Tile Tracker Security Flaw: Stalkers Can Track Your Location
- Security flaws in Tile's Bluetooth tracking tags allow for persistent device identification, possibly enabling long-term surveillance despite efforts to enhance privacy.
- Security researchers at the georgia Institute of Technology have identified notable vulnerabilities in Tile's Bluetooth tracking tags.
- The researchers discovered that Tile's rotating ID system,intended to protect user privacy,is predictable. An attacker who records a single message broadcast by a Tile device can "fingerprint" it...
“`html
Table of Contents
Security flaws in Tile’s Bluetooth tracking tags allow for persistent device identification, possibly enabling long-term surveillance despite efforts to enhance privacy.
– Last updated September 29, 2025, 18:53:49
What Happened?
Security researchers at the georgia Institute of Technology have identified notable vulnerabilities in Tile’s Bluetooth tracking tags. These flaws allow attackers to persistently identify individual Tile devices,even with Tile’s implemented security measures like rotating device IDs. the core issue lies in the continued transmission of a device’s Media Access Control (MAC) address, which can be intercepted to track a Tile’s location and movements.
The researchers discovered that Tile’s rotating ID system,intended to protect user privacy,is predictable. An attacker who records a single message broadcast by a Tile device can “fingerprint” it for its entire lifespan, according to one of the researchers. This predictability undermines the effectiveness of the rotating ID and creates a risk of systemic surveillance.
The technical Details: MAC Address and Predictable IDs
Tile utilizes Bluetooth Low Energy (BLE) to communicate with nearby devices, including smartphones. A crucial component of BLE dialog is the MAC address, a unique identifier assigned to each device’s network interface. While Tile attempts to obscure tracking by rotating its device ID, the researchers found that the MAC address remains consistently broadcast, providing a permanent identifier. Intercepting this MAC address allows for tracking even when the rotating ID changes.
Furthermore, the algorithm Tile uses to generate its rotating ids isn’t sufficiently random. The researchers demonstrated that future IDs can be reliably predicted based on past ones, rendering the rotation ineffective as a privacy measure. This means that even if Tile were to stop transmitting the MAC address, an attacker could still potentially track a device by predicting its future IDs.
Timeline of Events
What Does this Mean for Users?
The vulnerabilities pose a significant privacy risk to Tile users. Individuals could be tracked without their knowlege or consent, potentially revealing sensitive information about their location and habits.This is particularly concerning for individuals using Tile to track valuable items or for personal safety.
The potential for “systemic surveillance” is a key concern. An attacker could build a database of Tile MAC addresses and track the movements of numerous individuals over extended periods. This data could be used for malicious purposes, such as stalking, theft, or targeted advertising.
Life360’s Response
Life360 acknowledged the researchers’ findings and stated that it has implemented several security improvements. However, the company has not provided specific details about these improvements, leaving uncertainty about the extent to which the vulnerabilities have been addressed. The lack of transparency has raised concerns among security experts.