Bluetooth Battery Monitor (BLE Battery Monitor) Warning - Major Spyware

[Skid]

I was thinking of buying some of these for some cars that are rarely driven... You need to install an app on your phone to use these. It turns out that the app is pretty abusive.

• The product collects GPS co-ordinates, cell phone tower data and nearby Wifi beacons
• Location data is sent over the Internet to servers in Hong Kong and mainland China
• App store misleads consumers by stating that no personal data is collected or shared. Since the Android app requires location permissions to use the hardware device, users are effectively forced to continuously broadcast their physical location to 3rd parties in order to use the product.

Some links:

Bluetooth Battery Monitors That Also Monitor Your Position, Without Asking

These days Bluetooth-based gadgets are everywhere, including for car and solar batteries. After connecting them up to the battery, you download the accompanying app on your smartphone, open it up a…

hackaday.com

Part 1 - Discovering that your Bluetooth car battery monitor is siphoning up your location data

Reverse engineering an Android app for a Bluetooth connected car battery monitor with some startling discoveries

doubleagent.net

Part 2 - An analysis of location tracking in the AMap mobile SDK

A deep dive into the location tracking functionality of a popular location SDK package

doubleagent.net

 

[TumblrDucks]

Yikes
Is it mainly for solar battery or tickle-charged car battery?

 

[Skid]

It's for a car battery. People on other forums seem to call these things "BM2." Looks like the following.

 

[atikovi]

• The product collects GPS co-ordinates, cell phone tower data and nearby Wifi beacons

And? What's the big deal? So does your cell phone.

 

[blupupher]

And? What's the big deal? So does your cell phone.

 

[JHZR2]

And? What's the big deal? So does your cell phone.

I’d suspect it’s who is doing it and why.

Ok so Apple or Google does it. Not a fan. But are they sending it to China? And what’s the purpose? Serving local ads? Getting the right spot on a map? Verifying cell towers? Time zones? I’m sure something worse could be in the mix… but local or foreign??

Same for Facebook or whatever else. Many of those sorts of apps you have the ability to not download/use. So that’s good…

Websites may too. I don’t know the details.

Here you’re buying a Chinese item, that has no reason to have this data, beaming it back. Why? For their app to serve you ads? Or worse?

 

[sk_pete]

Anything that needs internet to work is risky.
But some don't care if calculator app needs access to call history.... Only paranoid survive.

 

[meep]

Why? Heat maps get really interesting and can connect users with careers, residential locations, income estimates, and probably 100 things I haven’t thought of. Avoid. I prefer the Ron Swanson approach.

 

[f355spider]

I've been using this app for over three years. First thing I turned off was the location services for the BM2 app on my Iphone. Never understood why it would even need that. (but truth be told, look at your other apps, you'd be surprised that many track too...probably for marketing purposes to see where their customers are located) But otherwise the app works really well and has a number of nice features. I had a couple questions, emailed the developer and surprisingly they answered back promptly.

Never experienced any slowness in download or processing speeds that I am aware of

 

[f355spider]

I’d suspect it’s who is doing it and why.

Ok so Apple or Google does it. Not a fan. But are they sending it to China? And what’s the purpose? Serving local ads? Getting the right spot on a map? Verifying cell towers? Time zones? I’m sure something worse could be in the mix… but local or foreign??

Same for Facebook or whatever else. Many of those sorts of apps you have the ability to not download/use. So that’s good…

Websites may too. I don’t know the details.

Here you’re buying a Chinese item, that has no reason to have this data, beaming it back. Why? For their app to serve you ads? Or worse?

Turn off location services on the app...in fact turn it off on every app that doesn't need it. Problem solved.

 

[JHZR2]

Turn off location services on the app...in fact turn it off on every app that doesn't need it. Problem solved.

I’m not sure I’d trust that sort of an app/product regardless.

 

[mk378]

According to the article, the Android OS requires Location to be on to search for new Bluetooth devices. Once the device is paired, it can be turned off. That will cripple most of the functions of the completely unnecessary location seeking library. However the app's other spy function of sending various data back home will continue.

 

[f355spider]

I’m not sure I’d trust that sort of an app/product regardless.

I noticed a new post update in the article above that the software developer recently removed the questionable AMap SDK from the app, probably due to the publicity.

I also noticed there may be a legit reason for the tracking....the app has additional features not currently being used by the hardware suppliers. The software can record you parking position and allow you to find your car later in a car park. But apparently removed now.

 

[f355spider]

According to the article, the Android OS requires Location to be on to search for new Bluetooth devices. Once the device is paired, it can be turned off. That will cripple most of the functions of the completely unnecessary location seeking library. However the app's other spy function of sending various data back home will continue.

I saw that as well and curious why that is, when Iphone version allows you to easily turn off the location services

 

[zzyzzx]

So if you post something that the battery monitor company doesn't like, and they kill off your battery.