Find my... and yours: Exploiting tracker ecosystems to track individuals

Modern Bluetooth Low Energy tracking ecosystems — Apple Find My, Samsung SmartThings, Tile, and Google Fast Pair, have each implemented privacy controls designed to prevent persistent observation and protect user privacy. This talk demonstrates how those controls fail in practice. Through passive BLE advertisement collection, protocol-level attacks, linkage analysis, we show how rotating identifiers can be correlated across time and space to re-identify devices, attribute them to individuals, and reconstruct movement histories. 

Specifically, it will explore how:

• Rotating identifier schemes, designed to prevent tracking, can be defeated through cryptographic, temporal, and behavioural linkage analysis
• Passive advertisement collection alone — requiring no active probing, no accounts, and no interaction with target devices or ecosystems — is sufficient to re-identify devices and reconstruct movement
• Cross-vendor artifacts and advertisement structure leak identity signals that individual vendors have not accounted for in their threat models
• The privacy guarantees communicated to hundreds of millions of users do not reflect the practical reality of what passive observers can determine

The session will present six linkage algorithms targeting different artifact classes across the four ecosystems and connect the findings to the broader question of what "privacy by design" actually requires when adversarial passive observation is the threat model.