AirTell

AirTell is a cutting-edge tool designed to unveil the digital body language of Bluetooth Low Energy (BLE) devices. Unlike conventional approaches that view BLE privacy merely as an address-randomization challenge, AirTell accurately exposes how these devices continuously broadcast identifiable signals long before any connection is established.

Overview

AirTell is built upon NCC Group's Sniffle firmware, enabling the coordination of multiple CC2652-based radio dongles. It eliminates the blind spots typically encountered by single-dongle sniffers, which often miss critical communications during channel transitions. With AirTell, users can deploy both active stimulators and synchronized passive observers to evaluate, benchmark, and document BLE tracking techniques as outlined in research from the Privacy Enhancing Technologies Symposium (PETS).

Key Features

• Advanced Multi-Dongle Setup: Allows the orchestration of two or more radio dongles to enhance visibility into BLE advertisements and interactions.
• Flexible Topologies: Supports various operational modes to cater to diverse testing needs:
  • Topology A (Stimulator + Observer): Enables broadcasting of specific beacon profiles with a companion device capturing the emitted signals.
  • Topology B (Dual-Channel Passive Observer): Captures BLE communications across multiple channels without the typical limitations of single-dongle setups.
  • Topology C (Master / Slave Link Layer Traffic Relay): Facilitates the relaying of link-layer traffic, providing insights into data transmission behaviors.
• Extensive Documentation: Comprehensive resources are available, including a Google Notebook with architectural notes and detailed technical documentation covering usage, device requirements, and operational procedures.

Technical Architecture

The project is designed with a robust architecture that includes:

• A coordination layer that orchestrates device interactions.
• Specialized subsystems for protocol handling, device management, and operational topologies.
• A mock simulation environment that allows for testing without physical hardware, ensuring full automated testing coverage in CI/CD environments.

Usage Examples

To run a trace deanonymization analysis on simulated traces:

airtell deanonymize --mock

For ingesting an offline PCAP capture to detect data leaks:

airtell deanonymize --pcap captures/session.pcap --max-gap 30.0 --max-rssi-delta 15.0

These examples illustrate the potential of AirTell to support extensive BLE analysis in a variety of scenarios.

AirTell aims to be an essential resource for researchers, engineers, and developers focused on BLE technology and privacy, providing the tools needed to enhance understanding and transparency in Bluetooth communications.