Unfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
summary
Hands-on testing shows many cheap BLE fitness trackers accept unsigned firmware and expose writable characteristics that enable spoofing and permanent compromise. Scans and captures use Ubertooth sniffing or Android btsnoop logs parsed in Wireshark, services enumerated with nRF Connect / bluez gatttool, and mobile apps unpacked with APKTool + ADB to extract firmware and resource files. A custom GATT writer uploads OTA firmware, changes device name and version to block legitimate pairing, and reliably pops arbitrary notifications — proof‑of‑concept code is on GitHub.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:44Why fitness trackers target
- 1:25What to expect
- 2:51Bluetooth basics and BLE
- 3:54Bluetooth Classic vs BLE
- 5:59BLE security flaws
- 7:04BLE stack and profiles
- 9:12Hacking BLE devices step-by-step
- 11:43Scanning nearby BLE devices
- 13:27Analyzing services and characteristics
- 15:12Capturing BLE packets
- 16:39Passive capture on Android
- 17:20Authentication flaws in trackers
- 18:01Reverse engineering BLE packets
- 20:10Fake notifications to trackers
- 20:32Firmware upload and modification
- 22:17Extracting firmware from apps
- 23:20Custom firmware over-the-air
- 26:30Checksum validation in updates
- 27:32Disabling tracker compatibility
- 28:35Risks of unsigned firmware
- 29:17Proof-of-concept demo
- 29:59Q&A
related talks
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
24mAttacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems
42mBreakMi: Reversing, Exploiting & Fixing Fitness Tracking Ecosystems
51mBluetooth Hacking: Tools And Techniques
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
18mBLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy
54mSecuring Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables
06mEvery Byte Matters: Traffic Analysis of BluetoothWearable Devices