Quantified Self - A Path to Self-Enlightenment or Just a Security Nightmare?
summary
Analysis of top free QS apps finds 52% of apps lack privacy policies, apps contact on average five external services (some up to 14), and 20% send passwords in clear text while many leak activity data unencrypted. A proof-of-concept Raspberry Pi scanner tracks BLE devices at events (563 devices at one mini-marathon) proving sport bracelets and trackers broadcast stable identifiers, enabling location correlation with cloud syncs, account enumeration, data exfiltration and fraudulent or extortion scenarios.
AI-written summary · about
chapters (14)
- 0:00Introduction to quantified self
- 1:50Vulnerabilities in ecosystems
- 3:35Data privacy and leakage
- 9:00Industry standards and policy
- 12:23Insecure data transmission
- 17:36Exploitation and impact
- 20:19Monetary and social risks
- 24:16Corporate and personal misuse
- 28:43Integrity and firmware issues
- 30:25Bluetooth and tracking risks
- 35:41Tracking experiments
- 43:50Research summary and findings
- 47:07Recommendations and outlook
- 51:29Q&A session
related talks
39mMobile App Security
37mHey, You, Get off My Private Data: Do Apps Respect Your Privacy as They Claim?
17mPrivacy Design Flaws
27mChinese Surveillance and CloudPets
31mEcosystem, Interoperability and Standards: IoT Security
54mSecuring Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables
28mEmbracing innovation by building privacy friendly apps
24mRecent Mobile App Security Incidents from Real-World Cases