RSSI-based attacks for identification of BLE devices - Inria - Institut national de recherche en sciences et technologies du numérique
Article Dans Une Revue Computers & Security Année : 2024

RSSI-based attacks for identification of BLE devices

Résumé

To prevent tracking, the Bluetooth Low Energy (BLE) protocol integrates privacy mechanisms such as address randomization. However, as highlighted by previous researches address randomization is not a silver bullet and can be circumvented by exploiting other types of information disclosed by the protocol such as counters or timing. In this work, we propose two novel attack to break address randomization in BLE exploiting side information in the form of Received Signal Strength Indication (RSSI). More precisely, we demonstrate how RSSI measurements, extracted from received BLE advertising packets, can be used to link together the traces emitted by the same device or directly re-identify it despite address randomization. The proposed attacks leverage the distribution of RSSI to create a fingerprint of devices with an empirical evaluation on various scenarios demonstrating their effectiveness. For instance in the static context, in which devices remain at the same position, the proposed approach yields a re-identification accuracy of up to 97%, which can even be boosted to perfect accuracy by increasing the number of receivers controlled by the adversary. We also discuss the factors influencing the success of the attacks and evaluate two possible countermeasures whose effectiveness is limited, highlighting the difficulty in mitigating this threat.
Fichier non déposé

Dates et versions

hal-04687696 , version 1 (04-09-2024)

Licence

Identifiants

Citer

Guillaume Gagnon, Sébastien Gambs, Mathieu Cunche. RSSI-based attacks for identification of BLE devices. Computers & Security, 2024, pp.104080. ⟨10.1016/j.cose.2024.104080⟩. ⟨hal-04687696⟩
11 Consultations
0 Téléchargements

Altmetric

Partager

More