  We present a detailed privacy analysis of Samsung's Offline Finding (OF)
protocol, which is part of Samsung's Find My Mobile (FMM) location tracking
system for locating Samsung mobile devices, such as Samsung smartphones and
Bluetooth trackers (Galaxy SmartTags). The OF protocol uses Bluetooth Low
Energy (BLE) to broadcast a unique beacon for a lost device. This beacon is
then picked up by nearby Samsung phones or tablets (the {\em finder} devices),
which then forward the unique beacon, along with the location it was detected
at, to a Samsung managed server. The owner of a lost device can then query the
server to locate their device. We examine several security and privacy related
properties of the OF protocol and its implementation, from the perspectives of
the owner, the finder and the vendor. These include examining: the possibility
of identifying the owner of a device through the Bluetooth data obtained from
the device, the possibility for a malicious actor to perform unwanted tracking
against a person by exploiting the OF network, the possibility for the vendor
to de-anonymise location reports to determine the locations of the owners or
the finders of lost devices, and the possibility for an attacker to compromise
the integrity of the location reports. Our findings suggest that there are
privacy risks on all accounts, arising from issues in the design and the
implementation of the OF protocol.
