DEMO: Himiko: A human interface for monitoring and inferring knowledge on Bluetooth-Low-Energy objects

International audienceThe Bluetooth Low Energy (BLE) protocol is being included in a growing number of connected objects such as smartphones, fitness trackers, headphones and smartwatches. As part of the service discovery mechanism of BLE, devices announce themselves by broadcasting radio signals called advertisement packets that can be collected with off-the-shelf hardware and software. To avoid the risk of tracking based on those messages, BLE features an address randomization mechanism that substitutes the device MAC address with random temporary pseudonyms. However, the payload of the advertisement packet still contains fields that can hamper the ran-domization mechanism by exposing counters and static identifiers. In addition to defeating the randomization mechanism, some of these fields can leak sensitive attributes of the owner such as his medical condition. As a consequence, we implemented Himiko to raise awareness about the privacy issues that the BLE advertising mechanism can involve. This tool aims to show the information that a passive eaves-dropper can infer by leveraging the contents of BLE advertisement packets. The advertising raw data are collected and processed from devices that have their Bluetooth interface enabled. The user is then shown the information that are leaking from his device