Bluetooth devices leak personal data in public spaces

Every time a Bluetooth-enabled device—such as a smartphone, laptop, or wireless earbud—connects to another, it transmits small data packets to identify itself within networks like Apple’s Find My or Google’s Fast Pair. These transmissions, known as advertising signals, also carry identifiable details that can be intercepted by unauthorized parties.

The technique of capturing these signals is called Bluetooth sniffing. When a sniffer detects a device’s broadcast, it extracts information including the device’s name, manufacturer, firmware version, and its unique MAC address. In locations where monitoring occurs consistently, such as hotel lobbies or conference centers, these signals can map movement patterns by tracking when devices enter or leave the area, without requiring direct tracking technology.

Most contemporary Bluetooth devices employ Resolvable Private Addresses (RPAs), which periodically change MAC addresses to prevent long-term tracking. However, some peripherals, such as older headphones or smartwatches, do not update their addresses frequently enough, creating gaps in protection. Even with RPAs in place, research indicates these measures do not completely eliminate the risk of data exposure.

Bluetooth tracking in public spaces

Public venues, including airports, cafés, and gyms, are ideal environments for Bluetooth sniffing. While high-value targets like executives or government officials may draw attention, the collected data still holds value. Retailers, for example, use Bluetooth symbols to detect customer entry and deliver location-based promotions. Both Target and Walmart disclose in their privacy policies that they rely on these signals for real-time advertising, though users can disable Bluetooth or location services to prevent tracking.

Security researchers have uncovered specific flaws in Bluetooth protocols. Earlier this year, a team from Belgium’s KU Leuven University identified vulnerabilities in Google’s Fast Pair system that could allow attackers to seize control of audio devices. More recently, researchers at France’s Eurecom demonstrated how the Bluetooth re-pairing process could be manipulated to impersonate devices, weaken security settings, and bypass authentication, even on newer Bluetooth versions.

Legacy devices pose biggest security risks

Legacy devices represent the highest risk. Older firmware or outdated Bluetooth versions lack current security patches, making them easier to exploit. Aimee Simpson, director of product marketing at Huntress, warns that malicious actors can abuse the Bluetooth OBEX protocol to bypass authentication and extract data from unpatched devices. This includes not only smartphones but also peripherals like mice, keyboards, and headsets commonly found in offices and homes.

One persistent threat is MouseJack, a decade-old vulnerability affecting older 2.4GHz wireless dongles used for mice and keyboards. Though these devices operate on a different protocol, they remain widespread in workplaces, conference rooms, and home offices. Brett Walkenhorst, chief technology officer at Bastille, advises IT teams to conduct audits of wireless devices in sensitive areas and enforce policies to phase out unencrypted peripherals.

For most individuals, the primary concern is not targeted attacks but passive data collection. If a device carries a personalized name, such as “Alex’s AirPods” or “Sarah’s Keyboard”, a sniffer can easily associate that identifier with the owner. Lorena Carthy-Wilmot, head of EU security strategy at iVerify, recommends using generic or humorous device names, such as “FBI Surveillance Van,” to prevent identification. She clarifies that while Bluetooth sniffing is rarely the main attack method for ordinary users, it remains a low-effort way for threat actors to gather background information.

How to protect devices from sniffing

Security experts outline a 10-step checklist to mitigate risks, including reviewing Bluetooth device names, disabling unused peripherals, and ensuring all devices run current firmware. For instance, an audit of a workstation might reveal an old wireless mouse still using an unencrypted protocol, even if the laptop itself is up to date. Many users overlook peripherals, assuming they inherit security from the main device, but legacy peripherals often operate independently. Walkenhorst’s team at Bastille found that as of 2024, some corporate environments still deploy unencrypted wireless receivers for mice and keyboards, leaving them vulnerable to bluesnarfing attacks. These devices, once paired, may maintain persistent connections that ignore modern encryption.

Simpson’s findings at Huntress show that the Bluetooth OBEX protocol, used for file transfers and peripheral communication, remains a frequent attack target. Unlike modern Bluetooth Low Energy, OBEX lacks built-in encryption for unauthorized access, making exploitation easier. For example, an attacker could send a malicious OBEX command to an unpatched wireless keyboard, triggering unintended keystrokes or data leaks. The protocol assumes trusted environments, but public spaces, such as co-working hubs or hotel business centers, rarely meet those conditions.