Personal tracking devices enter a new era of precision and danger

For some people, the rise of Bluetooth and ultra-wideband (UWB) tracking devices and accessories may not only be popular, but necessary. Mobile phones can easily be lost or stolen, not to mention keys or wireless earbuds. Gear replacement costs are prohibitively high-high-end earbuds can reach up to $250, while the cost of the Galaxy Z Fold 3 is as high as a gaming PC. If you are prone to misplacement, tracking technology can save you thousands of dollars.

However, in the rush to adopt it, it is important to be aware of the serious privacy issues involved. As we all know, the government often uses all available tools to track suspects, regardless of whether the targets are legal or not. Think of Edward Snowden’s public NSA metadata collection, or the Pegasus spyware used in countries such as Saudi Arabia and the UAE. The Stingray cell phone tower simulator is used by many agencies, including law enforcement agencies in the United States.

It is also difficult for the private sector to avoid such worries. We have shared a lot of location data with app-based companies such as Google and Facebook. Some companies specialize in enhancing, analyzing, and/or reselling these data, such as Foursquare, and some of them are not too picky about their customers or methods. Some people will completely ignore the law.

Broadly speaking, the risks of equipment tracking can be divided into two categories: tracking and general surveillance.

track

Tracking may be the biggest and most obvious threat. A Tile-like Bluetooth tracker can be put into someone’s bag, vehicle or clothing, and can be used to track someone wherever they go, especially now that the only major size limitation is the battery. Bluetooth’s range is (actually) limited to a few hundred feet-but companies like Tile and Apple have solved this problem, using the network to anonymously “echo” the location of the tracker as customers pass by. For example, if you hide the Tile in the electric bike before it is stolen, its location will be refreshed as long as another user of the Tile app is in the area.

The threats being tracked are not hypothetical.For example, in 2018, a Houston woman told ABC 13 She found a tile in the console of the car, which her predecessor had been using to track her home, restaurants and out-of-town locations. In this case, the predecessor was charged with a misdemeanor, but it is not difficult to imagine another situation in which women were beaten or killed.

Without criminal activity, parents and partners have room to control their behavior. Abusive husbands can use the tracker to track their spouse to the shelter or the police. An overprotective mother may prevent their child from removing anywhere outside of home or school.

Thanks to Apple’s integration of anti-tracking into AirTag-if an unpaired AirTag tracks the iPhone, the iPhone will automatically notify its owner, After 8 to 24 hours, the label will start beepingHowever, this still does not apply to Android phones, even if this support is online, Android users must download apps to protect themselves. This is of little help to unsuspecting victims, because the current waiting time is three full days before the suspected “person tracking” AirTag starts beeping for non-iPhone users.

related: Apple AirTag comments

Samsung’s SmartTags follow a similar model, but require the user to manually scan the tracker. Fortunately, people also need to install the correct Samsung app on their phones to broadcast location data, so SmartTag is not easy to be weaponized. However, Tile does not provide such an anti-tracking function at all.

With the development of tracking equipment technology and the development of the network, the tug of war between trackers and technology companies is bound to escalate, and the former will take advantage of any loopholes they can find. Sadly, they don’t have to install a Bluetooth tracker to hunt someone down-hacking into a mobile platform is another option, which brings us to the topic of general surveillance.

Monitor

Hacking is actually more effective than installing trackers, because people tend to carry their phones with them, and attackers can get more than just location information-assuming they overcome the obstacles of encryption and detection. Combining this with state-of-the-art tracking equipment can expand the possibilities of surveillance.

The problem here is not the hardware, but the applications people use for tracking. Tools such as Google Find My Device and Apple Find My have been integrated into their respective platforms, and if they are penetrated, they may map out every connected gadget that a person has. These require at least break into accounts that are tightly protected, so as long as one has a strong password and two-factor authentication (2FA), the threat is low.

However, lax security practices have always been a problem, and third-party applications are starting to become dangerous. Most companies do not have the same security resources as giants such as Apple and Google, which means that their servers and accounts do not always have so many protection measures. Brands like Tile are generally trustworthy, but they don’t use 2FA even at the time of writing.

The more items a person tracks through first-party or third-party applications, the more comprehensive the monitoring in theory. Suppose you have a tracker on your backpack or laptop. If your phone and tracker set off to a specific place every morning, it is not difficult to guess that the starting point is your home and the destination is the office or construction site. Putting another tracker on the TV remote will immediately confirm your home location. If you are monitoring headphones or a personal electric car, hackers can pick out some of your favorite places, such as a park or a gym.

Due to the widespread use of UWB-equipped trackers such as AirTag and SmartTag Plus, the situation in 2021 will be more complicated, not to mention large products with built-in UWB. Although the phone may have to be within 30 feet of the tracked item to switch from Bluetooth to UWB, the latter can reduce the location range to a few inches. Intruding into a mobile phone surrounded by UWB items can allow an attacker to find out where the device is stored in a building, and even where a specific person sits and sleeps. If it falls into the wrong hands, these data can be used to plan burglary and even murder.

You can also take a look: Everything you need to know about UWB wireless technology

Fortunately, there are several limiting factors. The first is the online security layer. Consumer UWB tracking is also relatively new, and only devices with the correct radio can relay this data, such as S21 Plus or iPhone 12. In other words, the target needs the most advanced UWB ecosystem to generate accurate information, and then they have to become victims of device or server hackers. As UWB becomes ubiquitous, ecosystem barriers will disappear, and hopefully no new loopholes will be created.

There may be difficult times in the future.Ransomware attacks are on the rise because NPR Note that tracking applications is entirely possible to become a profitable target. Attacking them can take advantage of the users’ most private information and threaten the companies that rely the most on their reputation for security. At the same time, Stalkers may become more tech-savvy and take full advantage of Bluetooth/UWB tracking devices and technologies. If everything from shoes to cars has built-in tracking in 20 years, you may not be able to tell how someone is tracking you.

Even if criminal attacks are kept to a minimum, there is still the problem of government incursions, especially in authoritarian countries like China. Chinese law requires local user data to be kept on the local server. In principle this is not a bad idea, but under an authoritarian regime, the result is that if the police or intelligence agencies want to access someone’s location data, they can obtain it without much effort. More trackers translate into more data points for monitoring and suppressing objections.

Both China and Russia regularly conduct cyber espionage activities against the United States, Canada, and Europe. They have an obvious motivation to collect as much target location data as possible-imagine someone who knows the daily habits of a politician or general, or just someone who has access to confidential data. This type of espionage can also be used to assess the vulnerabilities of future hacker attacks and mark devices that the spies may not know.

Despite this, the worst-case scenario rarely happens, and public and private organizations are ultimately strengthening cybersecurity efforts, mainly to avoid paying millions of dollars in ransoms. We only need to apply it to Bluetooth and UWB tracking, just as it applies to banks and hospitals.

read more: How to manage your location data

There are a few things that manufacturers of apps, devices, and accessories can do. First, anti-tracking measures like AirTags and SmartTags must be popularized and enabled by default. 2FA should probably be an option for all tracking apps in the Play Store or App Store, and is mandatory for people using first-party Android and iOS tracking.

If you have any fears, you can take some personal steps that go beyond 2FA and cannot completely disable location data. For example, you can manage location sharing on an application-by-application or device-by-device basis, and periodically clean up location history when allowed. A virtual private network (VPN) can help block IP and add additional network security.

It’s also good to be widely known in the social space. By paying close attention to the people around you and where your belongings are, you can reduce the risk of threats such as robbery and pickpocketing, not just tracking. Finally, use Bluetooth/UWB trackers sparingly-although the idea of ​​never losing anything is good, ask yourself how often you lose a given object and whether you need more tracking in your life.