Kaspersky Lab: Fitness devices have now become extremely popular, as they help people stay in shape by properly managing their physical activity and calorie intake.
However, such devices also process important personal data about their owners, which is important to keep secure. Kaspersky Labresearcher Roman Unuchek examined how various fitness with smartphones and came up with some surprising results.
According to its findings, the authentication method applied to various popular «smart» peripherals, allows third parties to «connect invisibly» to the device, execute commands and – in some cases – extract data from the device.
On the devices tested by the Kaspersky Lab researcher, such data was limited to the number of steps the owner had taken during the previous hour. However, in the future, when fitness trackers appear on the market, which will be able to collect a larger amount of information from wider databases, the risk of sensitive medical data being leaked could increase significantly.
The harmful connection becomes possible due to the way wearables connect to smartphones. According to the research, a device running Android 4.3 or newer, with a specially installed unauthorized application, can connect to wristbands of certain manufacturers. 
To connect, users must confirm the pairing by pressing a button on their smart bracelet. Attackers can easily bypass this step because most fitness bracelets don’t have a screen. When the bracelet vibrates, asking its owner to confirm the connection, the victim has no way of knowing whether it’s confirming the connection with their own device or someone else’s.
"This experiment depends on various conditions and, in general, shows that an attacker is not able to collect truly critical data, such as passwords or credit card numbers. However, it shows that there is a way for attackers to exploit some vulnerabilities that have not been fixed by the developers of a device. The fitness trackers currently available on the market are not yet "smart" enough, being able to simply count steps and follow sleep cycles and not much more than that.
"However, the next generation of these devices is almost ready and will be able to collect much more information about users. So it is important to think about the security of these devices now and ensure that there is appropriate protection in their interaction with smartphones," said Roman Unuchek, Senior Malware Analyst at Kaspersky Lab.
Οι ειδικοί της Kaspersky Lab συμβουλεύουν τους χρήστες των «έξυπνων» περιβραχιόνιων που ανησυχούν για την ασφάλεια της συσκευής τους, να ελέγξουν – σε συνεργασία με τους παρόχους των συσκευών – αν μια τέτοια δυνητική επίθεση, θα μπορούσε να συμβεί και στο προϊόν τους.
More details regarding the experiment and research conducted by Roman Unuchek are available in his article on Securelist.com.
