FitFitness trackers produced by Fitbit can "theoretically" be used to spread malware and can be infected in less than 10 seconds, claims Axelle Apvrille, a security researcher at Fortinet.
According to Axelle's findings, the reported vulnerability is quite easy to exploit, and the only requirement is that the attacker be close enough to their victim so that a Bluetooth between the wearable and the hacker's laptop.
Infection typically takes up to 10 seconds as an infected network packet is sent to the Fitbit device, and once that happens, the infection is boot-persistent, meaning that rebooting does not clean the Fitness Tracker, a method that works for routers and other IoT devices.
From this point on, the FitBit tracker acts as a malware spreader, infecting any other device it connects to with malware.
As the security expert explains, both everyday computers and other FitBit trackers can be infected at the same time, and the attacker can use the fitness tracker to spread trojans, ransomware, adware, or anything else they wish.
Axelle discovered the vulnerabilities in March and presented them to Fitbit as proof of her claims. The fitness tracking company apparently decided not to fix the issues, telling The Register that the reason was that they weren't used in real-life attacks and posed no threat to its users.
Before this, Fitbit was in the news for two other security incidents. In 2013, hackers were able to access Fitbit due to a weak authentication system, while in 2011, user data detailing sexual activities was exposed online and accessible through search engines.
Ms. Apvrille presented her findings yesterday at the Hack.Lu conference in Luxembourg. You can watch the video below:
