Security issue in fitness wristband, says Kaspersky researcher

• Vulnerability discovered in the authentication method used in several smart wristbands
• Allows third-party to connect invisibly to device, execute commands, and extract data

FITNESS trackers of all kinds have become extremely popular, helping people to manage their physical activity and calorie intake and stay in shape, Kaspersky Lab said in a statement.
 
However, such devices also process important personal data about their owners and it is important keep them secure, the cybersecurity specialist added.
 
Kaspersky Lab said its researcher Roman Unuchek has examined how a number of fitness wristbands interact with a smartphone, and discovered some surprising results.
 
According to his research findings, the authentication method implemented in several popular smart wristbands allows a third-party to connect invisibly to the device, execute commands, and – in some cases – extract data held on the device.
 
In the devices investigated by the Kaspersky Lab researcher, such data was limited to the number of steps taken by the owner during the previous hour.
 
However, in the future, when next-generation fitness bands capable of collecting a greater volume of more varied data appear on the market, the risk of sensitive medical data about the owner leaking out could increase significantly, Kaspersky Lab said.
  
The rogue connection is made possible because of the way in which the wristband is paired with a smartphone.
 
According to Unuchek, an Android-based device running Android 4.3 or higher, with a special unauthorised app installed, can pair with wristbands from certain vendors. To establish a connection, users need to confirm the pairing by pressing a button on their wristband.
 
However, attackers can easily overcome this, because most modern fitness wristbands have no screen. When the wristband vibrates asking its owner to confirm the pairing, victims have no way of knowing whether they are confirming a connection with their own device or someone else’s.
 
“This proof of concept depends on a lot of conditions for it to work properly, and in the end an attacker wouldn’t be able to collect really critical data like passwords or credit card numbers,” said Unuchek, senior malware analyst at Kaspersky Lab.
 
“However it proves that there is a way for an attacker to exploit mistakes left unpatched by the device developers.
 
“The fitness trackers currently available are still fairly dumb, capable of counting steps and following sleep cycles, but little more than that.
 
“But the second generation of such devices is almost here, and they will be able to gather much more information about users. It is important to think about the security of these devices now, and ensure that there is proper protection for how the tracker interacts with the smartphone,” he added.
 
Kaspersky Lab experts advise users of smart wristbands who are concerned about the security of their device to check with the wristband’s vendors whether such a potential attack vector would be possible on their product.
 
Related Stories:
 
Beware wearables and IoT: Kaspersky on security risks
 
IoT already transforming family life: GSMA report
 
 
For more technology news and the latest updates, follow us on Twitter, LinkedIn or Like us on Facebook.