niemandhier 7 hours ago

That man is doing nfc spectrum analysis during an air raid.

I hope to someday acquire this amount of focus and dedication.

spongebobstoes 14 hours ago

This is surprising and cool. What's the explanation for why there are NFC transmissions on unlock or wake?

  • roboror 14 hours ago

    To look for NFC stuff like payment or tickets etc.

  • lxgr 11 hours ago

    iOS is constantly scanning for NFC tags containing URLs etc., which requires emitting enough field power to allow the tag to indicate its presence.

    Apple Pay itself uses card emulation mode, and as such the phone only needs to (passively) listen for a payment terminal's field; that should itself not be detectable without emitting such a field.

    • bestham 6 hours ago

      Is it really true that the phone must be passively listening? The field of the payment terminal will induce current in the NFC-coil and that should be able to wake the phone as necessary.

boznz 13 hours ago

Bluetooth already broadcasts and has a UID, I have used this a few times in books as plot-outline to identify an antagonist, and I now wonder if NFC has a similar UID It would be interesting to decode the data and see.

  • capitainenemo 12 hours ago

    Article notes this impacts soldiers (or I suppose others trying to be stealthy) who would have turned off bluetooth and wifi.

    • pajko 4 hours ago

      If the transmission contains some identifying information and can be used for coarse triangulation to decide if a specific phone is in a specific building - well, that's pretty bad.

      Can be harmful even without identifying information in situations where it's enough to decide if some building is occupied or not.

    • ghostly_s 10 hours ago

      They mention android for this risk factor specifically-does android not have an "airplane mode" equivalent? I would assume it disables NFC also on iOS, but I guess I don't know —no mention of NFC on Apple's support page.

      • schaum 8 hours ago

        Andoird has an airplane mode Once enabled airplane mode you can enable Bluetooth again and airplane mode stays on,so just no mobile data an.same is true for WiFi.

        NFC however isn't touched by the airplane mode

        ...At least it was like that on the android phones I owned

        • eichin 5 hours ago

          Samsung Note (9 and 24 at least) has an "NFC and contactless payments" toggle (and a UWB one) on the page with wifi and bluetooth (Settings → Connections) but I don't know if it's "doesn't emit" or just "doesn't interact"...

  • lxgr 11 hours ago

    "Classic" Bluetooth does not broadcast a detectable ID except if the device is explicitly in "pairing mode". It can be inferred when observing a connection establishment between two paired devices, or probed for if known (i.e. you can confirm that one of a few candidate devices is nearby, if you know their addresses), but not passively sniffed, as far as I know.

    Bluetooth LE does explicitly broadcast its MAC address in some modes, but offers various forms of private or random address modes to mitigate the problem.

  • jsheard 13 hours ago

    Don't they randomize their broadcast ID? I know both Android and iOS scramble the WiFi MAC address by default, it would be odd if they didn't take the same precaution with Bluetooth.

    • csdvrx 13 hours ago

      The randomization doesn't matter: you can very easily link the addresses if you have a few datapoints, even if it's just the time you observed the addresses: the basic method is discussed in https://inria.hal.science/hal-03045555/document

      See https://inria.hal.science/hal-02394629v1 for the theoretical bases then hop to https://samteplov.com/uploads/shmoocon20/slides.pdf for an example applying to Apple devices

      Those who said the randomization and other techniques were sufficient were wrong: https://petsymposium.org/popets/2020/popets-2020-0003.pdf will show you how they changed their mind :)

      It's not just apple: google nearby has also been reversed: https://publications.cispa.saarland/2748/ and https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... talks about attacks, but there's no need for that: just find identifiers that let you link the addresses

      Even if you don't have any identifiers, the Bluetooth address randomization happens only about every 15 minutes: the manufacturer specific data in the public advertisement (or even the frequency and the length of these advertisements) during these 15 minutes periods can be used for linking the randomized addresses

      • lxgr 11 hours ago

        That attack requires continuously monitoring a given device or area though, right?

        In other words, you could possibly track a given device through an area with enough sensors, e.g. a store, but not across visits.

    • boznz 13 hours ago

      Sci-Fi books and it was a sentient AI, I can do anything I want in that situation :-)

    • AStonesThrow 7 hours ago

      Google has lately been far overstepping their utility with “security measures” which I definitely don’t need and often make everything more annoying and difficult.

      Ex: blocking 3rd party cookies always now. Breaks countless websites which I need to work reliably. “Manage unused website/app’s permissions” even after I specifically granted them! Randomized virtual credit card numbers in Wallet: for no good reason, you thoroughly fucked up a refund attempt for me, >$500! And randomized MAC addresses by default for EVERY. SINGLE. SSID. It’s unhinged. It’s fake protection.

      As a matter of fact, I do not enjoy my devices lying to my ISP, or to my college campus, my medical clinic, or to my employers. Device, please identify yourself without wearing a fuckin’ Groucho mask on top, and put on your big boy pants.

      • HeatrayEnjoyer 6 hours ago

        Never thought I'd hear someone complain Google takes privacy too seriously.

  • jillyboel 11 hours ago

    NFC uid is also randomized

drag0s 4 hours ago

one of the things I miss in iOS coming from Android is to be able to easily disable NFC or location :/

babuloseo 10 hours ago

Can we use this to find people stuck in Earthquake rubble?

  • areyourllySorry 8 hours ago

    the n in nfc stands for near. won't help under layers of concrete

    • voidUpdate 4 hours ago

      TFA talks about detecting phones through load-bearing walls over 15-20 meters, and how the lower frequency penetrates surprisingly well. You can't necessarily pull the actual data off it, but you can see that there is a signal

  • ghostly_s 10 hours ago

    Are they checking their phones?

byry 10 hours ago

From article: "Then, when the screen turns off again (either manually or via timeout), another signal is sent, just 1 ping this time."

Nice.

dzhiurgis 11 hours ago

Does it do it lockdown mode too?

yapyap 12 hours ago

Very interesting!

xyst 10 hours ago

Time to start lining the walls with lead to block signal leak. New building code, when?

sparker72678 12 hours ago

> tracking occupancy patterns, correlating signal presence with known devices, identifying sleep cycles

Wait til you find out about Wifi and GSM!

  • capitainenemo 12 hours ago

    From the article. "A great part of discussion in comments on the original thread I've made was about soldiers on the battlefield and a heavy usage of devices close to the line of contact. Android users might turn off Wi-Fi and Bluetooth and even remove their SIM card, thinking they’ve minimized their radio footprint. But NFC often remains active by default — and since most people assume it only matters within arm’s reach, they don’t bother disabling it."

    • 1659447091 5 hours ago

      > soldiers on the battlefield and a heavy usage of devices close to the line of contact. Android users might turn off Wi-Fi and Bluetooth and even remove their SIM card

      I would think a faraday bag would be far more efficient for this - should take care of the NFC issue too

babuloseo 11 hours ago

You know its interesting to know that the people that are in ICE are not smart/competent enough to make uses of these things to detect people and I dont think anything is going to change in the next 3-4 years, its actually bizarre.

  • reaperman 10 hours ago

    TSA (more accurately - CBP, more generally - DHS) contract out the hard engineering to Cellebrite and NSO Group. Those companies develop a dumb-proof box. The CBP agents at the border take the phones, plug them to the box, press a few buttons, and that’s it.

    No one in the TSA/CBP/ICE/DHS needs to be smart for this, that’s the job of private engineering firms/contractors.