Device & Location Tracking

#!/bin/bash
# Prerequisites: apt install bluez (provides hcitool, btmon)
# Platform: Linux only — macOS alternative: use nRF Connect app; Windows: use Bluetooth LE Explorer
# Comprehensive BLE tracker detection scan
# Detect AirTags, Tile, SmartTag, and unknown BLE beacons

# Quick scan for active BLE advertisers
sudo hcitool lescan --duplicates 2>/dev/null &
SCAN_PID=$!
sleep 15
kill $SCAN_PID 2>/dev/null

# Detailed BLE beacon analysis with btmon
sudo timeout 30 btmon | tee ble_capture.log | \
  grep -Ei "ADV_IND|ADV_NONCONN|manufacturer|rssi|company"

# Filter for Apple Find My network beacons (AirTag signatures)
sudo hcitool lescan --duplicates 2>/dev/null | \
  grep -i "4C:00" | sort -u  # Apple company ID prefix

# --- Expected Output ---
# LE Scan ...
# 5A:3C:B8:19:44:F2 (unknown)
# 4C:00:AA:11:BE:C3 (unknown)
# 78:D1:62:0A:33:17 Tile Mate
# 4C:00:5F:22:91:DA (unknown)
# F0:C7:7F:88:AB:03 [TV] Samsung 65Q80
#
# --- btmon filtered output ---
# > HCI Event: LE Meta (0x3e)  ADV_NONCONN_IND
#   RSSI: -47 dBm  Company: Apple, Inc. (76)
#   Type: Find My (0x12)  Payload: 07 19 01 48 2a...
# > HCI Event: LE Meta (0x3e)  ADV_IND
#   RSSI: -63 dBm  Company: Tile, Inc. (272)
# > HCI Event: LE Meta (0x3e)  ADV_NONCONN_IND
#   RSSI: -51 dBm  Company: Apple, Inc. (76)
#   Type: Find My (0x12)  Payload: 07 19 01 93 f1...

#!/bin/bash
# Prerequisites: apt install aircrack-ng wireshark-common (provides tshark)
# Monitor Wi-Fi probe requests to understand device tracking surface
# Requires monitor-mode capable adapter

# Enable monitor mode
# ⚠ WARNING: 'check kill' stops NetworkManager — you WILL lose internet connectivity
sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Capture probe requests with detailed fields
sudo tshark -i wlan0mon -f "subtype probe-req" -T fields \
  -e frame.time -e wlan.sa -e wlan.sa_resolved \
  -e wlan_mgt.ssid -e radiotap.dbm_antsignal \
  -E header=y -E separator=, > probe_log.csv

# Analyze unique devices and their preferred networks
echo "=== Unique devices broadcasting ===" 
cut -d',' -f2 probe_log.csv | sort | uniq -c | sort -rn | head -20

echo "=== Most broadcast SSIDs ==="
cut -d',' -f4 probe_log.csv | sort | uniq -c | sort -rn | head -20

# ⚠ Restore connectivity after capture:
# sudo airmon-ng stop wlan0mon && sudo systemctl restart NetworkManager

# Expected output:
# [Probe Requests Captured]
# MAC: aa:bb:cc:dd:ee:ff → SSID: "HomeNetwork-5G"
# MAC: aa:bb:cc:dd:ee:ff → SSID: "Starbucks_WiFi"
# MAC: 11:22:33:44:55:66 → SSID: "CorpNet-WPA3"
#
# ⚠ Exposure: 3 unique SSIDs from 2 devices — reveals home, work, and visited locations

#!/usr/bin/env python3
# Prerequisites: subprocess is stdlib — no install needed
# Platform: Linux only (requires hcitool from bluez package)
"""Verify MAC address randomization is working on your devices.
Monitor BLE/Wi-Fi addresses over time to detect static identifiers."""
import subprocess
import time
import json
from collections import defaultdict

def scan_ble_addresses(duration=60, interval=10):
    """Scan for BLE addresses over time and flag non-rotating ones."""
    seen = defaultdict(list)
    scans = duration // interval
    
    for i in range(scans):
        # Note: subprocess timeout sends SIGTERM to cleanly stop the BLE scan after each interval
        result = subprocess.run(
            ["sudo", "hcitool", "lescan", "--duplicates"],
            capture_output=True, text=True, timeout=interval
        )
        timestamp = time.strftime("%H:%M:%S")
        for line in result.stdout.strip().split("\n"):
            parts = line.strip().split()
            if len(parts) >= 2:
                addr = parts[0]
                seen[addr].append(timestamp)
        time.sleep(1)
    
    print(f"\n{'Address':<20} {'Times Seen':>10} {'Rotating':>10}")
    print("-" * 42)
    for addr, times in sorted(seen.items(), key=lambda x: -len(x[1])):
        # If a MAC address appears in >50% of scan windows, it's likely using a static (non-rotating) address
        rotating = "STATIC ⚠" if len(times) > scans * 0.5 else "OK ✓"
        print(f"{addr:<20} {len(times):>10} {rotating:>10}")

scan_ble_addresses(duration=120, interval=15)