Meet Fitbit Flex Wireless activity wristband Track steps, distance, - - PowerPoint PPT Presentation

▶
meet fitbit flex
SMART_READER_LITE
LIVE PREVIEW

Meet Fitbit Flex Wireless activity wristband Track steps, distance, - - PowerPoint PPT Presentation

Dec 20, 2022 146 likes •586 views

Meet Fitbit Flex Wireless activity wristband Track steps, distance, calories, active minutes Display progress with 5 LEDs No altimeter, no GPS on Flex. Only on Charge or Surge. Hack.lu 2015 - A. Apvrille 2/26 Its also a

slide-1
SLIDE 1
slide-2
SLIDE 2

Meet Fitbit Flex

◮ Wireless activity wristband ◮ Track steps, distance, calories, active

minutes

◮ Display progress with 5 LEDs ◮ No altimeter, no GPS on Flex. Only

  • n Charge or Surge.

Hack.lu 2015 - A. Apvrille 2/26

slide-3
SLIDE 3

It’s also a “sleep wristband”

I slept well, thanks :)

Hack.lu 2015 - A. Apvrille 3/26

slide-4
SLIDE 4

Opening the tracker

Hack.lu 2015 - A. Apvrille 4/26

slide-5
SLIDE 5

Opening the tracker

Thanks to my husband, Ludovic :)

Hack.lu 2015 - A. Apvrille 4/26

slide-6
SLIDE 6

Opening the tracker

Thanks to my husband, Ludovic :)

Hack.lu 2015 - A. Apvrille 4/26

slide-7
SLIDE 7

Opening the tracker

Thanks to my husband, Ludovic :)

Hack.lu 2015 - A. Apvrille 4/26

slide-8
SLIDE 8

Opening the tracker

Thanks to my husband, Ludovic :)

Hack.lu 2015 - A. Apvrille 4/26

slide-9
SLIDE 9

Opening the tracker

Thanks to my husband, Ludovic :)

Hack.lu 2015 - A. Apvrille 4/26

slide-10
SLIDE 10

Sleep stage: polysomnography (PSG)

Credits: NascarEd

Hack.lu 2015 - A. Apvrille 5/26

slide-11
SLIDE 11

Tracking activity with an accelerometer

Acceleration on (x), (y) and (z) for walking and jogging From Kwapisz, Weiss and Moore, “Activity Recognition using Cell Phone Accelerometers”, SIGKDD 2011

Hack.lu 2015 - A. Apvrille 6/26

slide-12
SLIDE 12

Tracking activity with an accelerometer

Acceleration on (x), (y) and (z) for sitting and standing From Kwapisz, Weiss and Moore, “Activity Recognition using Cell Phone Accelerometers”, SIGKDD 2011

Hack.lu 2015 - A. Apvrille 6/26

slide-13
SLIDE 13

Spying with an accelerometer

From Ravi, Dandekar, Mysore and Littman, “Activity Recognition from Accelerometer Data”, IAAI’05

Hack.lu 2015 - A. Apvrille 7/26

slide-14
SLIDE 14

Where fitness data goes to

Various reward programs Sales forces, insurances, sponsors... “Higi announced [..] the launching of its industry-leading, privacy-protected and secure API” - Source: PR News “AchieveMint previously partnered with the Brooklyn Nets basketball team to encourage users in Brooklyn and 75 miles around it to earn special rewards, such as VIP tickets to the draft or signed merchandise.” - Source: Mashable

Other Examples

Nest (thermostat) and Beam (toothbrushes) are sharing with insurances

Hack.lu 2015 - A. Apvrille 8/26

slide-15
SLIDE 15

Alternate usages to your tracker

What can you do with your (beloved) fitness tracker without sending anything to Fitbit (or other) servers?

Hack.lu 2015 - A. Apvrille 9/26

slide-16
SLIDE 16

Four alternate geek usages

“This can of green pees? I’m going to turn it into caviar!”

  • 1. Impress young kids with magician

talent

  • 2. Impress a scientist with a RNG
  • 3. Impress a hacker friend with a screen

saver

  • 4. Impress security researchers with a

scary attack

Hack.lu 2015 - A. Apvrille 10/26

slide-17
SLIDE 17

Geek no.1: Impress (very) young kids with magician talent

Proprietary!

No technical user/ developer/ contributor documentation Everything has to be reverse engineered

Display Code

c0 06 00 .. 00 02

◮ c0: control packet, for the tracker ◮ 06: command id - Display Code ◮ 02: useful length for packet

Hack.lu 2015 - A. Apvrille 11/26

slide-18
SLIDE 18

Blinking LEDs

Endpoint 0x01

Hack.lu 2015 - A. Apvrille 12/26

slide-19
SLIDE 19

Blinking LEDs

Endpoint 0x01 C0 06 00 ... 02

Hack.lu 2015 - A. Apvrille 12/26

slide-20
SLIDE 20

Geek no.2 Impress a scientist with a RNG We always lack sources of entropy, don’t we? Use authentication packets

Funny!

Flex supports authentication messages, but it’s a passthru if ( !isencrypted || (TrackerAuthUtils.checkMac(...)) { if (!isencrypted) { MySystemLog.log("TrackerAuthCommand", "Tracker is not encrypted, we just assume it\’s authed"); } ...

Hack.lu 2015 - A. Apvrille 13/26

slide-21
SLIDE 21

Flex authentication

Dongle Tracker(s) Client Challenge C0 50 LocalRandom Auth Chal Resp C0 51 TrackerChallenge SeqNum Response to Challenge C0 52 ComputedMAC ...

Implement a Flex-based RNG

◮ Send a dummy local random (C0 50) ◮ Wait for tracker’s response: 8-byte challenge ◮ Never send last message (C0 52)

Hack.lu 2015 - A. Apvrille 14/26

slide-22
SLIDE 22

Is it (really) random???

Description Entropy Chi- square Mean Monte- Carlo Pi error Dieharder failed tests Target 8 10- 90% 127.5 0% Victor Hugo 4.6 0.01% 99 27% 2 weak Linux PRNG /dev/urandom 8 75% 127 0.57% AES ciphertext 8 50% 128 0.50% Fitbit tracker 8 75% 127 0.36% 3 weak Radioactive de- cay events 41% 0.06%

Hack.lu 2015 - A. Apvrille 15/26

slide-23
SLIDE 23

Tracker RNG: conclusion I would not use it for crypto It does not look notably worse than Linux’s standard RNG

Hack.lu 2015 - A. Apvrille 16/26

slide-24
SLIDE 24

Geek no.3 Impress a hacker friend with a screen saver How to keep your laptop secure from curious eyes?

Screen lock

◮ See Matias Katz, “Backdooring X11 with much class and no

privilege”

◮ Use the Fitbit USB dongle! ◮ Rely on udev

DEMO

Hack.lu 2015 - A. Apvrille 17/26

slide-25
SLIDE 25

Better: lock with the tracker

Discover: MAC Addr, RSSI...

Lock the screen when you move away from your laptop How?

Discovery responses:

  • 1. the tracker’s ID - this is its Bluetooth MAC address
  • 2. and the Received Signal Strength Indication

Hack.lu 2015 - A. Apvrille 18/26

slide-26
SLIDE 26

Plotting RSSI

Close to dongle Moved 3m Moved 5m Next door In my pocket Hand around tracker

Hack.lu 2015 - A. Apvrille 19/26

slide-27
SLIDE 27

Trackerlock demo

Trackerlock

$ python trackerlock.py --delay 1 --movement 15 Getting list of available trackers... 1- TrackerId: 09 73 78 63 f7 f3 AddrType: 1 RSSI: 190 Attr: 02 07 SUUID: 00 fb Select tracker’s num: 1 Tracker has moved away!!! (RSSI=186)

Demo

Hack.lu 2015 - A. Apvrille 20/26

slide-28
SLIDE 28

Geeky no.4: Scare a Security Researcher For Good .. or for Bad

Good: Digital Tatoo

Hack.lu 2015 - A. Apvrille 21/26

slide-29
SLIDE 29

Geeky no.4: Scare a Security Researcher For Good .. or for Bad

Good: Digital Tatoo

I LOVE YOU ! Tatoo

Hack.lu 2015 - A. Apvrille 21/26

slide-30
SLIDE 30

Geeky no.4: Scare a Security Researcher For Good .. or for Bad

Good: Digital Tatoo

XX ...

Hack.lu 2015 - A. Apvrille 21/26

slide-31
SLIDE 31

Geeky no.4: Scare a Security Researcher For Good .. or for Bad

Good: Digital Tatoo

...I LOVE YOU ! Tatoo response

Hack.lu 2015 - A. Apvrille 21/26

slide-32
SLIDE 32

Danger: What if Tatoo is Malicious Code?

Attacker Victim’s laptop

Hack.lu 2015 - A. Apvrille 22/26

slide-33
SLIDE 33

Danger: What if Tatoo is Malicious Code?

Attacker INJECTED MALICIOUS CODE Tracker is infected Victim’s laptop

Hack.lu 2015 - A. Apvrille 22/26

slide-34
SLIDE 34

Danger: What if Tatoo is Malicious Code?

Attacker INJECTED MALICIOUS CODE Tracker is infected Victim’s laptop DISCOVERY

Hack.lu 2015 - A. Apvrille 22/26

slide-35
SLIDE 35

Danger: What if Tatoo is Malicious Code?

Attacker INJECTED MALICIOUS CODE Tracker is infected Victim’s laptop DISCOVERY M A L I C I O U S C O D E

Hack.lu 2015 - A. Apvrille 22/26

slide-36
SLIDE 36

Danger: What if Tatoo is Malicious Code?

Attacker INJECTED MALICIOUS CODE Tracker is infected Victim’s laptop DISCOVERY M A L I C I O U S C O D E Deliver malicious payload: crash, propagate...

Hack.lu 2015 - A. Apvrille 22/26

slide-37
SLIDE 37

Video

Hack.lu 2015 - A. Apvrille 23/26

slide-38
SLIDE 38

Digital Tatoo / Infection: Limitations

  • 1. Max 17 bytes. Is that enough?

Yes: Crash Pentium Trojan (2004): 4 bytes

Hack.lu 2015 - A. Apvrille 24/26

slide-39
SLIDE 39

Digital Tatoo / Infection: Limitations

  • 1. Max 17 bytes. Is that enough?

Yes: Crash Pentium Trojan (2004): 4 bytes

  • 2. Execute/Deliver code on target:

we did not handle this!

Hack.lu 2015 - A. Apvrille 24/26

slide-40
SLIDE 40

Digital Tatoo / Infection: Limitations

  • 1. Max 17 bytes. Is that enough?

Yes: Crash Pentium Trojan (2004): 4 bytes

  • 2. Execute/Deliver code on target:

we did not handle this!

  • 3. Fitbit patches

Hack.lu 2015 - A. Apvrille 24/26

slide-41
SLIDE 41

Interesting links

◮ Galileo - https://bitbucket.org/benallard/galileo ◮ Rahman et al. Fit and Vulnerable: Attacks and Defenses for a

Health Monitoring Device, CoRR, 2013.

◮ Fitbit Flex Teardown.

http://ifixit.org/blog/5042/fitbit-flex-teardown/

◮ Matias Katz - Backdooring X11 with much class and no

privileges, Hack in Paris 2015

◮ My my Fitbit tools repository on GitHub ◮ My presentation at Hack in Paris 2015 ◮ My own humoristic drawings Pico le croco ◮ Link to satisfaction form: http://bit.ly/1KUkjaB

Hack.lu 2015 - A. Apvrille 25/26

slide-42
SLIDE 42

Thanks for your attention!

Contact info

@cryptax or aapvrille (at) fortinet (dot) com http://bit.ly/1KUkjaB Thanks to Ludovic Apvrille, Aur´ elien Francillon and Matias Katz

Hack.lu 2015 - A. Apvrille 26/26