Detecting Bluetooth Surveillance Systems
Grant Bugher explores detecting bluetooth surveillance systems at DEF CON 22, examining bluetooth and practical defenses.
Summary
Architecture and Background
Detecting Bluetooth Surveillance Systems Grant Bugher PERIMETER GRID Departments of Transportation around the United States have deployed "little white boxes" -- Bluetooth detectors used to monitor traffic speeds and activity. While they're supposedly anonymous, they detect a nearly-unique ID from every car, phone, and PC that passes by.
Vulnerability Analysis
In this presentation, I explore the documentation on these surveillance systems and their capabilities, then build a Bluetooth detector, analyzer, and spoofer with less than $200 of open-source hardware and software. Finally, I turn my own surveillance system on the DOT's and try to detect and map the detectors.
Exploitation and Demonstrations
Grant Bugher has been hacking since the early 90’s and working professionally in information security for the last 9 years. He is currently a security architect for a cloud computing provider, and has previously been a program manager and software engineer on a variety of widely-used developer tools and platforms.
Remediation and Defensive Strategies
Grant is a prior speaker at BlackHat USA and a regular DefCon attendee since DefCon 16. Most of his research and work is on cloud compute and storage platforms, application security, and detecting attacks against web-scale applications. Twitter: @fishsupreme Web:
Related talks
Main Stage·45 min
Romain Cayre · Damien Cauquil
Framework and unified protocol architecture for wireless security research, hardware abstraction, and over-the-air exploitation.
Main Stage·23 min
Alan Meekins
Investigates fixed-address Bluetooth Low Energy beacons in law enforcement gear, body cameras, and consumer IoT, demonstrating long-term tracking.
Main Stage·37 min
Jose Pico · Fernando Perera
Jose Pico and Fernando Perera demonstrate exploiting Windows Bluetooth Low Energy (BLE) pairing flaws to execute unauthorized wireless keystroke injection.