Researchers have discovered major security flaws with Tile tracking tags, according to a report by Wired. These flaws could allow both the company itself and tech-savvy stalkers to track a user’s location. The security issue could also let a malicious actor falsely frame a Tile owner for stalking, as the flaw can make it appear as if a particular tag is constantly in the vicinity of somebody else’s tag.
The issue pertains to how Tile tags transmit data during use. Tile tags transmit a lot of data beyond that of other trackers, including the static MAC address and the rotating ID. According to reporting, none of this stuff is encrypted. The rotating ID changes all of the time, but a MAC address doesn’t.
Researchers believe that all of this information is stored in cleartext, making it easy for hackers to get ahold of. This also would theoretically give Tile itself the ability to track its users, though the company says it doesn’t have this capability.
It gets worse. Anyone with a radio frequency scanner can allegedly intercept all of this information as it’s being transmitted, creating another potential security hole. Also, this problem might not even be solved if Tile decides to stop transmitting the MAC address. This is because the company generates its rotating ID in such a way that future codes can be reliably predicted from past ones.
“An attacker only needs to record one message from the device,” one of the researchers behind the findings said, adding that a single recorded message will “fingerprint it for the rest of its lifetime.” The researcher said this creates a risk of systemic surveillance.
The security researchers, who are involved with the Georgia Institute of Technology, reached out to Tile’s parent company Life360 in November of last year to report the findings. Wired said the company stopped communicating with the researchers in February. The company did say it has made a number of improvements to its security but didn’t elaborate further.