internalblue VS BLEHeartRateLogger

I wonder how they deal with the channel hopping? I remember BT "Classic" derives the hoping sequence from the encryption key. Not sure if that changed significantly for BLE? So either they establish normal connections between relays and victims (meaning two keys, one between each relay and each victim), and then forward data coming out of the Link Layer between the attacker devices - or they need to sniff the whole spectrum in case there is just one key between car and fob.

Last time I checked, sniffing the full spectrum of BT required three SDRs, meaning six in total; making this attack rather expensive to pull off (no problem for professional thieves though, I guess). OTOH if they can use any BT stack (or manipulate it with e.g. InternalBlue[1]), potential carjackers just need two Android Phones and good WiFi :(

[1] InternalBlue: https://github.com/seemoo-lab/internalblue

Maybe check out projects like https://github.com/fg1/BLEHeartRateLogger which uses Bluetooth, or maybe projects like https://johannesbader.ch/blog/track-your-heartrate-on-raspberry-pi-with-ant/ that use Ant+. Both are written in Python, so assuming you have drivers for Mac that are compatible then the solution is pretty generic.