News for hackers. Stuff that matters.

A comment on Fisher Price Chatter Telephone with Bluetooth. Parent comment

Re:Fisher Price Chatter Telephone with Bluetooth by 300bps on Wednesday December 01, 2021 @08:05AM (#29403288)
Some function or app on the phone (or distant cloud service) can recognise the MAC address of the Fisher price phone's bluetooth PHY

That’s not how MAC addresses work. Once a packet crosses a router, the packet appears to come from the MAC address of the router.

So for example a web site you connect to has no idea what your MAC address is.

[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by inetknght on Wednesday December 01, 2021 @09:25AM (#29403842)
> So for example a web site you connect to has no idea what your MAC address is.

...unless you (or the app you're running) tells it.

[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by linker3000 on Wednesday December 01, 2021 @11:09AM (#29405205)
Exactly.
[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by linker3000 on Wednesday December 01, 2021 @11:18AM (#29405354)
Well, I'd disagree with the first statement having worked with IPX/SPX ;-)

But, yeah, you're not wrong for IP networking - however, an app on the phone could forward the MAC address of the bluetooth connected device.

[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by vlovich123 on Wednesday December 01, 2021 @01:33PM (#29407335)
Regular apps can't typically access the MAC address of the connected device. Additionally, with BLE (& Bluetooth 5?) the MAC address is required to rotate regularly as part of the spec (IIRC even while connected but certainly the broadcast address).
[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by SwaraLink on Wednesday December 01, 2021 @02:56PM (#29408370)
BLE has a privacy feature that enables MAC address rotation, but it isn't a requirement. Apple products and Android phones use the privacy feature, but other than that most products don't. The possibility of tracking someone via the MAC address of their Bluetooth devices is very real.

But you are correct that regular apps can't address the MAC address of connected Bluetooth devices, so the tracking vulnerability that OP is suggesting isn't really possible.

[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by oseityphelysiol on Wednesday December 01, 2021 @10:04AM (#29404275)
Bluetooth uses MAC addresses too, so this still applies.
[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by zymhan on Wednesday December 01, 2021 @11:19AM (#29405364)
And no one farther than 30 feet from you will see your Bluetooth hardware address.
[ Parent | on HN ]
Re:Fisher Price Chatter Telephone with Bluetooth by oseityphelysiol on Wednesday December 01, 2021 @03:01PM (#29408446)
Yeah, but someone in your home might have a rogue phone app installed (or not even that, I bet companies like Xiaomi already so this with their smart home stuff) that scans bluetooth devices and sends the addresses so that they can be data mined.
[ Parent | on HN ]