices, BlueID will significantly raise the bar of identity spoofing. Moreover, BlueID employs simple yet efficient techniques to detect and differentiate low power Bluetooth transmissions from a distance, making it suitable for mobile applications like energy efficient localization and tracking. BlueID is implemented on a low cost wireless development platform and extensively evaluated based on 56 commodity devices. We show that BlueID can detect Bluetooth radios from 100m away, and identify different devices with high accuracy, short delay, and low computational overhead. Although this paper focuses on Bluetooth, the design of BlueID is general and can be applied to other frequency hopping based wireless systems.