Detecting BLE Trackers for the price of a Gas Station Hot Dog

Detecting BLE Trackers for the price of a Gas Station Hot Dog

Speakers: Bil Swearingen, Larry Pesce

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=DPOEzJCMWxs

Overview

In an era where personal tracking devices are ubiquitous, the ShmooCon talk "Detecting BLE Trackers for the price of a Gas Station Hot Dog" by Bil Swearingen and Larry Pesce presented a compelling and accessible solution for individuals to regain control over their privacy. The presentation highlighted how readily available, inexpensive hardware can be leveraged to detect various Bluetooth Low Energy (BLE) trackers, including popular devices like Apple AirTags, Tile, and others. This talk is not merely a technical demonstration but a powerful statement on the democratization of security tools, emphasizing that robust privacy defenses do not require prohibitively expensive equipment.

The core of their work revolves around the Cheap Yellow Display (CYD), an $11-$15 development board featuring an ESP32 microcontroller. By demystifying the process of programming these devices within the beginner-friendly Arduino ecosystem, Swearingen and Pesce empower anyone to build their own BLE tracker detector. The talk underscores the dual nature of BLE technology, which, while convenient for finding lost items, also presents significant privacy risks through potential misuse or unintended exposure of sensitive personal data.

This presentation matters immensely in the current landscape of personal security and privacy. As BLE devices proliferate, from smart home gadgets to medical implants, understanding their broadcast mechanisms and developing low-cost detection methods becomes critical. Swearingen and Pesce not only provide a practical tool but also ignite a call to action for the security community to contribute to open-source hardware projects, expand detection capabilities, and collectively enhance digital self-defense against evolving tracking threats.

Background

▶ Watch: Introducing the Cheap Yellow Display and ESP32 (14:00)

The proliferation of small, inexpensive tracking devices has introduced a complex layer to personal security and privacy. Devices like Apple AirTags, Tile trackers, and various generic BLE tags are designed to help users locate lost items, pets, or even children. While their intended use is benign and often helpful, the underlying technology – Bluetooth Low Energy (BLE) advertising packets – can be exploited for unauthorized surveillance or inadvertently expose sensitive personal information. The problem arises from the fact that these devices constantly broadcast unique identifiers or manufacturer-specific data, which can be intercepted and analyzed by anyone with the right equipment.

Prior to this talk, efforts to detect such trackers often involved either specialized, costly hardware or reliance on smartphone apps, which may have limitations in scope or privacy guarantees. The speakers acknowledged earlier work, particularly from Matthew Kukanich, who explored initial concepts for AirTag scanning on GBL displays, serving as a foundational inspiration for their expanded project. The challenge remained to create a solution that was not only effective but also highly accessible and affordable, moving beyond niche security tools into the hands of everyday users.

The "why this problem exists" is rooted in the design of BLE itself. To be discoverable and connectable, BLE devices transmit advertisement packets at regular intervals. These packets contain various data fields, including manufacturer-specific data, service UUIDs, and other information. While these broadcasts are essential for the functionality of trackers, they also create an open window for detection. The speakers recognized that by meticulously analyzing these broadcast patterns and manufacturer identifiers, a low-cost, open-source detector could be built, offering a practical countermeasure against potential misuse. This initiative sought to bridge the gap between complex wireless protocol analysis and practical, DIY security solutions.

Key Findings

▶ Watch: Detailed features and identification of the Cheap Yellow Display (18:00)

The central discovery presented by Bil Swearingen and Larry Pesce is the feasibility and accessibility of building a highly effective Bluetooth Low Energy (BLE) tracker detector for an exceptionally low cost, comparable to "the price of a gas station hot dog." This project demonstrates that sophisticated security tools do not require expensive commercial hardware, but can be assembled using readily available components and open-source software.

Their primary contribution is the development of a working BLE tracker scanner utilizing the Cheap Yellow Display (CYD). This $11-$15 board, powered by an ESP32 microcontroller, proved capable of identifying a wide array of trackers, including Apple AirTags (both registered and unregistered), Tile devices, Millie tags, and Chipolo trackers. The core methodology involves scanning for specific manufacturer IDs and distinct byte patterns within BLE advertising packets. For instance, Apple devices broadcasting on the Find My network are identifiable by the manufacturer ID 4c0000, with specific hex values 07 and 12 in the payload differentiating between registered and unregistered AirTags.

Beyond just commercially available trackers, a critical and concerning finding was the ability to detect other BLE-enabled devices that broadcast potentially sensitive personal information. The speakers demonstrated that devices like the Dexcom G7 continuous glucose monitor, which uses BLE, could be identified. This highlights a significant privacy implication: the same techniques used to detect unwanted trackers can inadvertently (or maliciously) reveal personal health conditions or other private data based on the unique manufacturer IDs and service UUIDs broadcast by such devices. This finding elevates the project from a mere tracker detector to a broader privacy awareness tool, urging manufacturers and users alike to consider the implications of constant BLE broadcasting. The project's code has been open-sourced on GitHub, making it straightforward for anyone to replicate, modify, and contribute to, further democratizing access to this defensive capability.

Technical Deep Dive

▶ Watch: Making the BLE tracker portable with battery solutions (19:00)

The technical foundation of the BLE tracker detector lies in leveraging the capabilities of an inexpensive ESP32 microcontroller integrated into a versatile development board, coupled with a well-structured software approach for parsing Bluetooth Low Energy (BLE) advertising packets.

Hardware Components

The cornerstone of the project is the Cheap Yellow Display (CYD). This device, typically costing between $11 and $15, is an exemplary choice for its balance of affordability and functionality. Key specifications include:

• Microcontroller: An onboard ESP32, known for its integrated Wi-Fi and Bluetooth capabilities, making it ideal for wireless sniffing and processing.
• Display: A 2.8-inch resistive touchscreen LCD, which, while acknowledged as somewhat basic, provides a crucial user interface for displaying detected tags.
• Connectivity: Features a Micro USB port for power and programming.
• Expansion: Includes accessible GPIO pins, a speaker, an RGB LED, and a MicroSD card slot, enhancing its versatility for various projects.

For portability, the device can be powered by a 3.7V lithium battery. However, since the CYD typically requires 5V, a buck converter is necessary to step up the voltage. The speakers recommended an all-in-one charger device that combines a buck converter with a proper charging circuit (often via USB-C) to safely manage battery power without the risk of overcharging or explosion.

Software and Firmware Architecture

The software environment is designed for accessibility, utilizing the popular Arduino ecosystem:

1. Arduino IDE: The cross-platform Arduino Integrated Development Environment is used for writing, compiling, and uploading code to the ESP32. Its beginner-friendly nature is a key enabler for this project.
2. ESP32 Board Manager: To program ESP32-based boards, users must add the ESP32 board manager URL to the Arduino IDE preferences and install the necessary libraries. This allows the IDE to recognize and correctly interface with the ESP32 chip, typically by selecting the "ESP32 Dev Module" if a specific board isn't listed.
3. GitHub Repository: The project's code is publicly available on GitHub. Users can clone the repository, open it in the Arduino IDE, and upload it to their CYD. The only specific modification mentioned is replacing a display driver file, a process that is well-documented within the project.

Detection Logic

The core detection mechanism operates by continuously scanning for BLE advertising packets and parsing their contents:

• Packet Capture: The ESP32's Bluetooth radio captures incoming BLE advertisement packets.
• Manufacturer ID Analysis: The software employs a "dirty for loop" that iterates through captured packets, specifically looking for the manufacturer-specific data field within the BLE advertisement payload.
• Apple AirTags: Detection relies on the manufacturer ID 4c0000 (Apple's assigned ID). Further analysis of the payload differentiates between registered and unregistered AirTags using specific hex values: 07 for registered and 12 for unregistered.
• Tile Trackers: These are identified by their unique manufacturer ID, which is FEC (0x00FE for the 16-bit Service Class UUID). The speakers initially reverse-engineered this through Wireshark packet captures but later discovered the Bluetooth Special Interest Group (SIG) documentation lists these assigned IDs.
• Other Trackers (e.g., Millie, Chipolo): The method extends to other manufacturers. Notably, some brands like Millie achieve "Find My compatibility" by simply identifying their devices with Apple's 4c0000 manufacturer ID, effectively cloning the Apple beaconing behavior.
• Service Class UUIDs: The speakers highlighted that the official Bluetooth SIG documentation, specifically for 16-bit service class UUIDs, is a comprehensive resource for identifying various manufacturers and their device types without needing to perform extensive packet sniffing. This allows for the expansion of detection capabilities by simply looking up registered companies that produce trackers.

Expanding Capabilities

The speakers also touched upon the broader utility of the CYD and ESP32 platform:

• Multi-purpose Firmware: Other firmwares like Marauder (for Wi-Fi attacks, often seen on Flipper Zero add-ons) and Bruce (a penetration testing firmware) can be ported to the CYD.
• M5Stick Launcher: For users wanting to switch between multiple firmwares without constant reprogramming, the M5Stick Launcher has been ported to the CYD. This allows storing various firmwares on the SD card and selecting them via the touchscreen after a reboot.
• Non-Security Applications: The CYD's versatility extends to maker projects, such as an OBD2 display for vehicle diagnostics, a digital readout (DRO) for a lathe, or even custom cosplay props with rotating images from an SD card. This demonstrates the immense potential of the hardware beyond its security applications.

The project effectively combines accessible hardware with open-source software and a clear understanding of BLE protocols to create a powerful, user-friendly security tool.

Demo / Proof of Concept

▶ Watch: Getting started with Arduino IDE and ESP32 programming (20:00)

The live demonstration showcased a functional Cheap Yellow Display (CYD) device actively scanning and identifying Bluetooth Low Energy (BLE) trackers in real-time. Despite initial technical glitches with the presentation slides, the hardware demo successfully illustrated the detector's capabilities.

The speakers presented a CYD unit, which, upon booting, immediately began displaying detected tags on its 2.8-inch LCD screen. The display, although noted by the speakers as needing refinement (only showing the first five tags and lacking scroll functionality), clearly indicated the presence of multiple BLE devices. At one point, the device reported detecting "57 devices" in the venue, encompassing various AirTags and other BLE trackers. The speakers acknowledged that this number was likely inflated due to the audience's iPhones, which act as AirTags when joined to Apple's Find My network.

Larry Pesce further demonstrated a version of the device housed in a custom 3D-printed case, featuring a USB-C connector, showcasing the portability and potential for user customization. This particular unit also successfully displayed detected tags, reinforcing the project's viability across different CYD iterations. The demo confirmed that the setup—installing the Arduino IDE, adding board managers, downloading the GitHub code, and pressing "program"—was straightforward and yielded immediate, tangible results. It underscored the project's core promise: a functional, low-cost BLE tracker for personal security.

Defensive Implications

▶ Watch: Selecting the correct ESP32 board in Arduino IDE (22:00)

The "Detecting BLE Trackers" project by Swearingen and Pesce offers several crucial defensive implications for individuals and the broader cybersecurity community.

First and foremost, it empowers individuals with an accessible and affordable tool for personal privacy. In an era where unwanted tracking is a growing concern, having a device that can detect hidden AirTags, Tiles, or other BLE trackers in one's car, home, or personal belongings provides a tangible layer of defense. This shifts the power dynamic, allowing individuals to proactively scan their environment rather than relying solely on manufacturer-provided alerts (which may not always be sufficient or timely).

Secondly, the talk raises critical awareness about the privacy implications of ubiquitous BLE broadcasting. The demonstration of detecting not just trackers but also personal health devices like the Dexcom G7 continuous glucose monitor highlights how seemingly innocuous BLE signals can inadvertently reveal highly sensitive personal information. This should prompt both device users and manufacturers to reconsider privacy settings and the necessity of constant, identifiable broadcasting. Defenders should educate themselves and others about which of their personal devices might be broadcasting unique identifiers and the potential risks involved.

Third, the project encourages community contribution and open-source development in hardware security. The speakers explicitly call for contributions to improve the device's firmware, such as enhancing the display interface (adding scrolling), refining serial port data output, and expanding the list of detectable tag types. This collaborative approach ensures that defensive tools can evolve rapidly to counter new tracking technologies and expand coverage for existing ones, moving beyond the limited scope of commercial solutions.

Finally, the project serves as an excellent entry point for aspiring security professionals or hobbyists into microcontroller programming and hardware hacking. By providing a beginner-friendly path through the Arduino ecosystem, it fosters a new generation of defenders capable of building their own security tools and understanding the underlying technologies. This hands-on experience is invaluable for developing a deeper understanding of wireless protocols and creating custom solutions tailored to specific threats.

Key Takeaways

• Affordable BLE Tracker Detection: A functional Bluetooth Low Energy (BLE) tracker detector can be built for as little as $11-$15 using a Cheap Yellow Display (CYD) and an ESP32 microcontroller, making advanced security tools accessible to everyone.
• Privacy Implications of BLE: Beyond dedicated trackers, many everyday BLE devices, including personal health monitors like the Dexcom G7, broadcast identifiable information that can inadvertently reveal sensitive personal data, highlighting a broader privacy concern.
• Beginner-Friendly Hardware Hacking: The Arduino ecosystem significantly lowers the barrier to entry for hardware projects, enabling individuals with minimal programming experience to build and customize their own security tools using open-source code.
• Manufacturer ID Analysis is Key: Detecting various trackers (Apple AirTags, Tile, Millie, Chipolo) relies on analyzing specific manufacturer IDs (e.g., 4c0000 for Apple, FEC for Tile) and unique byte patterns within BLE advertisement packets.
• Versatile Hardware Platform: The CYD/ESP32 platform is highly versatile, capable of running various firmwares for security tasks (e.g., Marauder for Wi-Fi attacks) and non-security maker projects (e.g., OBD2 displays, digital readouts).
• Call for Open-Source Contribution: The project encourages community involvement to enhance the detector's capabilities, improve the user interface, and expand the database of identifiable BLE device types, fostering a collaborative approach to personal security.

About the Speaker(s)

Bil Swearingen and Larry Pesce are seasoned cybersecurity professionals who demonstrated their passion for accessible security and hardware hacking through this presentation. While the transcript provides fewer direct biographical details for Bil, his co-presentation with Larry highlights his expertise in the practical application of microcontrollers for security purposes.

Larry Pesce is well-known in the cybersecurity community, particularly as a SANS trainer specializing in wireless and IoT security for many years. Despite jokingly being described as looking "super scary," he is characterized as a "sweetheart" and highly approachable. His extensive background in wireless protocols and hardware makes him a credible authority on the subject. Both speakers expressed deep gratitude for the ShmooCon conference and its community, acknowledging its significant role in their careers and underscoring their commitment to sharing knowledge and fostering engagement in the security space. Their collaborative spirit and enthusiasm for empowering individuals to explore hardware security were evident throughout the talk.