Nov 18, 2019 7:00 AM

Burglars Really Do Use Bluetooth Scanners to Find Laptops and Phones

Bluetooth scanners are readily available and easy to use—which means that smash-and-grab car break-in might not have been pure chance.

At the beginning of October, a 31-year-old construction estimator named Samantha parked her Honda Fit on the street in Chicago. She left her backpack with a laptop and external hard drive in it under the backseat, and carefully covered the seat with a black blanket. Yet by the time she came back to her car, a burglar had smashed a window, broken in, and stolen the bag. Samantha reported the incident to the police but never heard back.

Unfortunately, car burglaries are common in the United States, especially in large cities. But Samantha's experience also has something else in common with many other break-ins around the country: It felt like the robbers knew there was valuable gear in the vehicle.

"I had other things in the car worth money, like a wallet with $50 emergency cash in the glove compartment, a bag of near-new boxing equipment, and a case of beer in the trunk," Samantha says. "But the laptop and hard drive were what was taken, which is what made me think there was something involved to find electronics specifically."

A recent rise in laptop and gadget thefts from cars, particularly in San Francisco and the larger Bay Area, has left victims and police wondering if burglars are using Bluetooth scanners to choose target cars based on which have gadgets inside emitting wireless signals. Many laptops and gadgets will put out a sort of beacon by default when their Bluetooth is turned on, so that other Bluetooth devices can find them and potentially pair—even when closed or idle.

"A lot of that has to do with power savings; it depends on what sleep mode different laptops go into when the lid is closed," says Jake Williams, founder of the security firm Rendition Infosec, who often uses Wi-Fi and Bluetooth scanners in penetration testing. "But I have little doubt that some thieves are using Bluetooth scanners to target devices. It's trivial to use one, so it's not like technical knowledge is a limiting factor."

In fact, they're not even specialized devices. You can easily install a Bluetooth scanner app; it uses your smartphone's own internal Bluetooth sensors to find nearby signals. They not only list everything they find, but provide details like what type of device they're picking up, whether that device is currently paired to another over Bluetooth, and how close the listed devices are within a few meters. The apps are often marketed as tools for finding lost devices, like scanning for your misplaced FitBit at your in-laws' house. But they're dead simple to use for any purpose—and they surface many more results than your phone does on its own when looking for something to pair with in your Bluetooth settings.

Still, criminal use of Bluetooth scanners has been dismissed by some as an urban myth. Some researchers point out a much simpler explanation: Maybe the burglar just watched the victim put their laptop bag in their trunk or hide it in the back seat. And given how common it is to leave valuable tech behind in a vehicle these days, it's not inconceivable that burglars are just playing the odds.

"If I'm sitting in a parking lot and going to break into a car, and I see someone get out of their car and put something in their trunk, then walk away, would I bother checking my iPhone to see if a Bluetooth beacon is beaconing from that trunk," says car security researcher Tim Strazzere. "No. I'm going to smash the window two seconds after they're out of view, take the bag, walk away, and look at it when I'm out of sight again. Save the time, go fast, grab everything."

But law enforcement officials have confirmed to WIRED that at least some burglars do use Bluetooth scanners to guide certain break-ins. "In our corridor, yes, we have noticed that they are in use," says Monica Rueda, a crime prevention specialist at the San Jose Police Department in California. "Right now we do know that thieves are utilizing them." Rueda declined to name specific apps or features that are in use, citing ongoing investigations.

Regardless of the specific method preferred by crooks, though, Rueda says that she and other SJPD crime prevention specialists strongly discourage people from ever leaving valuables unattended in their cars. If you have to do so for some reason, she says, place them on airplane mode or fully power them down rather than leaving them in any type of sleep or standby mode. "Even if you might think the battery is dead, it might not actually be dead, it might still be able to emit a signal," she says.

Victims like Samantha emphasize that thefts feel particularly targeted when burglars only take electronics. In October, tech worker James Madelin left his BMW unattended for two hours in Geneva, Switzerland. When he returned, thieves had stolen only the iPad he had slipped under the passenger front seat. The possibility of a Bluetooth scanner hadn't occurred to Madelin until he saw a tweet from an Amazon employee about an apparently scanner-related theft in Mountain View, California. "Something about the way they did it all so smoothly—when I saw that tweet, I just figured, 'Huh! That is totally likely,'" Madelin says. "I'll never know for sure, though."

Many victims told WIRED that they face that exact conundrum. Without more information from police, it's difficult to know exactly what happened in a given situation. Many incidents that seem related to a Bluetooth scanner could just as easily be explained by an analog technique. Most police departments WIRED contacted didn't reply or were wary of providing information about precisely how car burglars use Bluetooth scanners, if at all. This may be part of why the idea of car burglars using wireless scanners to find targets has become a sort of urban legend.

But SJPD isn't the only precinct to discuss their use. "When a person attempts to hide their laptop computer or other electronic device under a car seat or in a glove box out of sight, it's possible for a Bluetooth scanner to let a thief know that an electronic device is in that car," lieutenant Joe Donleavy of the Walnut Creek, California, Police Department wrote in a 2018 Nextdoor post. Besides, Bluetooth scanners are so incredibly simple to use that they seem at least like a tempting tool.

"I'm sure you can make money by stealing stuff and just playing the odds, but why risk breaking into a car that has nothing in it if you can know a vehicle has something of value in it," Rendition Infosec's Williams says.

It's all a good reminder to make sure you fully turn Bluetooth off when you're not using it on your devices. And when you do have to leave things in your car, power your devices down so they're totally off. But the safest approach is to remove valuables from your car altogether rather than hiding them or leaving them in the trunk. "Our advice is don’t leave it in the car to begin with," says SJPD's Rueda. "It’s a very low-tech way to make sure that that crime doesn’t happen."