Bluejacking:

Bluejacking is the sending of unsolicited messages via bluetooth. The most common carrier for these message is in the form of a contact card, as the sending of it requires ne special software to be installed on either the recipients or the senders bluetooth enabled device. Bluejacking has become increasingly popular, and has been about since at least early 2003. A bbc article stated that “Mobile phone buffs have been bluejacking for months but it now looks set to become much more widespread.”1 but as far as I can see the full potential of bluejacking is still being realised even now, two years later.

Bluejacking should not be confused with bluesnarfing, which is the use of applications to exploit bluetooth connectivity and peoples nativity. In the past bluesnarfing tools have been used to steal the data stored on mobile phones, including pictures, diary notes and contact details.2 Another term which may lead to confusion is 'toothing'. The term toothing was coined in early 2004 and described the use of bluetooth messaging to find sexual partners in the immediate area.3 It was later revealed to be a hoax, but some claim that the hoax paved the way for the reality, and that toothing is now a very real genuine phenomenon.4

Bluejackers however fall into their own category, less malicious than bluesnarfers, and more anonymous than toothers. Bluejackers sometimes get their kicks by relatively mischievous, but for the most part harmless pranks. More often than not a bluejacker is happy just sitting behind their device name and watching the reaction of their target. In an interview with the founder of one of the more active bluejacking forums we get a first hand account as to why bluejacking is fun:

"I came across the idea of bluejacking at an online discussion forum and it immediately struck me as a fun thing to do, ... She said the "priceless" expression on the face of her first victim as he tried to work out what was going on has turned her into a regular bluejacker. "This, mixed with not knowing whether the victim will react in an amused/confused or negative way gives me an adrenaline rush," “ 5

I decided to try this bluejacking for myself and bought a bluetooth dongle.

1 Mark Ward , 2003
“New mobile message craze spreads”
Retrieved 7th November 2005
http://news.bbc.co.uk/1/hi/technology/3237755.stm

2 Munir Kotadia, 2004
“Bluetooth phones at risk from 'snarfing'”
Retrieved 7th November 2005
http://news.zdnet.co.uk/communications/wireless/
0,39020348,39145881,00.htm?r=20&t=1131398663

3 Lucy Sherriff, 2004
“Forget dogging, here comes toothing”
Retrieved 7th November 2005
http://www.theregister.co.uk/2004/04/19/blue_tooth/

3 Jim, 2003
“UPDATE: AN EXPERT WEIGHS IN on TOOTHING”
Retrieved 7th November 2005
http://www.hanasiana.com/archives/000333.html

Bluejacking tests (testing):
Back to the top

The arrival of the bluetooth USB dongle (I did not own any bluetooth enabled device until this) means I was able to indulge in a form of bluejacking. My bluetooth dongle came with CD containing a software package with which I could conduct my testing.

The software runs for the first time:

After plugging in the bluetooth dongle my unique address and device name are revealed:

Clicking the orb in the middle searches for devices in range, my house mates mobile appears:

After I request the services for this device the available ones are highlighted, however most require pairing to work:

I edit my standard business card, changing the name field to my message 'Sending a business card test':

I click to start the object push service, which attempts to send my vCard (the business card i have just edited) to the device 'Dust'. The program shows a transfer is in progress via a dotted line to the device:

The message was sent and received successfully. No pairing was required, the message didn't even need to be opened like an SMS or MMS, it merely appeared on the screen:

But these tests were carried out in my room, where 'Dust' was the only bluetooth device in range. In order to test the software, and further explore my idea I needed to find a large number of bluetooth devices all in the same place. So I did what any student who had been working for over a week without a drink would do and went to the bar. For research purposes.

Bluejacking in the field (Analysis and testing of target audience):
Back to the top

Having to carry around my laptop is far from ideal, but it does mean I am able to document my bluejacking experience better. Preferably this messaging should be done with a PDA or mobile, both of which are decidedly easier to remain inconspicuous with.

Luckily 'the hub', one of the bars on campus, was quite busy. A scan for bluetooth devices revealed that the mobiles in the patrons pockets were busy also:

The software lets me down somewhat at this point as it is only able to show 8 bluetooth devices at any one time. The scrollbar shows the others. It should be noted that 'Dust', 'Jetta' and 'Bob' were all sitting with me at the table, but other than them my dongle detected 10 other bluetooth devices in range. Thirteen was the highest number of devices I was able to detect all afternoon, no matter where I scanned. This could be another limitation of the software, the manual doesn't specify. Searches in both student bars which were open, and the food hall gave 13 results everytime.

For each bluetooth device which was detected a MAC address was always received. The software then attempted to get a user specified device name also, if it was unable to it merely displayed the mac address. The device names were more hit and miss as the screenshot shows. If a device name was not acquired it was because the signal was too weak, or the person with the device was merely passing through the area during the scan. If a device name did appear however a service request was almost always responded to, which meant a business card could be sent.

Mini evaluation:
Back to the top

The technology to send people messages through bluetooth is already there, and being used by some. But people are not using it in this way as much as they could, with the dominant use of bluetooth being to relay conversations to headsets. Bluejacking is a relatively easy thing to do, but it is not something the phone manufacturers are promoting. One argument could be that because of the free nature of bluetooth the companies are reluctant to get people chatting through it as they can't make any money from it. This might explain their lack of interest in developing and pushing any software to use it.

Maybe the problem lies in the lack of user friendly software for bluetooth messaging, my software was not particularly great, and I had an entire laptop at my disposal. It seems the most universal way to send a message which the sender knows has a high chance of arriving and being read by the recipient is through the vCard method. Sending messages to people is not the intended use for the transmitting of a contact card, so it is more of an exploit of the feature, rather than a predicted use. Other means of sending messages, such as pictures, require pairing, which is designed to be carried out when you are using both devices yourself, requiring an identical passcode at either end. The passcode itself can be different everytime you pair with a new device, it doesn't matter what it is so long as it is entered the same on either device. Often people wishing to pair and share images will set their device name as their passcode.

Perhaps if there were software to facilitate the sending of bluetooth messages via contact cards it would really take off, because it's clear from my audience analysis there are enough people out there with bluetooth enabled devices capable of receiving messages.

In the next section I will research why people aren't using bluetooth to meet new people, and see if I can find software specifically designed to help people communicate through bluetooth.

As far as i am aware bluetooth communication between devices such as mobiles and PDAs is limited to text based messages, unless paired. Clearly bluetooth has the bandwidth to support voice communication, as it does so between phone and headset. That said the short range of bluetooth means any conversations could be carried out face to face, making a bluetooth voice communication agent rather pointless. In fact it would possibly even be counter productive as it would get two more people on their phones in the same area, something which I have already highlighted can cause irritation to people forced to listen. The only use I could see for it would be finding somebody in a crowded area. I and countless others no doubt have wasted money on 10 second calls used simply to pinpoint the exact location of somebody in the immediate area.