Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Communications Wireless Networking Build Technology Hardware

Reverse Engineering the Nike+ FuelBand's Communications Protocol 78

An anonymous reader writes: Security researcher Simone Margaritelli has reverse engineered the Bluetooth low-energy communications protocol for his Nike+ FuelBand SE, a wrist-worn activity tracker. He learned some disturbing facts: "The authentication system is vulnerable, anyone could connect to your device. The protocol supports direct reading and writing of the device memory, up to 65K of contents. The protocol supports commands that are not supposed to be implemented in a production release (bootloader mode, device self test, etc)." His post explains in detail how he managed this, and how Nike put effort into creating an authentication system, but then completely undermined it by using a hard-coded token. Margaritelli even provides a command list for the device, which can do things like grab an event log, upload a bitmap for the screen, and even reset it.
This discussion has been archived. No new comments can be posted.

Reverse Engineering the Nike+ FuelBand's Communications Protocol

Comments Filter:
  • by Anonymous Coward on Friday January 30, 2015 @11:30AM (#48939929)

    Now we know how many Calories he burned. we are doomed...

    • by AchilleTalon ( 540925 ) on Friday January 30, 2015 @12:12PM (#48940239) Homepage
      Better, you can let him think he hasn't burn enough calories and make him running forever.
    • That's what I was thinking. Another "researcher" looking for publication.

    • Now we know how many Calories he burned. we are doomed...

      Exactly!

      Does EVERYTHING have to have the utmost in security?

      What I didn't see was any mention of "personal information" or "remote code injection/execution" that MIGHT call for strong encryption.

      So the question for Nike becomes "How much will having a bigger, faster microcontroller to encode/decode secure communications cost us (and therefore the consumer)?"

      And is it necessary?

      • by cusco ( 717999 )

        I wouldn't worry so much about the security of data on the device as much as once it's paired with your other devices you have a security hole inside your network that is trusted by your phone, laptop, whatever. Printers and security cameras have already been exploited to attack networks from the inside, this is yet another opportunity waiting to be exploited.

  • by Anonymous Coward on Friday January 30, 2015 @11:32AM (#48939941)

    Developer: That's insecure.
    Phil Knight: Just do it.

  • by TWX ( 665546 ) on Friday January 30, 2015 @11:35AM (#48939959)
    Are people going to reverse-engineer these things so that when they're worn into secure facilities, they inject-attack systems in the secure facility?

    Are they going to act as a vector to attack other Bluetooth Low Energy capable security systems?

    I simply want to know what kind of maliciousness can be achieved through exploiting bugs in a very, very special-purpose device.
    • Yeah, I wonder why a lack of rock solid authentication for this particular device so "disturbing"?
      • by DarkOx ( 621550 )

        That was my first thought too. There is an obvious privacy, implication. Maybe in some really contorted situation you could induce someone to do something dangerous like convince a diabetic they have done a whole ton of walking this morning and therefore should eat more sugar than normal and similar attacks.

        I think the big issue is the potential to use this as a vector to introduce malware to the phone or PC the owner interfaces the device with. Not sure how practical that is.

        • by gmack ( 197796 )

          I think the big issue is the potential to use this as a vector to introduce malware to the phone or PC the owner interfaces the device with. Not sure how practical that is.

          The big issue will be that people will use this to display rude things on random people's armbands.

          • The big issue will be that people will use this to display rude things on random people's armbands.

            So you are saying the Anonymous script kiddies will use this to advance their devilish plan to "out" pedos and bring down ISIS?

          • The real issue is the inherent philosophy that the Internet of Things is such a trivial group of devices that security is not important.

            What's the threshold, and who establishes that?

            It's obviously an important discussion, given the attention it has generated.

            • by TWX ( 665546 )
              Oh, for that I definitely agree, there is a very specific point where that security needs to take place. I just don't think that a bluetooth wrist band that is supposed to only intermittently connect to a host device (not even directly to the Internet) is that place. I'd rather see wireless keyboards and mice see their communications secured before I worry about this thing.
          • issue or benefit?
          • by amias ( 105819 )

            such as reebok logos ?

    • by Anonymous Coward

      IDK, might be fun to make them all display custom messages. Simple app could harvest the device nonces in the area and then upload custom messages to each one using Cmd_UploadGraphic. Lots of laughs at the gym.

    • by CastrTroy ( 595695 ) on Friday January 30, 2015 @11:46AM (#48940035) Homepage
      It's interesting that you bring that up. Many secure facilities won't allow people to bring in cell phones or other devices. But it's actually quite hard to distinguish some regular wrist watches from one with cameras or communications devices in them. I think if you really want to have a "secure" facility, then you pretty much have to limit people to bringing in no electronic devices whatsoever.
      • by TWX ( 665546 )
        I expect that such facilities are helping to keep the paging industry going. That long with drug dealers...
      • by amias ( 105819 )

        if you have a secure facility that allows random bluetooth accessories to connect to it , its not a secure facility its a bad joke.

    • by oodaloop ( 1229816 ) on Friday January 30, 2015 @11:53AM (#48940097)
      I work in a secure facility, and activity tracking wristbands (among many other things) are forbidden.
      • Re: (Score:2, Funny)

        by Anonymous Coward

        I work in a secure facility, and activity tracking wristbands (among many other things) are forbidden.

        What about posting to Slashdot on the clock?

        • by Anonymous Coward

          I work in a secure facility, and activity tracking wristbands (among many other things) are forbidden.

          What about posting to Slashdot on the clock?

          You mean this isn't WikiLeaks?!? Oh for fucks sake, I'm ruined!

    • by xxxJonBoyxxx ( 565205 ) on Friday January 30, 2015 @12:01PM (#48940153)

      As I understand the analysis, this exploit could be used to turn Fuelbands into data mules. It could also let someone temporarily brick all the Fuelbands within range (could be fun at the start of a marathon or at the gym).

      >> Cmd_Bootloader: Set the device to bootloader mode ( basically it locks down the device, the official app won't work either ... only resetting it with the usb cable will unlock it ).
      >> Cmd_SampleStore: Use the device memory to store a custom object (!!!)

    • Good god man, with the protocol fully in the hands of hackers they can reverse the bluetooth polarity flow - either shifting it to red through acceleration to burn your wrist, or even worse with the reversed flow affecting the heart rate monitor the hackers have full control of your heart rate!

      Think everyone wearing a FuelBand as now living either a Logan's Run or Running Man scenario...

    • In general, somebody who has loads of money will make use of these bands. Now, if I wanted to take a rich person as hostage for a payoff, I might get somebody close to them to simply change out some code. That way when rich person is walking around and device gets a signal, it says, here I am. Basically, an easy tracking device.
      • by TWX ( 665546 )
        What's the range on it though? This is a low-power specification after all; you'd have to be right on top of them to detect it so you'd already know where they are.
  • by Anonymous Coward

    So, does it run Linux yet?

  • screw fitness bands. (Score:4, Interesting)

    by nimbius ( 983462 ) on Friday January 30, 2015 @11:44AM (#48940019) Homepage
    from a social standpoint these devices are near and helpful. From a FOSS standpoint these devices are intrusive and treat their users like cattle. Check out Fitbit for example, the largest provider of digital harvesting/tracking hardware. the privacy policy insists they sell de-identified data (because metadata is a dirty word these days) to third parties. So if you're wondering why health insurance companies are pushing biometric competitions at the workplace using subsidized devices its because your health is not their primary concern. Determining an accurate insurance rate for a component of workers that are at heightened risk for diabetes, heart attack, and alzheimers is what they care about. Your corporation in turn cares about your health, and might reward you with water bottles or gift cards to sporting goods stores that, in turn, might turn into a newer fitbit/fuel.

    the protocol used to affect data and function of the device is trivial, Galileo and libfitbit hacked this a few years ago. The real problem is your biometric data which is transferred across the device in an AES/md5 header encrypted blob. This violates countless freedoms of the application, starting with 0. The key to decrypt this data doesnt exist for you, and hence you're tethered to a website and a product that if it were ever usurped by say, fitness applications on your phone, would go bankrupt, shutter its doors, and leave you with a nice chunk of plastic that showed numbers and belched motivational platitudes. the real work in these devices should be decrypting the collected data without the use of the companies respective servers and web resources.
    • by tlhIngan ( 30335 ) <slashdot@nOSpam.worf.net> on Friday January 30, 2015 @01:12PM (#48940775)

      the privacy policy insists they sell de-identified data (because metadata is a dirty word these days) to third parties

      Metadata is NOT de-identified data. Metadata is data about data, while de-identified data is anonymized data.

      Metadata would be for example how often and when you upload your results to their website, but nothing on what you ran or for how long and all that (that's data). The data itself would be your track, pace, location and all that information, tied to you.

      De-identifying the data would mean advertisers get access to your track, pacing and other stuff, but with no name attached, and maybe even missing a few reporting points so your address isn't obvious by looking at the endpoints.

      It's not that metadata is a bad term - it's reasonably accurate because it's the difference between say, a pen recorder and a wiretap recorder (ohe records details about the call, the other records the call itself). Or recording IP headers over recording packet contents.

      You deal in metadata a lot - a file name is metadata - it's not a part of the file's contents (the data), just like the date and other details. You can get access to file metadata quite easily even if you can't read the file itself (and it's not possible to read the file without being able to access the metadata).

  • by gstoddart ( 321705 ) on Friday January 30, 2015 @11:52AM (#48940081) Homepage

    In what way should anybody be surprised that a wearable, wireless device has implemented security in a completely incompetent way?

    These are products which are intended to be cool, shiny, and pretty ... but secure? Not even a little.

    I continue to be unsurprised by this crap, and I continue fairly firm in my indifference to owning any of this stuff ... and the same goes the for "Interweb of Stuff"; I assume that out of the gate it's going to be insecure and stupid.

    Unless companies have actual legal liability for shit security, you'll continue to see shit security.

    So just don't buy it if you value security or privacy -- because they're all pretty much designed to upload your information to analytics companies anyway.

    • In what way should anybody be surprised that a wearable, wireless device has implemented security in a completely incompetent way?

      Right. Since Fitbit wearers are the product, to a vast array of companies wanting personal information, it sounds like the Fitbit is designed exactly how they want it designed -- to increase the value of Fitbits in the ultimate marketplace.

      A locksmith sells few keys to secure locks...

    • Yep I'm totally going to sue Nike because someone can change settings or read how many calories I burn on my fuel band. My privacy is so important.

      Look I'm all for privacy, but it gets to a point where I just don't give a shit about someone knowing some details.

      I go to the gym three times a week, run about 4km at 6min/km, then row 1km, and cycle 5km. There you are, out for all to see. About the only thing else you'll get from my fuel band is that I actually skipped gym last Thursday.

      Now if we were talking a

    • So just don't buy it if you value security or privacy

      Or if you are part of the Slashdot audience just wait until the wearable device is being dumped on eBay by people upgrading to the latest shiny thing. Then if someone has written a library for the device you want that provides access to the data stream buy it at a significant discount. You can then allow it to only pair with a secure device at home, avoiding the manufacurers crapware and keeping your data private.

  • by the_skywise ( 189793 ) on Friday January 30, 2015 @12:08PM (#48940197)

    I've got one of these and I honestly don't care if the band isn't secure. Sure they can get my motion data and I'm sure some nefarious insurance company could install bluetooth readers worldwide to pilfer my data, confirm that I'm not moving enough and raise my rates but... heck any good scale and heart rate meter would tell you that and probably be a lot more useful.

    But now that it's been cracked -
    I'd like to see somebody use this to make an android version of the software.

    I'd like to see somebody interface with the iPhone better so when I get a call it could display the name of the caller or an appointment reminder on my band (ooh, wotta concept!)

    And maybe, just maybe somebody would write a download tool that'd COLLECT THE DATA BETTER THAN NIKE DOES!!!! Because right now I average about 1 bad read a month. (Killer if you're trying to go for the consecutive days award or, y'know, actually, accurately *monitor* your activity levels)

    • by rthille ( 8526 )

      Um, he decompiled the Android version of the app to figure out that the device was insecure...

  • Let's just use 0xff 0xff 0xff 0xff 0xff 0xff .... !

    I laughed pretty damn hard. Best laugh I've had today.
  • by zoffdino ( 848658 ) on Friday January 30, 2015 @12:12PM (#48940231)
    This whole IoT concept is treating security as a joke. In the first of wave computing, the mini-computers (particularly Windows) treated security as an after-thought. That created the virus-laden era of the 1990s and early 2000s. The second wave, the "new" smart phone, learned the lessons, and use sandboxes, walled garden, permissions, encryption, tokenization, etc. pervasively. It's not fool-proof but at least the door is locked. Now we are approaching the third wave, the Internet of Things, and manufacturers think these devices are so personal that no security is needed. What do they say about people who don't learn any history?
  • They're trying to capitalize on all the interest from the DIY community. Someone will hook it up to a Raspberry Pi and make it do something it was never intended to do.
    • Yes like bricking everyone's band as they run past at a marathon or popular path. Perhaps adding a mandatory PWNT message on the band.

      Im thinking this is an unintended concequence of a smug and vindictive type benevolent overseer decision.

      There are better ways to get DIY support IMO.
      • by itzly ( 3699663 )

        Yes like bricking everyone's band as they run past at a marathon or popular path

        Sounds like a lot of work, when you can just throw a rock at them.

  • It costs (guessing, CBA to check) $100, and anybody walking (/swimming/sitting) near you could potentially break your device, and brick it so it becomes useless. That kinda sucks.

    • by rthille ( 8526 )

      It's only bricked until you plug it into USB and then you can reflash the firmware

  • This is the one device that has support wired into iOS (e.g. the healthkit). Now other wearable makers can get their data straight into the phone!

10.0 times 0.1 is hardly ever 1.0.

Working...