Unfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
summary
Live demonstration performs BLE reconnaissance and reverse engineering to inject OTA firmware and fake notifications. Uses Ubertooth sniffer (≈$100) or CC2540 (~$50), Bluetooth tools (gatttool, nRF Connect, LightBlue), adb btsnoop with Wireshark, and apktool reverse engineering. Tested five fitness trackers: 3/5 use link‑layer encryption while 2/5 accept unauthenticated commands. A GitHub proof‑of‑concept tool implements OTA firmware injection, successfully changing device name/version and preventing re‑pairing because firmware images are unsigned.
AI-written summary · about
chapters (13)
- 0:00Introduction to BLE security
- 1:31Agenda and overview
- 2:34Bluetooth technology basics
- 4:11Classic vs. BLE differences
- 5:50BLE vulnerabilities
- 7:05Understanding the BLE stack
- 9:07Targeting and analysis
- 11:20Reconnaissance tools
- 14:49Capturing BLE traffic
- 17:15Authentication and exploits
- 20:17Firmware updates overview
- 24:56Firmware integrity and hacks
- 29:09Q&A and conclusion
related talks
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
24mAttacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems
51mBluetooth Hacking: Tools And Techniques
42mBreakMi: Reversing, Exploiting & Fixing Fitness Tracking Ecosystems
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
54mSecuring Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables
40mBiohacking: The Invisible Threat
43mWhen encryption is not enough: Attacking Wearable