Securing Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables

on YouTube ↗54m

" summary

Case study on Radar Pace shows concrete failures and fixes: mobile apps can read encrypted Bluetooth traffic if granted Bluetooth permissions, allowing a malicious app to harvest steps and heart rate; partial authentication lets a second app piggyback reboot and factory‑reset commands; fit and JSON coach files are stored plaintext on public storage exposing routes and PII; a cloud XSS in friend requests steals admin creds and enables mass remote device lock/wipe. Proposal: a five‑milestone Security and Privacy Development Lifecycle (SPDL) that weaves threat modeling, pen testing, incident response and privacy into fast 6–8 month IoT release cycles.

AI-written summary · about

" chapters (27)

1. 0:00Intro
2. 3:36loT/Wearable Ecosystem
3. 5:48Case Study: In-ear fitness coach
4. 7:24Challenges: Securing a never-before gadget
5. 10:29Challenges - Technical
6. 12:20Proposal : Securing a never-before gadget
7. 13:32Introducing SPDL
8. 16:35Security topics
9. 17:00Hardware & Firmware Security Paradigms
10. 18:58SW Security Paradigms: application SW
11. 20:59Cloud Software & Infrastructure Security
12. 22:30Ecosystem security challenges
13. 23:54Device communication
14. 24:54The Problem - Prelude
15. 25:47Root Cause
16. 26:44Example - Wearable Ecosystem 1
17. 28:50Example - Wearable Ecosystem 2
18. 32:10Environment
19. 35:09Our Recommendation
20. 36:13Ecosystem overview
21. 37:37Target : Sign-up and Profile pages
22. 39:29Exploit Scenario: The attack
23. 40:11Victim - logs in
24. 40:28Attacker's c&c
25. 45:30Regulatory Guidelines and Privacy Laws
26. 47:02Privacy Breaches
27. 48:20Quantifying Privacy Vulnerabilities

" related talks

• 31mEcosystem, Interoperability and Standards: IoT SecuritySumanth Naropanth, Kavya Racharla · OWASP AppSec USA 2018
• 24mAttacking Bluetooth LE Design and Implementation in Mobile + Wearables EcosystemsSunil Kumar, Nitin Lakshmanan · FIRSTCON21 Virtual Edition 2.0
• 43mWhen encryption is not enough: Attacking WearableChandra Prakash Gopalaiah, Sumanth Naropanth, Kavya Racharla · AppSecUSA 2016
• 30mUnfit Story of Fitness Trackers: Hacking BLE Fitness TrackersYogesh Ojha · KubeCon + CloudNativeCon China 2019
• 48mSecuring The Internet Of ThingsSteve Lord · OWASP AppSec Research (AppSecEU) 2015
• 30mUnfit Story of Fitness Trackers: Hacking BLE Fitness TrackersYogesh Ojha · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 51mBluetooth Hacking: Tools And TechniquesMike Ryan · hardwear.io USA 2019
• 30mHousehold INFOSEC in a Post-Sony Era #bbuzzSteve Loughran · Berlin Buzzwords 2016