Before we get into how to track a phone, for example, it’s important to understand the first steps to protecting yourself as much as possible. First, do not leave your phone unattended. Do not leave it unlocked. Do not leave it without a password. Use a strong password scheme. Make sure that nobody is shoulder surfing you when you use your phone. In Chapter 8, mitigation strategies will be covered in detail; however, it’s important to note here that by practicing simple security steps, such as those listed above, you lessen the attack surface significantly.

Before we get to mitigation, let’s recapitulate what we have learned in earlier chapters about why someone would track you in the first place. Tracking is done for good reasons and on purpose. As a company, we need to know how many units we sold this quarter for financial statements. We track the units, the progress, and so on. This can be manipulated, however, for example, if we wanted to see what demographic purchased specific units and then we build a campaign to market to the specific demographic. This is good but questionable. This is a good example of simple tracking for logistical purposes turned into a marketing campaign. Another good reason would be hospitals that do bed tracking to keep inventory of their patients. They can use chips such as radio-frequency identification (RFID) to do this tracking. We also have to consider patient security and confidentiality. We can encrypt or secure this data to ensure safety. What if this information got into the wrong hands? Now we can start to see how good tracking can be further manipulated into a danger zone. As shown in Figure 5.3, the number of devices using RFID is increasing and allowing for advanced tracking of devices.

How can this type of tracking be used for bad? It can be turned into malicious intent when the tracking is used for surveillance and reconnaissance of targets such as people simply using their mobile phones. They may turn on location tracking so that they can allow applications on their devices to assist with finding things and giving specific directions, for example, but what if that location-based service (LBS) was used to further exploit buying patterns. What if it was used to track location? What if it got into the wrong hands?

Bad reasons … and there are many, need to be considered when you think about how to safeguard your identity and privacy. Reconnaissance and surveillance techniques used to gather information about a target are nothing more than the exploitation of information that can be gathered through the myriad of ways available. The ability to track a target today is exponentially growing easier as more and more users move to mobile devices and more and more devices come to market to allow for tracking abilities. A rule of thumb is to limit your exposure. Only use what you need and be cautious. Think about why you want to use a service, device, or application before using it and consider the risks. Also apply common sense to every situation you are in.

So what about physical devices? In this section, we will review some of the devices that you can use to track things; however, some of them can also track you!

As shown in Figure 5.4, the number of devices coming to market that people are wearing and carrying is becoming a concern to those who want to maintain privacy. With physical devices, you find that they can be clipped anywhere and can perform functions such as tracking your blood pressure or how far you have walked; however, it is when it is married to an application that the concern should set in.

As shown in Figure 5.5, the physical devices (such as ones people may put on their pet) can be tracked through the Internet (the cloud) to a computer of mobile device. Once it does so, it can then be tracked with all of the fingerprinting information we mentioned earlier.

Physical and application tracking is beginning to blur. You can, in fact, place a physical tracking device in the car of an unsuspected person (perhaps your significant other) to track their whereabouts, but it’s not until this device is viewed in an application console or the device is linked to an application that you can view the tracking information. Therefore, it should be noted that physical and application-based (or logical) tracking go hand in hand when tracking targets today.

As shown in Figure 5.6, the devices that can be used for tracking may use different technologies to allow for target tracking. For example, some are USB devices that, once placed, need to be retrieved. Some use GPS technology to communicate with a server that can allow it to be tracked and mapped.

Physical device tracking is a concern for those who are being stalked. For example, if an attacker is interested in learning your location, where you go and what you do, and wants to track you, they simply need to place a tracking device on you or in something you own, such as your car. You may never find it if it is placed in your car. An example could be, if a significant other wanted to see where you go on while you say you are at work. Are you stopping by a motel during the day? The physical tracker could give your location.

Some technologies are used for purposes of locating trucks in a fleet, as shown in Figure 5.7. Asset tracking is used to ensure that a fleet of trucks can be mapped and monitored for many purposes, one being to be able to give the customer accurate shipping information. It can also be used in emergencies.

As we can see, tracking is only bad when maliciously used but it’s hard to control. It really depends on who uses the technology and why they use it – are they using it for the wrong reason? Then it is considered a problem. That being said, we really need to understand the fundamentals of being safe with the technical landscape growing toward allowing ourselves to be tracked.

You should always consider that you can and will be tracked. This should give you the edge you need to check yourself for tracking devices. Consider that you should always review what “tracking” you will allow of yourself with tracking technology. For example, if you use a health tracker, does it contain sensitive information you do not want to share? If this device connects to an application, do you want it to save this information? Where is it saved? On a central database server? Who has access to this data? As shown in Figure 5.8, the devices that map your location are always targets of misuse. You can quickly use a device on your phone that allows the tracking of your exact location at all times.

When using LBS, GPS, or any other application that uses a positioning and locating system, you can quickly become the target of another person or group. We discussed in earlier chapters how the government can track your activity and location, so consider it possible that others can too. When you sign on to Facebook, it tracks the device in which you signed in to it with. Facebook calls it security; however, it can be considered privacy infringement.

As shown in Figure 5.9, the mapping that can be done when you are being tracked is significant. For example, you can be tracked based on pattern. Your work routine, where you shop, and what main roads you take. As an example, it could be found that you take the same major road to work every day and are usually in the location at a specific time.

This level of tracking is concerning. What if this information got into the wrong hands? What if someone is doing this without your knowledge? These are all the reasons why you should always consider the risks when using tracking devices. You can always review your devices (or choose not to use them) for tracking. Yes, your phone could still be tracked, we made this clear; however, you could also check for extra applications or services (such as LBS) that can help track you.

The best way to stay anonymous is, if you do not want to be tracked, leave your mobile device (and all tracking devices) at home when you leave the house. Consider that you will be on video camera and you could be tracked in your vehicle (license plate is a fingerprint), for example; however, you could take the bus. Disguise yourself. Sounds pretty crazy, doesn’t it? That’s because it is – you literally have to strip yourself of any traceable devices and travel in disguise to remain anonymous!

The only way to mitigate this threat is to limit exposure. Consider and weigh the risks of using tracking technology. Do not leave your car unlocked and do not leave your purse out of sight. Do spot checks. Leave your phone locked and on your person. Be slightly paranoid to remain safe.

As shown in Figure 5.14, the growth of smartwatches has begun and they will soon be mobile computing devices with the same baked-in technology of most tablets or smartphones. That being said, LBS will need to be disabled or refined within them as well. Yes, you still need to consider and mitigate threat with Bluetooth; however, location tracking of your smartwatch is also a concern today.

Today, we are watching smartwatches evolving quickly. Google Android is currently leading the effort with their smartwatch offerings. As with mobile devices (phones and tablets), they are still vulnerable to penetration and could be hijacked and manipulated by an attacker. They can also track your location. As shown in Figure 5.15, the smartwatch does not look like a mobile device; however, it is a computer-based mobile device that you wear as a watch.

As a final example, the FiLIP smartwatch is used by parents to help track a child’s location. You can program this limited use phone for a child so that it contains a few numbers and can be dialed easily, especially in an emergency; however, what it does do well is help you track the location of your child. This technology is continuing to grow and you should not only be prepared for it, but you should embrace it because it is not going away. You can limit your exposure to it by awareness that is what we intend to show you in this chapter. You can secure your privacy but you need to know the difference between how technology can be misused, what the threats are, and mitigate them if possible.