Editorials

An idea to make most tech theft useless

Virus - for some reason we don't have an alt tag hereI’d been at home since Wednesday of last week with a 2yo while my wife and 4yo went off to visit family and friends so I had some time to think about things, although not time to write much.

There’s a rather huge crime spree in my neighborhood lately. I’m no stranger to being burgled. Neighborhood changed from safe and cozy, to the IT destination (tall and skinnies, $500,000 shacks, etc.) I have had a lot of tech looted from my car, house, and office. Mostly little rinky dink WiFi or Bluetooth things.

Recently someone on our district page lost a smart TV, an iPad 2, and a couple of Bluetooth thingies of little value. The burglars had kicked into the house, yanked the security panel off the wall, pulled the battery and motherboard, and then took their time because the thing hadn’t yelped for help.

There was a comment that this stuff was all untraceable (the iPad 2 was WiFi only,) and that started me wondering – are smart things really untraceable? Shouldn’t they actually easier to trace?

Let’s step out a minute and take a look at a tracker company called TILE. You can take a look at any of the smart tag companies. They sell a tag, it’s a Bluetooth beacon. When the tag is out of range the app reports position to the server. It also reports any other TILEs it comes into contact with. Registered owners of the tags are the only people who can see the location of the tags so you don’t have to worry about person A sniffing your tag and then finding out where you spend your nights.

Every Bluetooth and WIFi device out there has a MAC address. This is a unique identifier that theoretically no other device on the planet should have. Read should. There are plenty of exceptions. We’ll skip the exceptions for this piece.

Now, your phone is passively scanning regularly in the background to see if a network you’ve joined or Bluetooth device is in range. Bluetooth sniff range is about 30 meters or 100 feet. WiFi sniff range is generally longer than that. Basically you can hear a WiFi or a Bluetooth way way before you’re in range to connect to it.

MAC addresses are regularly used to track your movement in chain stores (it’s to see where you linger, what interests you, tie your phone to a profile they can use to market.)

So why can’t we have an app that when you’re home you press “all this stuff you can sniff is mine” and it runs in the background using the passively collected WiFi/BT data, and if your stuff gets taken you then push “my stuff is gone” and a server then starts flagging approximate locations the devices are seen?

Much like TILE, you’re going to need an app on a lot of people’s phones, but perhaps this is something the big finding companies could incorporate into their existing apps as they’re already gathering and transmitting the other data.

Much like War Driving for WiFi hotspots, police or citizens who don’t particularly like being a hotbed of criminal activity could more actively participate while plugged in and driving. People who purchase stolen equipment could find out that it’s stolen and report the seller just by powering it up and attempting to claim it.

Suddenly gadget crime is useless.

Or maybe I’m being overly optimistic.

The things I do not know about this

  • Can WiFi MACs be sniffed when they’re joined to a network you’re not joined to.
  • Percentage of bad/duplicate MAC addresses on Bluetooth/WiFi devices.

Anyway, that’s the idea – need a programmer to take a look at it to see if it’s doable but I think it probably is.

Pocketables does not accept targeted advertising, phony guest posts, paid reviews, etc. Help us keep this way with support on Patreon!
Become a patron at Patreon!

Paul E King

Paul King started with GoodAndEVO in 2011, which merged with Pocketables, and as of 2018 he's evidently the owner. He lives in Nashville, works at a film production company, is married with two kids. Facebook | Twitter | Donate | More posts by Paul | Subscribe to Paul's posts

Avatar of Paul E King

8 thoughts on “An idea to make most tech theft useless

  • Avatar of Paul M

    This is a good idea and one I’ve pondered. Some years ago we were burgled and the thieves were true professionals, they stripped us of most electronic items.. two laptops (and they were careful to take the chargers, network cables, headphones etc!), portable digital radios (including chargers and headphones), an original xbox (ahem, modified) and things.
    I was able to give the police the make, model, serial numbers, and the ethernet mac addresses (cable and wifi). The police were surprised at the details I had, and said it was very rare that people even remembered the make, let alone model and serial!
    None of it was ever found, nobody prosecuted.

    The only good thing was that I’d renewed our house contents ten days before and had decided to go with a very high quality policy which was “new for old”, rather than the cheapest, so we got the full price to replace everything. My Sharp Zaurus was valued at over US$500 because there was only one place you could buy them in Europe!

    Reply
    • Avatar of Paul M

      Oh, anyway, once apon a time, knowing a wifi mac would be very useful. However, Apple and Google have realised that many hotspot providers actively track people using wifi, particularly in shopping malls, and sell the movement patterns to retail analysts,
      Apple and now Google are using mac randomisation to prevent this. Also, IPv6 with EUI64 addressing (which revealed the mac) has been supplanted by IPv6 privacy extensions which prevent tracking.

      So, sadly, great idea, but now not useful.

      Reply
      • So that cuts out some phones that are stolen, shouldn’t have any effect on BT devices, can tell you my TV’s WiFi is always on the same MAC.

        According to this only 6% of Android phones use MAC randomization: https://arstechnica.com/information-technology/2017/03/shielding-mac-addresses-from-stalkers-is-hard-android-is-failing-miserably/

        And according to this: https://www.theregister.co.uk/2017/03/10/mac_address_randomization/ you can track 100% of phones regardless of MAC randomization by tracking control frames sent out by chipsets. This is iOS and Android.

        Reply
        • Avatar of Paul M

          interesting.
          so, due to bugs in mac randomisation and thus privacy protection flaws, you’ve got a better chance of getting your device back.

          we thus need some trusted service for devices to record and log the MAC of any bluetooth devices and wifi devices along with location. you’d register your devices with that service, and if stolen, you’d report as lost/stolen, and perhaps you’d get the device back.

          a few years ago my daughter’s tablet was stolen. I wondered about trying to get Google to tell me if they knew where the device was, because surely Google Play knows things about your device like serial number and maybe the wifi MAC?

          Reply
          • Avatar of Paul M

            maybe the geolocation services which rely on wifi hotspots having a fixed location could provide this service?
            when you interrogate them, your device would tell their servers a list of wifi devices you’ve seen recently.

          • yup, like what the TILE app does for Bluetooth devices.

          • Avatar of Paul M

            ok, lets do this.
            first, we need about 10M in funding.
            actually, no, “first, we kill all the lawyers” – Shakespeare.

          • It should be noted that the devices that actually use MAC randomization should also be useless if stolen to begin with. My phone gets stolen they have to have the previous user’s username and password to get around the bootloader lock.

            Unless they’re using a writer of some sort.

            Only phones that are useless to a thief to begin with have the thing that might protect them from my evil plan

Leave a Reply

Your email address will not be published. Required fields are marked *