Knowing the MAC makes the attack reasonable - let's say 5 hours compute for 3080Ti.
Not knowing the MAC makes it exponentially harder. You can still "guess" it, but the search-space is vast and that would take bazillion-years.
So to attack iOS device:
- user has to download the app
- app has to broadcast fake BLE
- some other devices (e.g. Android/RasPi would need to pickup that MAC and pass it to you
You don't need MAC address - you just need the iPhone to broadcast specific BLE advertising packet/payload.
Using Core Bluetooth API it is trivial, but you need to either:
a) create an app that does it and user has to download it
b) modify SDKs existing in apps (e.g. Ad SDKs)
Also turning app/phone into a "BLE beacon" is only possible when app running in the foreground (on iOS).
Founder of Estimote, Inc. (YC S13) here — we do beacons.
In Project Aria video, they claim to have installed beacons at an airport to enable indoor location, only to dismiss it as something that "doesn't scale."
Instead, they say they "trained" an AI model using vision from glasses, allowing for vision-based localization.
So, here’s an honest question: which approach is actually easier, more cost-effective, and energy-efficient?
1) Deploying 100 or even 1,000 wireless, battery-operated beacons that last 5–7 years—something a non-tech person can set up in a day or two.
2) Training an AI model for each airport, then constantly burning compute power from camera-equipped glasses or phones that barely last a few hours.