1
00:00:00,000 --> 00:00:02,999
Welcome to the Bluetooth device database.

2
00:00:02,999 --> 00:00:03,999
Ryan Holeman.

3
00:00:03,999 --> 00:00:04,999
Take it away.

4
00:00:08,999 --> 00:00:12,584
(Applause.)    RYAN HOLEMAN: Thank you for coming.

5
00:00:12,918 --> 00:00:14,501
Last talk of the day.

6
00:00:14,501 --> 00:00:19,083
Everyone having fun so far?

7
00:00:19,083 --> 00:00:21,501
So this project is a little more high level than some

8
00:00:21,501 --> 00:00:23,999
of my previous projects.

9
00:00:24,959 --> 00:00:27,542
If you're getting into Bluetooth, it's really fun to see it

10
00:00:27,542 --> 00:00:29,459
at this type of view.

11
00:00:29,876 --> 00:00:32,999
I don't think it's ever been looked at in this way and I believe that you

12
00:00:32,999 --> 00:00:37,000
need to look at devices in the wild in order to understand the technology.

13
00:00:37,542 --> 00:00:40,083
So basically, in short, this project was to be

14
00:00:40,083 --> 00:00:45,375
the largest scale Bluetooth device survey I've seen out there.

15
00:00:45,375 --> 00:00:48,834
And I gave a lot of support to the community.

16
00:00:49,375 --> 00:00:51,250
I have a lot of clients.

17
00:00:53,999 --> 00:00:58,999
Install this stuff and send me your data, it's for everyone, not just for me.

18
00:00:59,292 --> 00:01:02,751
So a little about myself before I get started.

19
00:01:03,083 --> 00:01:04,626
That's a great picture of me.

20
00:01:05,626 --> 00:01:09,250
I'm a senior I used to be a server developer,

21
00:01:09,250 --> 00:01:13,834
security researcher at Ziften Technologies where we do

22
00:01:13,834 --> 00:01:17,167
a lot of management solutions.

23
00:01:18,667 --> 00:01:21,999
If you haven't heard about us, check us out.

24
00:01:21,999 --> 00:01:23,999
We do tool stuff.

25
00:01:23,999 --> 00:01:27,083
In my spare time I spend a lot of time tinkering with Bluetooth.

26
00:01:27,459 --> 00:01:33,167
I have Python uber tooth projects I have up on GitHub.

27
00:01:34,834 --> 00:01:36,209
Fun stuff.

28
00:01:36,375 --> 00:01:38,999
I have fun doing this stuff in spare time.

29
00:01:38,999 --> 00:01:41,792
Follow me on Twitter to follow any projects I'm doing and

30
00:01:41,792 --> 00:01:45,709
all this research today is just kind of on my own.

31
00:01:45,709 --> 00:01:47,792
It has nothing to do with existence, they just allow me to come

32
00:01:47,792 --> 00:01:49,999
out and present to you guys.

33
00:01:51,334 --> 00:01:57,250
So as I mentioned before, at its core the Bluetooth device survey was one

34
00:01:57,250 --> 00:02:01,709
of the widest scale surveys I'm aware of.

35
00:02:02,999 --> 00:02:05,751
I did it because I had a lot of questions about devices

36
00:02:05,751 --> 00:02:09,083
in the wild and there weren't any data sets big enough and broad enough

37
00:02:09,083 --> 00:02:11,417
to answer a lot of my questions so I just kinds

38
00:02:11,417 --> 00:02:13,125
of took this on.

39
00:02:13,334 --> 00:02:17,501
And as I kinds went through this and started doing analysis on the data,

40
00:02:17,501 --> 00:02:21,999
I became aware of a lot of things I wasn't aware of before.

41
00:02:21,999 --> 00:02:24,999
A lot of questions got risen and I was able to come up with a lot

42
00:02:24,999 --> 00:02:28,083
of answers for them and learn new things.

43
00:02:28,459 --> 00:02:33,999
And so all of this project was done only on discoverable devices.

44
00:02:33,999 --> 00:02:35,584
And a lot of people say hey, why did you only do

45
00:02:35,584 --> 00:02:37,667
discoverable devices?

46
00:02:37,667 --> 00:02:39,999
You do a lot of passive stuff in your spare time.

47
00:02:40,999 --> 00:02:42,626
Well, the number one reason was

48
00:02:42,626 --> 00:02:44,626
convenience, right?

49
00:02:44,626 --> 00:02:47,209
I could write a simple iPhone app and put it in my pocket and walk

50
00:02:47,209 --> 00:02:49,375
around and scan things.

51
00:02:49,792 --> 00:02:51,709
People don't really like it when you walk

52
00:02:51,709 --> 00:02:54,999
around with big antennas in crowds and computers.

53
00:02:55,918 --> 00:02:59,083
So that was the main reason was for convenience.

54
00:02:59,459 --> 00:03:01,459
That and secondly, there wasn't anything done

55
00:03:01,459 --> 00:03:03,999
at this wide a scale before.

56
00:03:03,999 --> 00:03:07,292
And when we look at stuff with passive monitoring we miss

57
00:03:07,292 --> 00:03:10,999
a lot of stuff I was interested in such as upper halves

58
00:03:10,999 --> 00:03:13,667
of Bluetooth addresses.

59
00:03:14,834 --> 00:03:16,999
So what was I interested in.

60
00:03:16,999 --> 00:03:18,375
Mostly Bluetooth addresses.

61
00:03:18,834 --> 00:03:23,501
But along with this comes device information along with device name.

62
00:03:23,501 --> 00:03:25,751
Since I was doing all this for mobile devices,

63
00:03:25,751 --> 00:03:29,834
geo location was easy to add in there and any other metadata I get

64
00:03:29,834 --> 00:03:35,125
with a simple scan so this would be device class information, et cetera.

65
00:03:35,584 --> 00:03:38,083
I did nothing that was actually probing you know, Bluetooth ports

66
00:03:38,083 --> 00:03:40,999
or anything like that because that typically takes time and

67
00:03:40,999 --> 00:03:44,083
by the time Bluetooth object moves on, you wouldn't actually be able

68
00:03:44,083 --> 00:03:45,999
to complete the scan.

69
00:03:46,999 --> 00:03:49,834
So what were the tools that I used for this project?

70
00:03:49,834 --> 00:03:52,083
Everything about this project is open source.

71
00:03:52,083 --> 00:03:54,751
The clients and I have a simple server too you can implement

72
00:03:54,751 --> 00:03:59,375
if you don't want to send all your data up to my managed server.

73
00:03:59,501 --> 00:04:02,834
But the main client that I created was an iOS client.

74
00:04:02,959 --> 00:04:04,999
It will not be in the app store.

75
00:04:06,501 --> 00:04:10,999
I had to leverage a lot of private libraries and APIs that Apple

76
00:04:10,999 --> 00:04:14,584
does not allow to go through making applications run

77
00:04:14,584 --> 00:04:17,083
in the background 24/7.

78
00:04:17,459 --> 00:04:19,999
They don't allow you to put that stuff there.

79
00:04:19,999 --> 00:04:23,167
But it's up on GitHub repo an you can compile it and throw it

80
00:04:23,167 --> 00:04:25,083
on your phone.

81
00:04:25,083 --> 00:04:28,083
For cross platform support if you saw Joseph Paul Cohen's talk

82
00:04:28,083 --> 00:04:32,167
about an hour ago, in order to support cross platform, I hacked

83
00:04:32,167 --> 00:04:35,083
up one of his Blucat clients.

84
00:04:35,083 --> 00:04:37,918
I have a fork of it on my repo and basically the data it collects

85
00:04:37,918 --> 00:04:40,999
will ship off to the remote server too.

86
00:04:41,626 --> 00:04:44,459
The server if you want to participate in this project

87
00:04:44,459 --> 00:04:47,792
but you don't want your data to go out to the public, I have

88
00:04:47,792 --> 00:04:51,083
a simple server implementation on my GitHub repo too so you can

89
00:04:51,083 --> 00:04:54,834
change the URL and have it report to your server.

90
00:04:55,083 --> 00:05:00,083
Any data I collect or any data that I collect is open to people.

91
00:05:00,083 --> 00:05:01,751
I do a database dump once a week, you can't use

92
00:05:01,751 --> 00:05:04,167
the information track someone.

93
00:05:04,167 --> 00:05:05,999
I'm giving them a week headstart.

94
00:05:07,876 --> 00:05:10,083
So there are similar projects.

95
00:05:10,334 --> 00:05:13,250
There was nothing that kind of hit this broad

96
00:05:13,250 --> 00:05:16,334
of a scale app was a project similar run

97
00:05:16,334 --> 00:05:21,083
by Josh Wright where he was trying to correlate the upper half

98
00:05:21,083 --> 00:05:27,167
of an address vendor specific to an actual device it correlates to.

99
00:05:27,501 --> 00:05:29,999
So this was a little different.

100
00:05:30,375 --> 00:05:32,918
It didn't really follow what I wanted to look at.

101
00:05:32,999 --> 00:05:34,999
JP dunning did a couple years ago did

102
00:05:34,999 --> 00:05:38,209
the Bluetooth profiling project.

103
00:05:38,209 --> 00:05:40,083
And it was similar to mine.

104
00:05:40,125 --> 00:05:42,918
It didn't have the capability for shipping to remote server

105
00:05:42,918 --> 00:05:44,876
like these clients do.

106
00:05:44,876 --> 00:05:47,125
Didn't have geo server location.

107
00:05:47,125 --> 00:05:49,125
It was looking at unique devices whereas,

108
00:05:49,125 --> 00:05:53,459
repeated sightings in my data is really important.

109
00:05:53,959 --> 00:05:55,542
Things like this.

110
00:05:55,542 --> 00:05:58,083
And you know, Bluetooth changes from year to year.

111
00:05:58,083 --> 00:06:00,999
His last scan was from, like, two years ago and so you know you

112
00:06:00,999 --> 00:06:04,959
wouldn't see things that came out in the last year or two.

113
00:06:04,959 --> 00:06:07,083
This stuff kind of changed really quickly.

114
00:06:07,250 --> 00:06:12,083
There are some closed source projects that kind of do this it detection stuff.

115
00:06:12,459 --> 00:06:15,083
So wireless works as a company.

116
00:06:15,292 --> 00:06:18,209
If you've been paying attention to the media lately, there's been

117
00:06:18,209 --> 00:06:20,667
a big stink about malls and department stores

118
00:06:20,667 --> 00:06:23,083
tracking you based on your cell phone's wireless

119
00:06:23,083 --> 00:06:24,999
probing, right?

120
00:06:24,999 --> 00:06:28,834
Wireless works is kind of the Bluetooth version of this.

121
00:06:28,834 --> 00:06:29,876
They track you going into a store based

122
00:06:29,876 --> 00:06:31,999
on Bluetooth information.

123
00:06:32,459 --> 00:06:34,999
There's not a lot of information about them online, so, if anyone

124
00:06:34,999 --> 00:06:37,375
is familiar with them, I wouldn't mind talking to you

125
00:06:37,375 --> 00:06:39,083
after the talk.

126
00:06:39,626 --> 00:06:42,709
Houston's Transstar system use Bluetooth to even though I'm

127
00:06:42,709 --> 00:06:46,292
from Texas, I have nothing to do with this project.

128
00:06:46,584 --> 00:06:49,125
But they use Bluetooth to detect traffic patterns

129
00:06:49,125 --> 00:06:51,125
in Texas highways.

130
00:06:51,584 --> 00:06:53,876
So obviously these projects don't open the data sets

131
00:06:53,876 --> 00:06:57,125
up to the public so it wasn't much use to me.

132
00:06:57,125 --> 00:06:59,709
But it's interesting to know they're out there.

133
00:07:00,083 --> 00:07:05,292
So the database right now has over 12,000 sightings and 5,000 actual

134
00:07:05,292 --> 00:07:07,459
unique devices.

135
00:07:07,709 --> 00:07:11,999
This is kind of like my collection over time for the last couple months.

136
00:07:11,999 --> 00:07:15,584
As you can see, Vegas was pretty lucrative.

137
00:07:15,834 --> 00:07:20,209
It would be the last couple days on the end of the time series here.

138
00:07:20,751 --> 00:07:24,999
One of the first questions I what is the most discoverable device.

139
00:07:25,334 --> 00:07:30,709
If you saw Joseph Paul Cohen's talk an hour ago you might have a hint.

140
00:07:30,751 --> 00:07:32,834
Anyone here want to take a guess?

141
00:07:36,375 --> 00:07:40,792
It was blackberries, they win by a landslide.

142
00:07:41,083 --> 00:07:44,083
This is broken out based on device name.

143
00:07:44,083 --> 00:07:48,999
There is error here but I had to munch some of the data.

144
00:07:48,999 --> 00:07:51,999
A lot of the devices we get back in have generic names.

145
00:07:51,999 --> 00:07:54,417
You don't get the name on the first scan so they'd be bucketed

146
00:07:54,417 --> 00:07:57,584
into mobile phone so for this data set I truncated that

147
00:07:57,584 --> 00:07:59,501
information off.

148
00:07:59,751 --> 00:08:01,792
But for the most part if you take the top 10 in this list,

149
00:08:01,792 --> 00:08:05,083
it's pretty accurate as far as what's really out there.

150
00:08:05,167 --> 00:08:08,417
You know, Apple products, Mac books, iPhone, Roku, just going

151
00:08:08,417 --> 00:08:10,959
down the list of the top 5.

152
00:08:13,709 --> 00:08:15,250
IPads.

153
00:08:15,542 --> 00:08:17,959
I'll get into the information a little bit.

154
00:08:21,751 --> 00:08:24,959
I kind of truncated a lot of this material.

155
00:08:24,959 --> 00:08:26,584
I thought this was a 20 minute talk but they gave me more so I get

156
00:08:26,584 --> 00:08:28,542
to take my time on this.

157
00:08:28,542 --> 00:08:31,459
But some of the things we can do with geo location on this,

158
00:08:31,459 --> 00:08:34,999
the way I was collecting data is a lot different than a lot

159
00:08:34,999 --> 00:08:38,999
of other techniques where most techniques as far as wireless works

160
00:08:38,999 --> 00:08:42,459
or the Texas Department of Transportation they're basically

161
00:08:42,459 --> 00:08:46,167
a stationary sell and you can assume that anything passing them

162
00:08:46,167 --> 00:08:49,250
is a mobile device, so it's moving.

163
00:08:49,542 --> 00:08:52,834
With my survey it was a little different.

164
00:08:52,834 --> 00:08:54,125
I was the moving device so it's really hard for me

165
00:08:54,125 --> 00:08:57,999
to determine am I seeing a moving device on the other side?

166
00:08:58,250 --> 00:09:00,918
So in order to do this, I would take I would have

167
00:09:00,918 --> 00:09:04,709
to see a device more than once, I need two or more sightings,

168
00:09:04,709 --> 00:09:07,751
I would take the two farthest geo location points

169
00:09:07,751 --> 00:09:12,209
in order to correlate it and bucket it into how much this device moves So

170
00:09:12,209 --> 00:09:16,292
for this I'm getting about over 70% of the devices I actually saw

171
00:09:16,292 --> 00:09:18,083
were moving.

172
00:09:18,292 --> 00:09:23,375
And you can bucket them out into how much distance I actually

173
00:09:23,375 --> 00:09:25,751
saw them moving.

174
00:09:25,751 --> 00:09:31,083
Because I'm one person, it was hard for me to see things at a hard chain.

175
00:09:32,209 --> 00:09:35,501
I had less than 5% that saw them.

176
00:09:37,584 --> 00:09:39,459
Cool way to look at the data.

177
00:09:39,751 --> 00:09:41,626
I liked it.

178
00:09:41,626 --> 00:09:44,999
Another thing you can do that's cool with geo location information.

179
00:09:44,999 --> 00:09:48,083
You can look at the reoccurrence of it in your data set.

180
00:09:48,250 --> 00:09:51,918
In the top picture here this is a local Costco I go to time

181
00:09:51,918 --> 00:09:56,999
after time and always have my phone on scanning the devices in there.

182
00:09:56,999 --> 00:10:00,626
So in this map you can see the blue dots and these are devices that

183
00:10:00,626 --> 00:10:04,918
are stationary and local to this particular Costco I go to and

184
00:10:04,918 --> 00:10:09,751
all the red dots are devices which are not local to this.

185
00:10:09,751 --> 00:10:13,918
So these would be most likely people traversing the store at the time.

186
00:10:13,999 --> 00:10:15,584
So that's one way you can look at geo location information

187
00:10:15,584 --> 00:10:17,999
with this stuff which is pretty neat.

188
00:10:17,999 --> 00:10:22,000
The other way I call it solving the small world phenomena where that

189
00:10:22,000 --> 00:10:26,000
would be assume you live in Cleveland and your friend lives

190
00:10:26,000 --> 00:10:27,626
in L.A.

191
00:10:27,626 --> 00:10:28,999
and you meet in Denver.

192
00:10:28,999 --> 00:10:30,417
Small world.

193
00:10:33,959 --> 00:10:35,999
This bottom picture is the route I skateboard

194
00:10:35,999 --> 00:10:37,999
to work every day.

195
00:10:38,459 --> 00:10:41,042
It's an access road so there's not a lot of traffic.

196
00:10:41,250 --> 00:10:45,959
But the blue dots denoted in this image are cars I pass multiple

197
00:10:45,959 --> 00:10:49,417
times whereas, the red dots are cars I would never

198
00:10:49,417 --> 00:10:51,042
see again.

199
00:10:51,626 --> 00:10:52,999
So this is something that you would never

200
00:10:52,999 --> 00:10:54,999
really realize on your own.

201
00:10:54,999 --> 00:10:55,999
You're not going to memorize every car that you pass

202
00:10:55,999 --> 00:10:57,250
every day.

203
00:10:57,584 --> 00:11:00,375
It's a cool way to look at data set.

204
00:11:04,292 --> 00:11:06,083
Geo location is cool.

205
00:11:06,083 --> 00:11:09,250
It was something I to tack on to see the data a different way.

206
00:11:09,250 --> 00:11:12,417
I was interested in the Bluetooth address space.

207
00:11:12,834 --> 00:11:18,459
I threw this in there because nobody everybody is familiar.

208
00:11:21,999 --> 00:11:25,584
So Bluetooth addresses are laid out a lot like a Mac address

209
00:11:25,584 --> 00:11:28,501
and you have the upper half being vendor specific

210
00:11:28,501 --> 00:11:31,751
and lower half being device specific.

211
00:11:31,751 --> 00:11:35,501
The device specific half is supposed to be unique across devices

212
00:11:35,501 --> 00:11:38,792
and once you get into the vendor specific part,

213
00:11:38,792 --> 00:11:42,459
we split it up into the NAP and the UAP.

214
00:11:42,751 --> 00:11:44,999
UAP is when we do something passive monitoring

215
00:11:44,999 --> 00:11:49,209
in Bluetooth we don't always get it and NAP we never get.

216
00:11:49,751 --> 00:11:51,999
Even though all this date data I did research

217
00:11:51,999 --> 00:11:54,292
on was for discoverable devices I wanted

218
00:11:54,292 --> 00:11:57,250
to take the data set and use it in the techniques

219
00:11:57,250 --> 00:12:00,209
for passive Bluetooth monitoring.

220
00:12:01,542 --> 00:12:05,417
So I don't know if I mentioned but basically when we do passive

221
00:12:05,417 --> 00:12:10,834
Bluetooth monitoring, the lap is the only thing we're guaranteed ever.

222
00:12:11,125 --> 00:12:14,626
One of the things I wanted to determine if I were to go back

223
00:12:14,626 --> 00:12:17,999
and do this whole survey again with only you know,

224
00:12:17,999 --> 00:12:21,999
Bluetooth passive monitoring, I would most likely only get lap

225
00:12:21,999 --> 00:12:24,792
addresses for geo location.

226
00:12:24,792 --> 00:12:27,501
So what I really wanted to know is are lab addresses unique

227
00:12:27,501 --> 00:12:30,999
or are vendors printing and pressing them out and using

228
00:12:30,999 --> 00:12:33,834
the same LAP over and over.

229
00:12:33,834 --> 00:12:37,125
Lo and behold it turns out their they're not.

230
00:12:37,417 --> 00:12:39,999
LAPs are evenly distributed.

231
00:12:40,083 --> 00:12:43,125
So all the devices I saw which is around 5,000,

232
00:12:43,125 --> 00:12:45,999
I only had one collision and that happened

233
00:12:45,999 --> 00:12:48,501
at around 3,000 devices.

234
00:12:48,834 --> 00:12:50,999
So which isn't too bad.

235
00:12:51,083 --> 00:12:54,083
That's an acceptable loss for me if I'm scanning a bunch of devices

236
00:12:54,083 --> 00:12:58,125
and I get a collusion every 3 or 4,000, that's not too bad.

237
00:12:58,999 --> 00:13:02,501
This graph here doesn't mean anything, it looked cool.

238
00:13:02,501 --> 00:13:07,999
It was basically from 00 to FF like the whole 256 bytes you can get

239
00:13:07,999 --> 00:13:14,999
for all sections the lap, just how evenly it is distributed across.

240
00:13:14,999 --> 00:13:17,626
You can see there's no hotspots and that's that led me

241
00:13:17,626 --> 00:13:20,083
to believe it is unique.

242
00:13:25,542 --> 00:13:29,751
UAP is something that we do get in passive monitoring sometimes.

243
00:13:29,876 --> 00:13:31,125
It depends on whether or not the traffic that goes

244
00:13:31,125 --> 00:13:33,250
over the wire has a pay load.

245
00:13:33,667 --> 00:13:35,876
So by looking at it in active devices

246
00:13:35,876 --> 00:13:40,876
across the board we can drive cool information about it.

247
00:13:40,876 --> 00:13:44,584
It looks as if the whole address space is pretty much used

248
00:13:44,584 --> 00:13:49,083
as UAPs and there is a hotspot for popular UAPs.

249
00:13:49,667 --> 00:13:54,292
This can be used for mostly if you were to grab if you only had

250
00:13:54,292 --> 00:13:57,375
an LAP and you wanted to just derive what

251
00:13:57,375 --> 00:14:02,209
the most probable UAP is, you could use the top one.

252
00:14:02,417 --> 00:14:05,417
I guess if you really wanted to, you could use it for brute force

253
00:14:05,417 --> 00:14:08,999
in UAPs though it's not the most effective thing.

254
00:14:10,125 --> 00:14:12,083
But it was just interesting.

255
00:14:12,083 --> 00:14:15,999
I saw there was a hotspot with UAPs, a lot are used more than others.

256
00:14:15,999 --> 00:14:19,959
And this is only the top 35UAPs.

257
00:14:20,125 --> 00:14:22,417
So basically, the last, you know, 200 some

258
00:14:22,417 --> 00:14:27,751
of them that you're getting down into one device sighting per UAP.

259
00:14:27,999 --> 00:14:29,959
So it tails out pretty nicely.

260
00:14:31,501 --> 00:14:33,626
So this is the coolest thing.

261
00:14:33,876 --> 00:14:35,125
I'm a nerd.

262
00:14:35,709 --> 00:14:38,334
This is my favorite part of all the research.

263
00:14:38,417 --> 00:14:42,501
So in passive monitoring, we do not get NAPs.

264
00:14:42,542 --> 00:14:47,334
So what I really wanted to do is see if I could derive an NAP based

265
00:14:47,334 --> 00:14:51,918
on probability of the rest of its address space.

266
00:14:53,459 --> 00:14:57,417
So you need an NAP if you want to correlate a device to a vendor

267
00:14:57,417 --> 00:15:00,584
and since we don't get this in passive monitoring,

268
00:15:00,584 --> 00:15:04,292
what I was looking for here is are there higher probabilities

269
00:15:04,292 --> 00:15:07,999
of getting particular NAPs based on a UAP.

270
00:15:07,999 --> 00:15:09,584
So this was pretty interesting.

271
00:15:09,584 --> 00:15:13,292
Right here I have basically this graph is just the first 8 addresses,

272
00:15:13,292 --> 00:15:18,999
first 8 UAP addresses based out of 208 possibilities from 00 to 207.

273
00:15:20,501 --> 00:15:24,999
For every UAP I have correlating NAPs with that.

274
00:15:24,999 --> 00:15:28,125
So what we can basic by do here is say if you have a UAP, what

275
00:15:28,125 --> 00:15:33,292
is your most probable NAP based on devices seen out in the wild?

276
00:15:33,792 --> 00:15:36,375
As it turns out this is actually pretty good for coming

277
00:15:36,375 --> 00:15:39,834
up with a high probability of what it is.

278
00:15:40,167 --> 00:15:43,918
Worst case scenario, I think there's 8NAPs associated

279
00:15:43,918 --> 00:15:47,999
with one or two of the UAPs on the list.

280
00:15:47,999 --> 00:15:50,999
But a 1 in 8 probability isn't too bad and you're able

281
00:15:50,999 --> 00:15:53,584
to see which are used the most.

282
00:15:53,584 --> 00:15:56,501
So you can narrow that down into the highest probability.

283
00:15:57,083 --> 00:15:59,375
So that was pretty interesting.

284
00:15:59,375 --> 00:16:01,125
That's your worst case scenario.

285
00:16:01,542 --> 00:16:03,999
Best case scenario which happens to be for the majority

286
00:16:03,999 --> 00:16:06,999
of all UAPs there's only 1, 2, 3, NAPs actually associated

287
00:16:06,999 --> 00:16:08,959
with those UAPs.

288
00:16:08,999 --> 00:16:11,999
So for the majority of the time you can marrow it

289
00:16:11,999 --> 00:16:15,417
down to the 1 or 2 and then increase probability based

290
00:16:15,417 --> 00:16:18,125
on how many times you saw it.

291
00:16:18,209 --> 00:16:22,083
This is interesting, last year I touched on this subject

292
00:16:22,083 --> 00:16:24,834
but he was just looking at vendor lists

293
00:16:24,834 --> 00:16:28,918
to my NAP probabilities were, you know, I would have 40 60,

294
00:16:28,918 --> 00:16:31,834
NAPs which is not as useful.

295
00:16:31,834 --> 00:16:35,542
If I can tell you I can give you three possible vendors, that's pretty good.

296
00:16:36,667 --> 00:16:38,999
So on to vendor statistics.

297
00:16:39,250 --> 00:16:43,250
This stuff can be used for two different purposes, I think.

298
00:16:43,584 --> 00:16:47,250
One is increasing probability even more from the last slides you talked about so,

299
00:16:47,250 --> 00:16:50,292
if you had 2 NAPs that were tied you could weight it based

300
00:16:50,292 --> 00:16:53,334
on actual vendor which is most popular.

301
00:16:53,834 --> 00:16:57,167
Other thing to look at is what are the most popular vendors

302
00:16:57,167 --> 00:16:59,125
for Bluetooth.

303
00:16:59,250 --> 00:17:01,417
Apple takes the cake.

304
00:17:01,417 --> 00:17:03,250
I said BlackBerry was the number one actual device

305
00:17:03,250 --> 00:17:07,667
but Apple has more products so they're taking the case with this.

306
00:17:07,667 --> 00:17:08,834
BlackBerry in second.

307
00:17:08,834 --> 00:17:10,417
Samsung does a lot of embedded devices so they're far

308
00:17:10,417 --> 00:17:11,918
up there.

309
00:17:12,250 --> 00:17:14,501
Rokus was interesting.

310
00:17:14,501 --> 00:17:17,542
I saw a lot during this scan and before I started doing correlations,

311
00:17:17,542 --> 00:17:22,083
I thought Rokus might be the most popular device I saw out there.

312
00:17:22,542 --> 00:17:24,459
But they're pretty high up on the list.

313
00:17:24,584 --> 00:17:25,999
Kind of interesting to know.

314
00:17:29,834 --> 00:17:33,459
And and I was getting Roku boxes driving down the road which

315
00:17:33,459 --> 00:17:38,999
is crazy which means I'm probably getting 50 70 feet based on an iPhone.

316
00:17:39,209 --> 00:17:41,083
So they're very loud.

317
00:17:42,999 --> 00:17:44,584
Security.

318
00:17:44,584 --> 00:17:46,334
So what does this mean for security?

319
00:17:46,918 --> 00:17:50,083
You know, you can be tracked with Bluetooth.

320
00:17:50,083 --> 00:17:52,167
It's not something everyone knows.

321
00:17:52,584 --> 00:17:55,417
I think that if it is something that is important to you,

322
00:17:55,417 --> 00:17:58,626
you're probably best turning Bluetooth off.

323
00:17:59,999 --> 00:18:04,250
And on top of that, Bluetooth is a security protocol itself.

324
00:18:04,250 --> 00:18:07,167
But there are vulnerabilities that exist out there.

325
00:18:07,417 --> 00:18:10,417
It's mostly based on software implementations,

326
00:18:10,417 --> 00:18:13,876
vendors who will create services that accept

327
00:18:13,876 --> 00:18:17,167
connections without actual PIN authentication

328
00:18:17,167 --> 00:18:23,083
or easy PIN authentication connections typically you'll see that where you can

329
00:18:23,083 --> 00:18:25,918
connect 0, 0, 0, 0, 0.

330
00:18:25,918 --> 00:18:27,999
It is out there and something to be aware of.

331
00:18:28,667 --> 00:18:32,792
I think, too, like if you ever wanted to do research in this realm, this

332
00:18:32,792 --> 00:18:35,083
is the list I never had.

333
00:18:35,375 --> 00:18:39,417
If you wanted to get the most bang from your buck finding

334
00:18:39,417 --> 00:18:43,834
the most widespread device, this is the list I could go

335
00:18:43,834 --> 00:18:49,167
down and it would be interesting to go down and start doing Bluetooth

336
00:18:49,167 --> 00:18:52,999
audits on these devices, awareness.

337
00:18:53,542 --> 00:18:57,918
A lot of devices don't act how you think or you might have Bluetooth

338
00:18:57,918 --> 00:19:00,417
in places you don't know.

339
00:19:00,417 --> 00:19:02,999
A lot of people might not know it's on in your car and discoverable

340
00:19:02,999 --> 00:19:04,584
all the time.

341
00:19:04,584 --> 00:19:06,999
Or are not aware that when start up your car Bluetooth goes

342
00:19:06,999 --> 00:19:10,375
into discoverable mode for 60 seconds or longer.

343
00:19:11,999 --> 00:19:14,751
This happens in other devices besides car audios, but this

344
00:19:14,751 --> 00:19:18,209
is something some people might not be aware of and it's something you can't

345
00:19:18,209 --> 00:19:20,501
turn off most of the time.

346
00:19:21,501 --> 00:19:23,751
And I did notice a lot of bugs.

347
00:19:23,751 --> 00:19:25,083
If you notice in my device list broken

348
00:19:25,083 --> 00:19:28,167
out by actual devices out there, if you're aware

349
00:19:28,167 --> 00:19:31,667
of how iOS devices work, your Bluetooth actually goes

350
00:19:31,667 --> 00:19:37,209
into discoverable mode only when you go to your Bluetooth settings menu.

351
00:19:37,209 --> 00:19:40,083
Yet I'm seeing so many iPads and iPhones in my skins

352
00:19:40,083 --> 00:19:44,542
is there a chance I'm walking by somebody when they're actually

353
00:19:44,542 --> 00:19:47,250
configuring the Bluetooth?

354
00:19:47,250 --> 00:19:48,250
Most likely not.

355
00:19:48,584 --> 00:19:49,459
So what happens is this actually happened

356
00:19:49,459 --> 00:19:51,999
to me multiple times when I was scanning this.

357
00:19:51,999 --> 00:19:53,709
I never scanned 24/7 that it never occurred

358
00:19:53,709 --> 00:19:58,626
to me that my phone would get stuck in discoverable mode sometimes.

359
00:19:58,999 --> 00:20:01,999
It depends on how you leave the Bluetooth settings pages

360
00:20:01,999 --> 00:20:03,751
in your iOS.

361
00:20:03,876 --> 00:20:08,292
If you live too fast it gets stuck in discoverable mode.

362
00:20:08,292 --> 00:20:12,250
That's why you see them in discoverable mode so much.

363
00:20:13,209 --> 00:20:16,876
I believe the other reason why there's so many discoverable Bluetooth

364
00:20:16,876 --> 00:20:18,918
devices out there is bad human computer

365
00:20:18,918 --> 00:20:20,751
interface, right?

366
00:20:20,792 --> 00:20:23,083
Vendors just they give you that perma discoverable

367
00:20:23,083 --> 00:20:25,999
button when you don't need it.

368
00:20:26,000 --> 00:20:29,626
I'm not picking on Apple here but they did it right with iOS

369
00:20:29,626 --> 00:20:33,542
despite the bug I mentioned but in OSX they don't.

370
00:20:33,999 --> 00:20:35,000
They could have done the same thing when you go

371
00:20:35,000 --> 00:20:37,709
in the configuration page, you're in discoverable an and when you leave,

372
00:20:37,709 --> 00:20:38,999
you're not.

373
00:20:39,751 --> 00:20:42,125
They have that perma button.

374
00:20:42,125 --> 00:20:43,999
That happens with Bluetooth too.

375
00:20:50,501 --> 00:20:52,999
It does seem to be a little more personal

376
00:20:52,999 --> 00:20:55,542
because it's something that happens to you

377
00:20:55,542 --> 00:20:58,584
more than your home Wi Fi router.

378
00:20:58,626 --> 00:21:02,417
But as far as legal issues go, there's really nothing out there and it

379
00:21:02,417 --> 00:21:04,709
is just kind of based.

380
00:21:04,709 --> 00:21:07,626
Closest thing would be detecting wireless devices.

381
00:21:09,083 --> 00:21:13,417
If you don't want to be tracted, it is your responsibility as a consumer

382
00:21:13,417 --> 00:21:17,125
to turn off your Bluetooth device, not everything can be turned

383
00:21:17,125 --> 00:21:20,999
off so I don't know if that's the right answer.

384
00:21:21,999 --> 00:21:24,375
So all my data sets for this stuff can be downloaded

385
00:21:24,375 --> 00:21:26,709
from Bluetoothdatabase.com.

386
00:21:26,876 --> 00:21:30,999
As I said, I do a dump once a week.

387
00:21:32,999 --> 00:21:38,459
All the data can be downloaded from GitHub directly if you want

388
00:21:38,459 --> 00:21:41,250
to get at this stuff.

389
00:21:41,999 --> 00:21:46,417
If you need to contact me, hate mail, whatever, Ryan@Hackner.com.

390
00:21:52,250 --> 00:21:56,501
There's no time statistics except for device sightings over time,

391
00:21:56,501 --> 00:21:59,918
so I'd like to take the slides I showed you and have

392
00:21:59,918 --> 00:22:05,709
the week's most popular devices which would be easy for me to add in there.

393
00:22:05,999 --> 00:22:09,167
Community participation: Obviously the reason I'm here today.

394
00:22:09,209 --> 00:22:12,459
If you want to participate in this, you know, feel free

395
00:22:12,459 --> 00:22:16,250
to install my clients even if you don't want to submit it

396
00:22:16,250 --> 00:22:20,083
to this database, fire up your own server.

397
00:22:20,083 --> 00:22:21,250
I supply the code for it.

398
00:22:21,292 --> 00:22:25,083
Just kind of look at what's out and around you, it's fun to see

399
00:22:25,083 --> 00:22:30,209
and it will it will give you a wider idea of what's really going on out there

400
00:22:30,209 --> 00:22:32,918
in the Bluetooth space.

401
00:22:34,250 --> 00:22:39,083
Service enumeration: I didn't add this in originally.

402
00:22:39,083 --> 00:22:40,709
And I might play around with it.

403
00:22:40,709 --> 00:22:48,709
I think I didn't want it do anything too I wanted to be as evasive as I could.

404
00:22:48,709 --> 00:22:49,999
I didn't want to do RF com scannings

405
00:22:49,999 --> 00:22:52,083
on these things.

406
00:22:52,417 --> 00:22:55,959
I didn't want to interrupt people's daily scans,

407
00:22:55,959 --> 00:23:01,417
I wasn't looking to offend anyone and a passive survey, I think that

408
00:23:01,417 --> 00:23:05,626
by comparing, by doing a large scale passive survey

409
00:23:05,626 --> 00:23:08,999
and comparing the data sets it would lead

410
00:23:08,999 --> 00:23:13,125
to interesting space like you would get a wider view

411
00:23:13,125 --> 00:23:16,334
of what the actual Bluetooth deployment

412
00:23:16,334 --> 00:23:18,417
is out there.

413
00:23:18,918 --> 00:23:21,209
So you can kind of compare the sets.

414
00:23:21,209 --> 00:23:22,667
You could see out of X amount of discoverable,

415
00:23:22,667 --> 00:23:26,083
how many passive do you typically see in an area?

416
00:23:26,417 --> 00:23:27,834
Things of this nature.

417
00:23:27,834 --> 00:23:29,709
It would be cool to do with standard wait and Bluetooth

418
00:23:29,709 --> 00:23:31,083
low energy.

419
00:23:31,083 --> 00:23:34,250
I don't believe anyone's really done a large scale Bluetooth low energy scan

420
00:23:34,250 --> 00:23:36,709
which would be cool to see.

421
00:23:38,375 --> 00:23:39,584
So that is it (Applause.) I almost clapped

422
00:23:39,584 --> 00:23:40,959
for myself.

423
00:23:40,959 --> 00:23:41,083
(off mic)    RYAN HOLEMAN: So in my findings,

424
00:23:41,083 --> 00:23:43,999
it's you're always going to get in discoverable mode.

425
00:23:43,999 --> 00:23:46,999
AUDIENCE: (off mic)    RYAN HOLEMAN: In this study, OX4f.

426
00:23:46,999 --> 00:23:48,667
You're talking about the top one?

427
00:23:48,667 --> 00:23:49,667
Around 300.

428
00:23:49,667 --> 00:23:51,999
AUDIENCE: (off mic)    RYAN HOLEMAN: Oh, no.

429
00:23:51,999 --> 00:23:53,626
I don't have it broken out here.

430
00:23:53,626 --> 00:23:53,626
It would be broken out more in the NAP statistics that correlate

431
00:23:53,626 --> 00:23:54,626
with that one.

432
00:23:54,626 --> 00:23:54,626
You're asking about the NAPs that actually associated

433
00:23:54,626 --> 00:23:55,626
to that?

434
00:23:55,626 --> 00:23:55,626
AUDIENCE: (off mic)    RYAN HOLEMAN: Because some devices

435
00:23:55,626 --> 00:23:55,626
will scan with that address and it's not the actual address

436
00:23:55,626 --> 00:23:57,834
of the device, so you end up seeing it more.

437
00:23:57,834 --> 00:23:59,250
Is that what you're getting at?

438
00:23:59,250 --> 00:24:01,999
AUDIENCE: (off mic)    RYAN HOLEMAN: I don't know.

439
00:24:01,999 --> 00:24:04,751
Some of this stuff is black magic to me so I don't know.

440
00:24:04,751 --> 00:24:05,751
Cool.

441
00:24:05,751 --> 00:24:06,876
Any other questions?

442
00:24:06,876 --> 00:24:07,876
Yeah.