What Your Bluetooth Devices Reveal About You
How Life Patterns, Location, and Behavior Are Tracked Through BLE Signals Alone
Bluetooth devices continuously broadcast Advertising Packets to announce their presence. These packets contain MAC address, device name ("Jack's iPhone"), manufacturer ID, BLE service UUIDs (device types like heart rate monitors, glucose meters), and signal strength (RSSI). Bluehood is a Python-based educational BLE scanner developed shortly after KU Leuven researchers disclosed the WhisperPair vulnerability (CVE-2025-36911, enabling remote hijacking/location tracking of hundreds of millions of BT audio devices). It detects nearby devices through passive scanning (listening only, no connections), classifies device types via Vendor+UUID fingerprinting, filters randomized MAC addresses, and logs appearance/disappearance patterns in SQLite. The web dashboard (:8080) visualizes time-based heatmaps, dwell times, and correlated devices (phone+watch pairs that always appear together), with ntfy.sh push notifications for specific device arrival/departure. Deployable instantly via Docker, the creator ran it in passive mode at home and was able to identify delivery vehicle arrival times and whether it was the same driver, neighbors' commute patterns, and device combinations that appear together. Hearing aids, pacemakers, and vehicle diagnostic modules cannot have BT turned off and continuously broadcast, while even privacy apps like Briar and BitChat require BLE activation, creating the paradox of "the protection tool becomes the exposure path".
Architecture Diagram
How It Works
BLE devices periodically broadcast Advertising Packets (including MAC, device name, UUID, RSSI)
Bluehood collects packets in passive scan mode — listening only, no connection/interaction (no pairing needed)
Auto-classify device types via Vendor ID + BLE service UUID fingerprint (phone/watch/vehicle/medical/IoT)
Detect and filter randomized MAC addresses → isolate only fixed MAC devices as tracking targets
Record appearance/disappearance timestamps in SQLite, analyze time-based heatmaps, dwell time, and correlated devices
Pattern visualization on web dashboard (:8080) + ntfy.sh push notifications for specific device arrival/departure
Pros
- ✓ Tracking possible with passive collection only (no pairing needed)
- ✓ Implementable with inexpensive equipment (Raspberry Pi, ESP32)
- ✓ More covert than visual surveillance as signals penetrate walls
- ✓ Can identify device type and manufacturer
- ✓ Long-term pattern analysis reveals lifestyle habits
Cons
- ✗ MAC randomization makes tracking newer devices increasingly difficult
- ✗ Limited signal range (Class 2 BLE: ~10m)
- ✗ Difficult to distinguish between devices in dense environments
- ✗ Legal constraints — tracking without explicit consent prohibited in EU, etc.
- ✗ Metadata alone has limitations for personal identification (additional info needed)