NoPeek: Detecting smart glasses and VR headsets via immutable BLE manufacturer company IDs — open source Android tool
Source Reddit BlueTeam
Discussion
NoPeek is an open-source Android tool designed to detect smart glasses and VR headsets nearby by scanning immutable Bluetooth Low Energy (BLE) manufacturer company IDs. These company IDs are embedded in every BLE advertisement frame and cannot be randomized or hidden, unlike MAC addresses. The tool uses a three-layer detection approach: primary detection via BLE manufacturer IDs, secondary confirmation via device name keywords, and a low-confidence fallback using MAC OUI prefixes. It targets devices such as Meta Ray-Ban glasses, Snap Spectacles, Meta Quest VR, Apple Vision Pro, and others. NoPeek operates locally on the device without internet connectivity, preserving user privacy. Detection is probabilistic and limited to devices broadcasting BLE signals when powered on. The tool is intended as a privacy awareness aid rather than a comprehensive security solution.
r/blueteamsec+AskNetsec+Information_Security (opens in a new tab)u/Still_Neck73280 points0 comments
- This post was deleted. Content shown was captured before removal.
TL;DR: Built an Android app that detects Meta Ray-Ban glasses,
Snap Spectacles, VR headsets and other camera-capable devices
using BLE manufacturer company IDs — which are immutable and
cannot be randomized unlike MAC addresses.
---
**The technical problem**
MAC address randomization has made passive BLE device fingerprinting
unreliable. However, the manufacturer company ID embedded in every
BLE ADV frame (bytes 0-1 of the Manufacturer Specific Data field)
is assigned by the Bluetooth SIG and is immutable — it cannot be
rotated or hidden.
This means even with MAC randomization active, devices still
broadcast their manufacturer identity on every advertisement.
**Detection method**
NoPeek uses a 3-layer detection system:
Layer 1 — BLE Manufacturer Company ID (primary)
Matches against Bluetooth SIG assigned company IDs:
- 0x0D53 — Luxottica (Ray-Ban manufacturer) — unique to Ray-Ban
- 0x03C2 — Snapchat Inc — unique to Spectacles
- 0x01AB — Meta Platforms Inc
- 0x058E — Meta Platforms Technologies
- 0x0BA7 — Pico Technology
- 0x00E0 — HTC Corporation
- 0x07D7 — TCL Communication
Layer 2 — Device name keyword matching
Only reliable during pairing/power-on. Used as confirmation.
Layer 3 — MAC OUI prefix
Low confidence fallback only — randomized on modern devices.
**False positive prevention**
Apple's 0x004C is broadcast by ALL Apple devices. NoPeek requires
BOTH the company ID AND device name "Vision Pro" before flagging
— preventing iPhones from triggering alerts.
**RSSI threshold**
Default -75 dBm per research by Nearby Glasses project
(~10-15m outdoors, 3-10m indoors). User configurable.
**Limitations**
- Devices only broadcast BLE when powered on
- Some devices may disable BLE broadcasting in certain modes
- Detection is probabilistic, not guaranteed
GitHub: https://github.com/getnopeek/nopeek-android
Built with Kotlin. MIT license. Contributions welcome especially
additional company IDs and false positive reports.