Bluetooth headphones and privacy

tw-hx

A 2021 blog post, Location Tracking of WIFI Access Point and Bluetooth Devices might be of interest to GrapheneOS users.

It notes a lot of phones use Bluetooth MAC randomisation, but a lot of cars, headphones and wearable devices don't, so he was able to track users citywide based on their devices. Furthermore a more recent paper has uncovered a new threat that breaks BLE MAC randomisation

Graphene has the ability to automatically turn off Bluetooth on a timer, but thought this would be worth discussing as since the death of the 3.5mm jack you can't really disable Bluetooth if you want to listen to audio on an external device without a USB-C DAC. What does everyone else here do? Any known good or bad headphones for privacy?

Graphite

tw-hx

I keep bluetooth off, and turn on manually when I want to use headphones. The randomization helps only from tracking the phone. But of course the headphones don't randomize.
I've done tracking as a red team, and there are GATT attributes that can fingerprint and be surprisingly accurate for some phone models.
And as you mention too. Car infotainment can be tracked as well. I've also done work with SDRs to track the Tire Pressure sensors to track most vehicles.

Unfortunately, we're in a losing battle here.

tw-hx

Graphite Interesting on the GATT attributes; I suppose you are right regarding it being a losing battle. Apparently researchers are looking at tracking wireless devices with per-device microscopic variances in their RF transmitting performance with quite good accuracy too.

Here's another article covering the Norwegian study listing affected headphones by manufacturer -- not exhaustive though.

Aaron

So for Privacy, it's USB DAC and Wired headset...
Thanks for the great library of information on BT privacy vulnerability.