Security News > 2021 > September > Norwegian student tracks Bluetooth headset wearers by wardriving around Oslo on a bicycle

A Norwegian student who went wardriving around Oslo on a pushbike has discovered that several popular models of Bluetooth headphones don't implement MAC address randomisation - meaning they can be used to track their wearers.

Norwegian state broadcaster NRK revealed Bjorn Hegnes' findings after helping him analyse Bluetooth emissions from a dozen different models of audio headphones, contained within 1.7 million Bluetooth messages he intercepted.

Without that randomisation, it was trivial for the devices to be pinged repeatedly, revealing their wearers' precise location as they travelled around the city of Oslo.

"The data were collected by Hegnes by bike throughout Oslo with a Bluetooth receiver. The first couple of trips were used to test the device and the procedures, then he endeavored on a 300km-long trip over 12 days. The antenna picked up Bluetooth messages within a radius of 100 metres," reported NRK this week.

NRK prepared some maps, available on its website, showing where particular device owners had been travelling around the Norwegian capital.

A set of Bluetooth earbuds or headphones isn't what springs to mind when you think of an IoT device - yet it can apparently still pose a privacy risk.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/09/04/bluetooth_headphones_tracking_oslo/