💻 computer science

AirCatch: Effectively tracing advanced tag-based trackers

AirCatch is a passive detection system that identifies advanced rogue trackers by exploiting stable, physical-layer Carrier Frequency Offset (CFO) fingerprints to bypass identifier-rotation evasion tactics, utilizing a low-cost SDR-based receiver for practical deployment.

Original authors: Abhishek Kumar Mishra, Swadeep, Guevara Noubir, Mathieu Cunche

Published 2026-02-10

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Abhishek Kumar Mishra, Swadeep, Guevara Noubir, Mathieu Cunche

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "Digital Shape-Shifter" Stalker

Imagine you are walking through a crowded mall. Most people are just passing through, but there is one person following you. To stay hidden, this person is a master of disguise. Every time they pass a security camera, they change their clothes, put on a different hat, and even change their name.

By the time the security guard looks at the footage from five minutes ago, the person they are looking for "doesn't exist" anymore because the name and outfit have completely changed.

This is exactly what advanced rogue trackers (like modified AirTags or Tile tags) do. They use "identifier rotation." They broadcast a signal that says, "I am Device A," and then a few seconds later, they broadcast, "I am Device B." Most current anti-stalking tools look for a single device that stays the same. When the device keeps changing its "name" (its digital ID), the security tools get confused and think they are just seeing a bunch of different, unrelated people.

The Solution: AirCatch (The "Fingerprint" Detector)

The researchers behind AirCatch realized that while a person can change their clothes and name easily, they cannot easily change their physical gait or the unique sound of their footsteps.

Even if a tracker changes its digital ID, the physical hardware inside it (the radio chip and the oscillator) has tiny, microscopic imperfections. These imperfections cause a very specific "wobble" in the radio frequency, known as Carrier Frequency Offset (CFO).

Think of it like this: Even if a person changes their clothes, their heartbeat or the specific rhythm of their walk remains the same. AirCatch doesn't look at the "name" on the digital ID; it listens to the "heartbeat" of the radio signal.

How AirCatch Works (The Three Pillars):

The "Digital Heartbeat" (Modulation-Aware Fingerprints):
Instead of just looking at one simple signal, AirCatch looks at a complex "fingerprint." It analyzes how the signal changes during different types of bit transitions (the 0s and 1s in digital code). It’s like not just listening to a person's heartbeat, but also the specific way their breath hitches when they speak. This makes the fingerprint incredibly unique and hard to fake.
The "Crowd Filter" (The Detection Algorithm):
In a busy place like an airport, there are thousands of signals. AirCatch is smart enough to ignore the "passersby." It looks for a specific pattern: A group of different names that all share the exact same "heartbeat" and stay in the same area for a long time. If it sees ten different "people" (IDs) all walking with the exact same unique limp, it knows it’s actually just one stalker in different disguises.
The "Pocket Guard" (BlePhasyr):
Usually, high-tech radio analysis requires massive, expensive laboratory equipment. The researchers built BlePhasyr, a tiny, $10 device (about the size of a thumb drive) that can do this heavy lifting. This makes it possible to turn a regular smartphone into a powerful anti-stalking shield that you can carry in your pocket.

The Results: Does it actually work?

The researchers put AirCatch to the test in real-world "stress tests"—commutes in cars, walking through offices, and even the chaotic environment of an airport.

Zero False Alarms: In a crowded airport, it didn't accidentally flag innocent people as stalkers.
Catching the Stealthy: Even when the "stalker" device was programmed to be incredibly sneaky—changing its name every single time it spoke and only "whispering" once every minute—AirCatch still caught it.
Early Warning: It provides alerts fast enough to actually be useful to a person being followed.

Summary in a Nutshell

AirCatch turns the stalker's greatest strength (changing identities) into a weakness. By ignoring the "names" and focusing on the "physical heartbeat" of the radio signal, it can spot a shape-shifting tracker hiding in a crowd, providing a low-cost, high-tech shield for everyone.

Technical Summary: AirCatch: Effectively Tracing Advanced Tag-Based Trackers

1. Problem Statement

The proliferation of BLE-based item trackers (e.g., Apple AirTag, Google Find My Device) has created a dual-use dilemma: while useful for finding lost items, these devices can be repurposed for stealthy stalking. Current defenses—both protocol-level (rotating MAC addresses/identifiers) and platform-level (user alerts)—rely on identifier continuity.

An advanced adversary can exploit this by using modified firmware to perform aggressive identifier rotation (changing MAC/payloads every transmission) and duty-cycling (varying transmission intervals). This breaks the linkability required by existing detectors, allowing a tracker to follow a victim without leaving a persistent digital trail.

2. Methodology

The authors propose AirCatch, a passive detection system that shifts the detection paradigm from the logical layer (identifiers) to the physical layer (analog imprints).

Core Insight: While logical identifiers can change arbitrarily fast, the hardware-induced imperfections of a transmitter’s oscillator (specifically the Carrier Frequency Offset or CFO) remain stable. An attacker following a victim will manifest as a "persistently occupied, abnormally compact region" in the CFO feature space, even as their MAC addresses churn.
Fingerprint Design: AirCatch uses a 5-dimensional modulation-aware CFO fingerprint. This includes:
- The global packet-level CFO (proxy for oscillator mismatch).
- Four transition-conditioned CFOs ( $c_{\Delta f}^{00}, c_{\Delta f}^{11}, c_{\Delta f}^{10}, c_{\Delta f}^{01}$ ), which capture hardware-dependent asymmetries occurring during specific bit transitions (e.g., $0 \to 1$ vs. $0 \to 0$ ).
Detection Algorithm: The system processes data in temporal blocks using a four-step pipeline:
1. Segmentation: Groups packets by window, ecosystem, and identifier to prevent "contamination" from unrelated devices.
2. Clustering: Uses Ward agglomerative clustering in a standardized CFO space to find dense regions.
3. Core Density Calculation: Measures how "compact" a cluster is by calculating the ratio of identifier diversity to the cluster's physical radius in CFO space.
4. Persistence Tracking: A tracker is only flagged if a high-density core persists for a minimum duration ( $T_{min} = 40$ minutes), filtering out transient bystanders.
Hardware Implementation: They developed BlePhasyr, a low-cost ( $\approx \$ 10$) micro-SDR based on the Seeed XIAO MG24 and ESP32-S3, capable of streaming raw IQ samples for high-fidelity CFO extraction.

3. Key Contributions

Modulation-Aware Fingerprinting: A novel method of decomposing CFO based on bit transitions to increase device distinctiveness.
Passive Detection Framework: A robust algorithm that detects trackers despite per-transmission pseudonym rotation and variable transmission rates.
BlePhasyr Hardware: A practical, ultra-low-cost SDR designed specifically for continuous, resource-constrained anti-tracking monitoring.
End-to-End System: An Android application that provides actionable user alerts and technical transparency.

4. Results and Evaluation

The system was evaluated against Apple, Google, Samsung, and Tile ecosystems across diverse mobility traces (commutes, public transport, airports).

Fingerprint Stability: CFO features proved highly stable over time and across different sensing hardware (SDR vs. BlePhasyr).
Detection Accuracy: In stress tests involving advanced adversaries (rotating IDs every 2–60 seconds), AirCatch achieved zero false positives in benign environments (including a dense airport setting) and successfully detected all adversarial configurations.
Robustness to Evasion: Even when attackers used "stealth" modes (low transmission rates), AirCatch maintained detection, provided the tracker remained close enough to be observable.
Comparison to State-of-the-Art: Unlike platform-native alerts (Apple/Google), which can be delayed by over an hour or evaded by rapid rotation, AirCatch provides earlier and more consistent detection across multiple ecosystems.

5. Significance

AirCatch represents a significant shift in privacy protection. By grounding security in the immutable laws of physics (analog hardware impairments) rather than the malleable rules of protocols (digital identifiers), it provides a defense that is inherently resistant to the most sophisticated software-based evasion techniques. Its low-cost hardware implementation makes it a viable candidate for consumer-grade, everyday anti-stalking tools.