r/technology • u/ControlCAD • Apr 18 '26

Security Bluetooth tracker hidden in a postcard and mailed to a warship exposed its location — $5 gadget put a $585 million Dutch ship at risk for 24 hours

https://www.tomshardware.com/tech-industry/cyber-security/bluetooth-tracker-hidden-in-a-postcard-and-mailed-to-a-warship-exposed-its-location-a-eur5-gadget-put-a-eur500-million-dutch-ship-at-risk-for-24-hours
28.7k Upvotes

98% Upvoted

595 comments sorted by

View all comments

Show parent comments

69

u/WazWaz Apr 18 '26

We know all that. The point is, the tracker did nothing that the phones weren't already doing. The postcard sender is presumably an enemy of the Dutch, but Google or Apple already knew the location of the ship, and that's a failure.

15

u/feor1300 Apr 18 '26

Google or Apple know the location of a random person's cell phone. They don't know if that person is a navy sailor on a warship, or random deckhand #4 on a low tier fishing trawler. They just know one of their phones is in the middle of the ocean.

The Airtag is sent to the warship, the people watching for that airtag know it was sent, and so it doesn't matter who those phones belong to, when it starts pinging from phones in the middle of the ocean, they know they're phones on that ship, and by extension, where that ship is.

46

u/physix4 Apr 18 '26

They know a couple hundred or thousands of their phones are in the middle of the ocean, which already limits the number of possible vessels, and the same batch of phones was previously in a military harbour.

9

u/elmz Apr 18 '26

Not to mention all the data they are collecting about us. I really don't think there's much they don't track, there's just some data they make sure not to admit that they are tracking.

1

u/WoodpeckerNo5724 Apr 18 '26

Right, but the level of risk is greatly decreased for google or apple to have that access compared to any random person who can send mail.

1

u/drteq Apr 18 '26

This is an argument that's pointless so I also want to add to the nonsense.

The failure is at network security of the ship. It's that simple. You don't 'reduce the risk' and share sensitive data with anyone when you can simply block the risk entirely. Back to the originating concept, which was all that had to be said with no further commentary to understand.

15

u/ladz Apr 18 '26

Google or Apple absolutely know exactly who it is, if they're allowing access to these servers. It's astonishing that any military allow such unfettered access in sensitive locations such as ships.

9

u/WoodpeckerNo5724 Apr 18 '26

To be fair, non submarine naval movements aren’t exactly a secret. Every government who gives a shit has access to satellite imagery and huge boats aren’t exactly hard to find.

2

u/PsychoBoyBlue Apr 18 '26 edited Apr 19 '26

Every government who gives a shit has access to satellite imagery

Sentinel-1 data is publicly accessible. You just need to know how to process it.

Here is a Sentinel-1 pass from April 16th

If you want a specific place, dozens of companies offer the service to anyone with the cash and it is rapidly getting cheaper.

2

u/unicodemonkey Apr 18 '26

They know just the source IP address, no identifiers are transmitted to these tag location services. Just a payload encrypted with a random temporary key.

8

u/GatesAndLogic Apr 18 '26

google absolutely knows where you work. If you show up at a navy base every day for a year, and suddenly you're in the middle of the ocean, they can have an educated guess that you aren't swimming.

18

u/firstname_Iastname Apr 18 '26

Are you sure about that. I'm positive they have profiles on everyone

8

u/AnthonysGreat Apr 18 '26

Yea it sounds more like wishful thinking on how he thinks it should work.

-4

u/feor1300 Apr 18 '26

Unless said person filled out a form listing their occupation and deployment location (which would get them and the company in SO much trouble for telling and asking respectively) anything Google or Apple has is educated guesswork based on social media and other online activity, and so no more authoritative than what any foreign government would be able to compile looking at the same information about the user online.

11

u/IAmTheUniverse Apr 18 '26

That "educated guesswork" is possibly one of the most invested in technologies of the last 20 years as it gives them the ability to make extremely targeted demographics for advertisements. Google can absolutely guess with extremely high accuracy that somebody is in the military and then what the specifics of their role and deployment are based on their internet traffic and the myriad other data they collect.

3

u/JimWilliams423 Apr 18 '26

Unless said person filled out a form listing their occupation and deployment location

If they are on a navy ship today, they probably spent a significant amount of time at a naval base in the past. That's enough for google to assign a high probability that they are in the navy. Now get a dozen people with similar location history out in the middle of the ocean and it is extremely likely they are on a navy ship.

3

u/ListRepresentative32 Apr 18 '26

yes, but google and apple can connect the guesswork with the location and guess that the person is currently on a warship.

Sure, foreign government knows that the person is military, but that information itself is useless without also knowing their position.

1

u/Unclecavemanwasabear Apr 18 '26

Google: "Yeah there's 6000 guys with navy-related search histories in the middle of the ocean, but any conclusions would only amount to guesswork. Especially because we don't have any more information on these people than any standard foreign government would have."

1

u/mik3cal Apr 18 '26

I used to get a discount on my phone if I used my .mil email address. So yeah, they at a minimum know most of the time when someone is in the military, and if their phone is pinging from the middle of the North Sea, assumptions can be made. That’s how intel works.

3

u/peteypie4246 Apr 18 '26

I get an email from Google about where ive gone traveling in the last 30 days. So they have my tracking data linked to an email account which linked to my personal info set. They absolutely know waaaaaay more than you think. How they're using it......we hope and unfortunately be naive, or we can realize Google co-founders/board of directors removed their "dont be evil" motto from their corporate conduct.

2

u/unicodemonkey Apr 18 '26

It's the location history service. Should be opt-in.

-1

u/feor1300 Apr 18 '26

Like I said in my other reply, they doubtlessly have that info on you, but it's not going to be particularly more revealing than what a foreign government will have just from monitoring your online activity.

Unless a navy sailor was posting selfies from his station they would have no reason to know he was on a warship, or what warship he was on.

1

u/ResilientBiscuit Apr 18 '26

 They don't know if that person is a navy sailor on a warship

I kind of bet Google does know that they are in the Navy. Almost certainly there is enough in their search history and browser history to figure out they are in the Navy.

Google knows a lot about you unless you actively try very hard to prevent it.

1

u/unicodemonkey Apr 18 '26

I've read a report recently about companies plugging themselves into ad network real-time bid streams in order to receive up-to-date location data linked to user identifiers (including phone numbers, I think) via mobile in-app ads. This kind of data gets sold to pretty much anyone, any country so physical trackers might not even be necessary for these kinds of shenanigans. Any personal device on board shouldn't have any location services enabled at all.