BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.bsidescbr.com.au//bsides-canberra-2026//talk//3VQLV
 R
BEGIN:VTIMEZONE
TZID:Australia/Sydney
BEGIN:STANDARD
DTSTART:20250925T000000
TZNAME:AEST
TZOFFSETFROM:+1000
TZOFFSETTO:+1000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20251005T030000
RDATE:20261004T030000
TZNAME:AEDT
TZOFFSETFROM:+1000
TZOFFSETTO:+1100
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20260405T030000
RDATE:20270404T030000
TZNAME:AEST
TZOFFSETFROM:+1100
TZOFFSETTO:+1000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Find My... And Yours: Exploiting Tracker Ecosystems To Track Indiv
 iduals - Carter Smith
DTSTART;TZID=Australia/Sydney:20260925T110000
DTEND;TZID=Australia/Sydney:20260925T115500
DTSTAMP:20260727T185319Z
UID:pretalx-bsides-canberra-2026-3VQLVR@cfp.bsidescbr.com.au
DESCRIPTION:Modern Bluetooth Low Energy tracking ecosystems: Apple Find My
 \, Samsung SmartThings\, Tile\, and Google Fast Pair\, have each implement
 ed privacy controls designed to prevent persistent observation and protect
  user privacy. This talk demonstrates how those controls fail in practice.
  Through passive BLE advertisement collection\, protocol-level attacks\, l
 inkage analysis\, we shows how rotating identifiers can be correlated acro
 ss time and space to re-identify devices\, attribute them to individuals\,
  and reconstruct movement histories.\n\nSpecifically\, it will explore how
 :\n- Rotating identifier schemes\, designed to prevent tracking\, can be d
 efeated through cryptographic\, temporal\, and behavioural linkage analysi
 s\n- Passive advertisement collection alone\, requiring no active probing\
 , no accounts\, and no interaction with target devices or ecosystems and i
 s sufficient to re-identify devices and reconstruct movement\n- Cross-vend
 or artefacts and advertisement structure leak identity signals that indivi
 dual vendors have not accounted for in their threat models\n- The privacy 
 guarantees communicated to hundreds of millions of users do not reflect th
 e practical reality of what passive observers can determine\n\nThe session
  will present a mix of linkage algorithms targeting different artifact cla
 sses across the four ecosystems and connect the findings to the broader qu
 estion of what "privacy by design" actually requires when adversarial pass
 ive observation is the threat model.
LOCATION:Off-Main Track
URL:https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/3VQLVR/
END:VEVENT
END:VCALENDAR