Georgia Tech Finds Security Flaws in Tile Bluetooth Tags

Researchers at the Georgia Institute of Technology have identified security flaws in Bluetooth tracking tags made by Tile that, they say, could allow strangers or the company itself to follow a tag's movements. The research team disclosed the findings to Tile's parent company, Life360, in November 2024 and reported that communications with the company ended in February. Life360 has since said it implemented a number of improvements but has not provided detailed public information about the fixes.

The vulnerabilities center on how Tile tags broadcast identifying information. Each tag sends a unique identifier that rotates periodically and a Bluetooth MAC address that remains static. Researchers say both pieces of data are transmitted without encryption, allowing anyone with a smartphone or a radiofrequency antenna to passively collect broadcasts, link them to a single device, and track its movements over time. The team also reported that identifiers sent to Tile's servers appear to be stored in readable form, a practice that would permit centralized tracking if those server logs can be linked to devices.

The research team demonstrated multiple attack scenarios. One involves...