Breaking fitness records without moving : reverse engineering and spoofing fitbit
Abstract
Tens of millions of wearable fitness trackers are shipped yearly to consumers who routinely collect information about their exercising patterns. Smartphones push this health-related data to vendors' cloud platforms, enabling users to analyze summary statistics on-line and adjust their habits. Third-parties including health insurance providers now offer discounts and financial rewards in exchange for such private information and evidence of healthy lifestyles. Given the associated monetary value, the authenticity and correctness of the activity data collected becomes imperative. In this paper, we provide an in-depth security analysis of the operation of fitness trackers commercialized by Fitbit, the wearables market leader. We reveal an intricate security through obscurity approach implemented by the user activity synchronization protocol running on these devices. Although non-trivial to interpret, we reverse engineer the message semantics, demonstrate how falsified user activity reports can be injected, and argue that based on our discoveries, such attacks can be performed at scale to obtain financial gains. We further document a hardware attack vector that enables circumvention of the end-to-end protocol encryption present in the latest Fitbit firmware, leading to the spoofing of valid encrypted fitness data. Finally, we give guidelines for avoiding similar vulnerabilities in future system designs.
Citation
Fereidooni , H , Classen , J , Spink , T , Patras , P , Miettinen , M , Sadeghi , A-R , Hollick , M & Conti , M 2017 , Breaking fitness records without moving : reverse engineering and spoofing fitbit . in M Dacier , M Bailey , M Polychronakis & M Antonakakis (eds) , Research in Attacks, Intrusions, and Defenses : 20th International Symposium, RAID 2017, Atlanta, GA, USA, September 18–20, 2017, Proceedings . Lecture Notes in Computer Science , vol. 10453 , Springer, Cham , Cham , pp. 48-69 , International Symposium on Research in Attacks, Intrusions and Defenses , Atlanta , Georgia , United States , 18/09/17 . https://doi.org/10.1007/978-3-319-66332-6_3 conference
Publication
Research in Attacks, Intrusions, and Defenses
ISSN
0302-9743Type
Conference item
Rights
Copyright © Springer International Publishing AG 2017. This work has been made available online in accordance with publisher policies or with permission. Permission for further reuse of this content should be sought from the publisher or the rights holder. This is the author created accepted manuscript following peer review and may differ slightly from the final published version. The final published version of this work is available at https://doi.org/10.1007/978-3-319-66332-6_3.
Description
Funding: Hossein Fereidooni is supported by the Deutsche Akademische Austauschdienst (DAAD). Mauro Conti is supported by the EU TagItSmart! Project (agreement H2020-ICT30-2015-688061) and IT-CNR/Taiwan-MOST 2016-17 “Verifiable Data Structure Streaming”. This work has been co-funded by the DFG as part of projects S1 and S2 within the CRC 1119 CROSSING, and by the BMBF within CRISP. Paul Patras has been partially supported by the Scottish Informatics and Computer Science Alliance (SICSA) through a PECE grant.Collections
Items in the St Andrews Research Repository are protected by copyright, with all rights reserved, unless otherwise indicated.