BM2 Battery Monitor Reporting Location Data to Hong Kong

TL;DR: Someone reverse-engineered the BM2 battery monitor and found that the application was reporting 10-meter-precise location data to Mainland China and Hong Kong. As a result, the developer has since stopped collecting data in Mainland China, but GPS location data is still sent to an Alibaba hosted server in Hong Kong.

I know a few of us on here are using a

$29 Battery Monitor BM2 BM3 Bluetooth 4.0 Wireless Battery Tester 12V Automotive Battery Load Tester,Automotive Charging and Cranking System Monitor Digital Battery Analyzer for Android & iOS

Bluetooth Low-energy (BLE) Battery Monitor that is sold under a variety of names. I was looking for a way to capture and display the traffic from the device as I wanted to make my own monitoring application for near-real-time streaming data. As I was researching the protocols, applications, etc. associated with this device, I stumbled across an article from Hackaday which reports that this device is sending location data, cell phone tower IDs, WiFi beacon data, and more, to servers in Mainland China and Hong Kong.

Hacker haxrob reverse-engineered the application and protocols the device is using and reported all of this information via his blog. As a result of his work, the developer of the BM2 device has since removed the AMap Software Development Kit (SDK) that was sending precise location, wifi and cell phone tower data to Mainland China, but GPS location data is still sent to an Alibaba hosted server in Hong Kong. Apparently the iPhone application will also "resolve and send the user's street address."

While this isn't a terrible concern of mine as most of us are already sending all of our personal data to a variety of data farms, I figured I would post this here for general situational awareness and for the more privacy-focused individuals amongst us.

 

Amazing what companies will do for a buck. Then again, who knows where the data from our phones goes… with geofencing and the like your every move is j own unless you leave the phone and car at home.