Loading story…
Researchers from the Georgia Institute of Technology have uncovered significant security flaws in Tile's popular Bluetooth location trackers, raising concerns about user privacy and the potential for malicious tracking. The investigation revealed that each Tile device broadcasts an unencrypted, static MAC address along with a unique identifier, making it possible for any nearby Bluetooth-enabled device or radio-frequency antenna to intercept these signals. Unlike competing trackers that use temporary, rotating IDs to obscure the device's identity, Tile's approach leaves the MAC address unchanged, which allows for persistent tracking of the device and, by extension, its owner. The researchers also found that while Tile does rotate its unique ID, the method used is weak and can be easily circumvented, enabling continuous monitoring. Data collected by nearby devices is sent to Life360's servers without encryption, and the researchers believe this information may be stored in cleartext, further compounding privacy risks. This design flaw means that an attacker only needs to capture a single broadcast from a Tile device to fingerprint and track it indefinitely. The scale of the issue is significant, with approximately 88 million Tile trackers in use worldwide, amplifying the potential impact. The vulnerabilities are not mitigated by the safeguards Tile introduced in 2023, which were intended to prevent misuse by owners but do not address third-party tracking via Bluetooth sniffers. Such sniffers are widely available and commonly used in retail environments and smart-home setups, making the exploitation of these flaws trivial for both individuals and organizations. The researchers warn that these weaknesses could be exploited by stalkers, thieves, or other malicious actors to follow individuals without their knowledge. The lack of encryption in both the device broadcasts and the communication with Life360's infrastructure means that sensitive location data could be intercepted or misused in the event of a breach. The findings highlight a broader issue in the rapidly growing Bluetooth tracker market, where security and privacy considerations have not kept pace with adoption. The researchers emphasize that the current implementation allows for mass surveillance if Tile trackers are caught in large-scale scans. They also note that other tracker systems use more robust encryption and key management to protect user privacy, underscoring Tile's lag in adopting industry best practices. The exposure of static MAC addresses and weak ID rotation not only facilitates stalking but also opens the door to broader privacy violations and potential data breaches. The researchers' warnings serve as a call to action for both manufacturers and users to prioritize security in the design and use of location-tracking devices. Life360, the parent company of Tile, has not yet announced any immediate remediation steps in response to these findings. The incident underscores the importance of rigorous security assessments for consumer IoT devices, especially those with the potential to impact personal safety and privacy on a large scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The Georgia Tech researchers said attackers could replay Tile Bluetooth broadcasts to make it appear that a legitimate Tile owner was conducting stalking activity. This added a new abuse scenario beyond covert tracking, showing the flaws could also be used to falsely implicate users.
The researchers said the design flaws undermine Tile's 2023 anti-misuse protections because they enable covert tracking of a tag's owner without planting a separate tracker. They recommended encrypting Bluetooth broadcasts and server communications to reduce stalking risk and limit misuse of historical location data.
Researchers at the Georgia Institute of Technology found that Tile Bluetooth trackers broadcast an unencrypted MAC address and unique identifier, allowing nearby Bluetooth devices or RF antennas to track a tag's movements. They also reported that tag location, MAC address, and unique ID are transmitted unencrypted to Tile's servers, potentially enabling tracking of a tag owner.
6 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcemalwarebytes.com
Open sourcearxiv.org
Open sourcetomshardware.com
Open sourcearchive.ph
Open sourceeprint.iacr.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple and Google have rolled out a new cross-platform standard that warns users on **iOS** and **Android** when an unknown Bluetooth tracking device appears to be moving with them. The feature is designed to counter stalking and other misuse of consumer location tags, including Apple AirTag-compatible devices and other trackers that implement the industry specification **Detecting Unwanted Location Trackers**. Apple said iPhone users running **iOS 17.5** will see "Item Found Moving With You" alerts, while Google said Android 6.0+ devices will support similar "Tracker traveling with you" notifications and provide options to locate and disable the device. The rollout comes amid broader scrutiny of how Bluetooth-based location networks can be abused beyond dedicated tags. KrebsOnSecurity reported that some Wi-Fi routers and other Bluetooth-enabled devices can effectively behave like AirTags because Apple’s **Find My** network may infer their location from nearby Apple devices, creating privacy concerns if hardware is moved or repurposed without an owner’s knowledge. Together, the announcements and reporting highlight a wider effort to reduce covert tracking risks across mobile ecosystems while acknowledging that everyday connected devices can also become part of large-scale location-finding networks.
Jul 12, 2026
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
Security researchers demonstrated that Apple’s **Find My** offline-finding network can be repurposed to transmit arbitrary data from devices without direct internet access by encoding message bits into crafted Bluetooth Low Energy broadcasts that nearby Apple devices forward to Apple’s backend. The proof of concept, dubbed **Send My**, used an `ESP32` transmitter and a macOS retrieval tool derived from **OpenHaystack** to recover the data through authenticated queries to Apple’s location-report service, achieving roughly **3 bytes per second** with end-to-end delays typically ranging from **1 to 60 minutes**. The work builds on reverse engineering behind **OpenHaystack**, an experimental framework for creating third-party Bluetooth accessories trackable through Apple’s Find My network. Researchers said the abuse is enabled by privacy-focused design choices that prevent Apple from linking broadcast public keys to owners, limiting authorization checks on report retrieval; they also noted prior security issues in the ecosystem, including **`CVE-2020-9986`**, which Apple fixed. The researchers proposed mitigations including BLE advertisement authentication and tighter rate limiting for location-report retrieval, while warning that experimental OpenHaystack firmware broadcasting a fixed public key can itself make accessories trackable by nearby devices.
Jul 24, 2026