IoT Data Leaks via Bluetooth

TL;DR

Some IoT devices can sneak data home even with their internet connection blocked, using your phone’s Bluetooth as a hidden pathway. This guide shows you how to check for this and what to do about it.

How It Works

Many ‘smart’ devices use apps on your phone to set up and control them. Some of these apps also create a Bluetooth connection that allows the device to send data to your phone, which then forwards it to the manufacturer’s servers – even if the IoT device itself isn’t directly connected to Wi-Fi or mobile data.

Checking for Hidden Data Transfer

1. Put Your Device in Setup Mode: Start the initial setup process of your IoT device as if you were connecting it for the first time. This often triggers the Bluetooth connection.
2. Monitor Phone Network Activity: While in setup mode, use a network monitoring tool on your phone to see what data is being sent.
   • Android: Use an app like ‘Packet Capture’ (requires root access for full visibility) or ‘Network Analyzer’.
   • iOS: iOS restricts direct packet capture. You can use a Wi-Fi sniffer on your computer to monitor traffic from your phone when it’s connected to the same Wi-Fi network, but this is less precise. Look for connections to manufacturer domains (see Step 4).
3. Disable Bluetooth: Turn off Bluetooth on your phone *before* completing the setup process. If the device still connects and sends data, it’s likely using a different method (Wi-Fi Direct perhaps) – this guide won’t cover those.
4. Identify Manufacturer Domains: Find out which servers your IoT device is trying to connect to. This information is usually in the privacy policy or terms of service of the device manufacturer’s app. Common examples include example.com, manufacturer.net, etc.
   • Use a DNS Lookup Tool: If you only have an IP address from network monitoring (Step 2), use a tool like What’s My DNS to find the domain name associated with it.

Blocking Data Transfer

1. Firewall on Your Phone (Advanced): Some Android phones allow you to block specific app network access using a firewall like NetGuard.
   • Open NetGuard and find the IoT device’s app.
   • Block both Wi-Fi and mobile data connections for that app.
2. Bluetooth Blocking (Limited): You can’t reliably block *all* Bluetooth data transfer without disabling Bluetooth entirely, which defeats the purpose of using the device.
3. Use a Virtual Private Network (VPN): A VPN encrypts all your phone’s internet traffic. While it doesn’t prevent data from being sent, it makes it harder for manufacturers to track you directly.
4. Factory Reset and Alternative Firmware: If possible, factory reset the IoT device and look for alternative firmware (like OpenWrt if supported) that gives you more control over network connections. This is a technical solution.
   • Warning: Flashing custom firmware can void your warranty and potentially brick your device.
5. Physical Network Isolation (Best): The most secure option is to put the IoT device on a separate network segment isolated from your main network using a VLAN or a dedicated router.

Tools

• Packet Capture (Android): Packet Capture
• Network Analyzer (Android): Network Analyzer
• What’s My DNS: What’s My DNS