Bestand wählen
Merken

Doping your Fitbit

Zitierlink des Filmsegments
Embed Code

Automatisierte Medienanalyse

Beta
Erkannte Entitäten
Sprachtranskript
the but if the
if the I and the thing it before that the would be or do we look at it the of the we helped by user and on the note the but in case you have been to any of the smaller it is the events and profit thing free maybe 4 years are you might know the disk from you know that your usually residues from lupus elastin machines the all medically double possible bombykol for that they click the 2nd shift today as a speaker which I itself Crowley is Our stressful on the other and during battle small runs on D amend city this year they had some of the 1st little same topic so if you miss that you what want forgot we calling for this around that they spoke about decoding messages to some the gold for you to talk about some data from wealthy of the bits along with that effect for you it would so they come to our talk on doping your fit sure you how to modify the film there so that you don't have to do anything but well no sports as every nite Our Motivation lost
when we started taking fitness checkers so that most of them are not inflicting luckily and so you will always have a chance to to get the data from users which is not nice surprise the n most EPs required that you upload your data into the clout so that's again that for privacy if you look at that they are 1 after market leaders so that's 1 thing why we them and the other thing is that when we compared to vendors that they had quite reasonable security and which is similar to many IOT systems so what we showed today that apply to other systems don't and their security model this nice but she cries sharing your data to them so take the security but get your data would be a nice thing and therefore we have them I 1st
explain how the system works in general uh which messages are exchanged and then go to more technical details the
trackers have the key in inside which is symmetric and and it's an ordering factory and not so it's already injective and you buy it and is used for end-to-end approach with the server so the system is as secure as standard encryption as soon as you have a lot of course no longer but that's the idea and the tracker only has to very so you need the smartphone application which is followed in the traffic in the locker connection not very secure but that doesn't matter that much because of the end of 2 and encryption and now the thing is can be breakage and encryption well yes we can come they and and encryption is only used for the recent trackers so modest before 2015 were not always using encryption and we could look a bit into the protocol and there has been a memory take which was not attached for attractors and recently so if you buy a tracker now we have a good chance that he didn't catch the mayor so far yourself or someone honest didn't do it so far and and you can memory read out and all
these things are a somewhat encryption floors are connected to encryption and I'm now going to show you how you can learn now break the encryption on the tracker and get your data the if you have the origin as my for
that and the tracker you have 2 steps in the beginning so you log into the app which is if you make you on it is not necessarily required and you do some local pairing which anyone can do with tractor and then there's an interesting part which is so remote association and industry and remote you prove that you are physically owning the tracker for example by entering a and as soon as you have just proof you can get authentication credentials from the summer and use these of education credentials to run off indicated commands and that's not applied that it's getting interesting because the south indicated commands you can and execute them as often as you want and so if you have a dose of get dentures and they are valid for ever because they are bound to the device keep so
all non-aggression is 1st of all how you get this authentication credentials some and therefore you can associate jacket there are some flaws in it so you need to prove that you're physically present on that well how how do you do this and in the the 1st slide is of course if you have a displayed and you have a pin the pin is displayed on the tracker on and then you have but this not flat they entered depend center from technogenic that server you compare it on the server of the thing that you didn't get that's OK but then there are also those factors which don't have a display you just tap them and the confirmation is the violence frame that you can easily replaced and and there is no confirmation of freshness of either of those so you can just replay any sniff remote association process and then there are those all at plaintext tractors and they had the serial number being printed on the picking and you can just use the serial number of and craft developed packets from this and to this situation if you want the as a source of indication traditions of and for ever well you just use them as an yet and you could even recent Utrecht and use them again Anderson if someone has a state of the
1st thing that we used to have to break encryption is an authenticated memory read out which was already found by before on that the charge it's I affirm there he could compared to actually own the pheromone update and found that they removed a command and Fitbit then removed the commands on uh the Fitbit One and flexed until October so you could still used as memory read out on the Order trackers and you can just enter any memory address ends name of an and you get all the data which is located at this address this includes the encryption keys so with this encryption key you can then um take any encrypted packets to tracker of from the tracker including dead dead dead dams which continue activity data or even from there and then you might
ask yourself whether why did they do this sort of memory it out of his it is well the patch but they still have of education and you need of indication for so called life malt from for example if you have a rate sensor on the Fitbit then you don't want to send each time a European had to the server led 72 100 and so on because in the lake a lot and you would have a higher load on the server I so what they did was the more they can do some strange closing of link enable some under new to fantasize a bit hidden so nobody didn't find it so far and then you get a very nice thing which is this life data and not interrupted and it's a summary of your current data so 2 things about this 1st of all you can say that it's it's text everyone could never and and even having authentication credentials can and neighborhood and and well fitted fix this on under last finback and in the sense of that you can disable the life model if you wish to but you can still use it on on any trickery didn't deserve it mentally and it's even and they're present in the most recent ionic smart watch not is going to
tell you more about there and how makes us alright thank you and for some of the stuff which we already told you and also for dynamically barring we want to have some access to a child with little tracker itself but 1st of all let's look at some
schematic were on hold the this appears the so template so we have to remain system-on-a-chip which is promised him in our case users based on their contexts and 3 and we also have of course on the uh the uh 2 which is used for the communication with the small font and we also have the maximum meter which detects your steps and everything is connected via bus and most interestingly and we also know that for some of the uh software which runs in the family uh basically which library to use so for example for encryption we know that the use the concrete and phobia leaving at least know that the the the field is very similar to what they use in the fervor so this really helped us in reverse engineering
and so this is what the PCB looks like if you were to the power and the remove it from its casing basically and we already see that there are lots of lots of interesting points and the knowledge that this time the figure out basically what testing point do we starting points do we need to connect the debugger and the so we figured out or something of that I've already figured out that you need those 4 so is the depending on what the protocol you want to use for a new debugger you need to various amounts of of testing pens and you for nowadays and the users of beauty so we just need for pins the really testing . 8 9 10 ground and and so on so you can also see that use just a grant from the battery which we remove removed previously and on the right hand side is just the kind those that you can use to connected to of the tutorial power supply and so this this we already can dump of the and the also can modify the stored data the so now that we have 2 females so let's let's have a
closer look into it but by the way this is on the right hand side is all about this set of it may look some kind of crude but it's that when the so we the the the memory layout of the basically the speed of repulsed but we have fun flash which contains 2 from the court and the problem which contains the data which at the bottom and to battery so for example your fitness data and also has and which is used for which relies on space for from the variables so if you look into the flesh uh for
example in a more detailed and we see that there are actually 2 independent of some of their from arousal um yeah stuff which runs on that so you have the manpower which is copies of a year from part which is called the and the reason for that is you always want to have some failsafe mode when you're opted to from so he's going to talk about model is a popular this in the morning and that later slides but then I'll just mind that there are 2 parts and the only problem we have apart from this that the state of we also have everything we need for encryption so we have all the numbers we have an encryption key and the even which you that you can use to the Committee disabled encryption a so uh
what we also wanted to do is enabling uh to be accessible to have the dynamic debugging support but but we discovered is uh in cases that up and you connect the DB to it uh and then neutron you could appear be connection will just reset after a certain point and then the sum of what's up the problem is that the firm actually disables the stupid I O ports and during the Board of so it uses for of other stuff which is bad for us and so we decided so what can we do to re-enable them the system
modified and there's so within in our uh and group we already developed this next 1 framework which we use previously to a binary patch some Wi-Fi from rest and now we just adopted it's just that that that that fall uh there's that that formula and now we are able to uh modified the firmware anyway we want and of course we can just resets to achieve that opens up the would up to be uh incapable of the body so now we have the to be breakpoints and memory what points which was really helped us by in reverse-engineering so now use cover tell you
more about where the sum of you might have seen our and I start out with the open fit but it's quite hydro to benefit so I mean that's not super high but it's tied to use it again after it's open and the idea is not to buy this fisher from which need some more reverse engineering in the femur of this process and then if the predator good but
some gap that process is a bit complicated felt in the in in each of an activity they had you transmit December you include your formal version of the tracker and the summit of most well you have maybe an updated from there and in this case the and yet there is shown that there's a new from rapid ability but it is not fleshed out onto the tractor onto the user is actually tapping this update in India that's there and this is not really a security features so anyone could trigger from an update it's not any user interaction required nominee as soon as the update is that if you get a micro down from the tracker which contains tracker metadata including the serial number and a further and once again which is attached to a from a request and the femur request is then being obliged of from summer and contains the BS and then add from the pipes that then you just showed you the firm Aristide's them of the BSF lashing and is 1st validated then it's written to the flesh and then you reviewed into this be a sad part same thing than 40 at pirates from which is again validated written to flesh and then there's the reworded yet and if the MPF denominal functionality back again this up that
formants and ensures that you are flashing the correct from there but in the correct order to the so each chunk of the fervor starting with the action check your model so each of them has this exco depend on a track model then you have a chance which is marked by the SBS at or the reward action and depending on which of his actions you have of iters some 0 bytes are actual content the and you have also size limit of something like the 64 kilobytes depending on the it on on on the trackers so you just need to attach these things together so if you have an app from their updated contains 3 times then 1 anti-tank and 1 we which chunk we the and all these times are attached to each other and then there is another had so they had a
is having the encryption options and it is encoded announced and then the end has another C a C or if it's a group that you have to make take now you would say word you discovered from the updated merits and that's nice that's if you do it like this you is the get a
mouse so the address ranges of course checked you could past this address range check if you would flesh 1 1 more round in and around this disabled is at the center of it and then you have a bit flip and here see somewhere in the middle of the from there of there you need to flip the bits the calculate not included the included into the from a because otherwise the fermentative flesh the I'm not booed and show you from a version 0 . 0 in on some nectivity dance which is not that nice so you cannot simply replace the string and from there for example without this being happen the and now that is going to tell you how the encryption on top of all this works the is so the problem is so
we don't know all we do from a encryption and plain mode but most often you would already come in and by so but basically have encryption amended by the default so what we now need to do is uh just put in a cryptic the firm out there uh so uh what do we need for that
so at record lows us all the models of tilt goes you 60 years for encryption where neural models use a yes and you also need to for this you need basically 3 things that provide non which is contained in each and every time you get there and there are 128 bit encryption key which you can get with the uh aforementioned uh memory readout attack and also made by make which you can just calculated and and for this basically used the optimum and Tom crypt which is a C library which we already know Total before but you can also use uh the sponger castle library which is written in Java and this also contains every function you need so now we know basically everything we need we need to really know where and how to communication works we know how to fill up the distracted amino how to encrypt properly so it altogether so you
6 steps which you need to do that when you want to basically build your own and
modified effects of that the Flex firmware and there's so you 1st get basically you're symmetric key then you get to the plaintext tumble feel thermal binary then you transfer everything to not talk Richard and on any PC basically which you can then use to run on 1 framework and then you modified of them anyway we want and and then you sort of new form of the 1st 2 steps of last was that we have a firm and run on and let f for that you consider your on the source code of path and for the next 1 framework for that the Russians also on another report and then the last 2 steps are basically uh and transferred from the back to your smartphone reading group that and flesh utricle with that so and of course we did this before and now we can see
where you organize them what you can do with it so of course you want to to modify and the your fitness 2nd and the intervention so for example we just modified it here so
that each and every step gets multiplied by 100 and
yeah so here you can see uh I state of that in each state that creates 100 steps the a
few and maybe it's it's good to see you so this does not work with the latest that we update the dual goes to those who promote the rosary but this is
because we told them that this is wrong so I did this October update which is come mentioned was basically
uh came out of 4 after our research OK
interested so this is modifications so that you can apply them on Fitbit 1 flex or change charge which are and then 41 and inflects and therefore map it is not that fire gold sold you have high chances to modify attractor if you now by 1 that is an notion of picking or adjusted and update cures because it was lying around and for the life all this it's even nicer because I've mode is there on all attractors so if you're happy with the data that you get a life mode you can just disabled internet connection of the attractor and extract on your data with this so to sum up our
topic go out and fish enables
device to control of your own data that of course that you want to do an end run any code on if it you so
you have to start at the 1st to at
Soundverarbeitung
Virtuelle Maschine
Datennetz
Mini-Disc
Residuum
Mobiles Internet
Computer
Ereignishorizont
Message-Passing
Fitnessfunktion
Verschiebungsoperator
Streuungsdiagramm
Chiffrierung
Systemprogrammierung
Datenmissbrauch
Informationsmodellierung
Computersicherheit
Computersicherheit
Datenmodell
Physikalisches System
Message-Passing
Fitnessfunktion
Einfach zusammenhängender Raum
App <Programm>
Bit
Server
Programmierparadigma
Protokoll <Datenverarbeitungssystem>
App <Programm>
Firmware
Telekommunikation
Physikalisches System
ROM <Informatik>
Umwandlungsenthalpie
Chiffrierung
Symmetrische Matrix
Festspeicher
Server
Faktor <Algebra>
Repellor
Assoziativgesetz
App <Programm>
Server
Stellenring
Prozess <Physik>
Rahmenproblem
Datensichtgerät
Paarvergleich
Zahlenbereich
Quellcode
Codierung
Persönliche Identifikationsnummer
Rechenschieber
Assoziativgesetz
RPC
Authentifikation
Beweistheorie
Mereologie
Server
Authentifikation
Serielle Schnittstelle
Indexberechnung
Persönliche Identifikationsnummer
Aggregatzustand
Chipkarte
Stellenring
Server
Bit
Adressraum
Summengleichung
Abgeschlossene Menge
ROM <Informatik>
Zeitstempel
Chiffrierung
Informationsmodellierung
Authentifikation
Adressraum
Abgeschlossene Menge
Speicheradresse
Indexberechnung
Strom <Mathematik>
Stochastische Abhängigkeit
Normalvektor
Videospiel
Binärcode
Binder <Informatik>
Quick-Sort
Web log
Patch <Software>
Chiffrierung
Funktion <Mathematik>
Last
Festspeicher
ATM
Server
Lesen <Datenverarbeitung>
Authentifikation
Ordnung <Mathematik>
Schlüsselverwaltung
Telekommunikation
Extrempunkt
Familie <Mathematik>
Firmware
Kontextbezogenes System
Chiffrierung
Software
Chiffrierung
Datenfeld
Font
Reverse Engineering
Software
Meter
Programmbibliothek
Meter
Bus <Informatik>
System-on-Chip
Hardware
Punkt
Smiley
EEPROM
Information
ROM <Informatik>
Flash-Speicher
Variable
Softwaretest
Minimum
Figurierte Zahl
Leistung <Physik>
Hardware
Softwaretest
Protokoll <Datenverarbeitungssystem>
Reverse Engineering
Statisches RAM
Debugging
Firmware
Codierung
Variable
Persönliche Identifikationsnummer
Menge
Rechter Winkel
Festspeicher
Debugging
Flash-Speicher
Fitnessfunktion
Einfach zusammenhängender Raum
ATM
Punkt
Gewichtete Summe
Diskretes System
Hyperbelverfahren
App <Programm>
Content <Internet>
Zahlenbereich
Debugging
Firmware
Fitnessfunktion
Physikalisches System
Whiteboard
Rechenschieber
Chiffrierung
Informationsmodellierung
Chiffrierung
Funktion <Mathematik>
Serielle Schnittstelle
Flash-Speicher
Mereologie
Schlüsselverwaltung
Aggregatzustand
Binärcode
Gewichtete Summe
Punkt
Prozess <Physik>
Gruppenkeim
Debugging
Firmware
Framework <Informatik>
Ausdruck <Logik>
Überlagerung <Mathematik>
Patch <Software>
Framework <Informatik>
F-Test
Reverse Engineering
Offene Menge
Festspeicher
Firmware
Fitnessfunktion
Bit
Prozess <Physik>
App <Programm>
Zyklische Redundanzprüfung
Gruppenoperation
Nebenbedingung
Versionsverwaltung
Zahlenbereich
Interaktives Fernsehen
Iteration
Dicke
ROM <Informatik>
Metadaten
Weg <Topologie>
Informationsmodellierung
Adressraum
Speicherabzug
Inverser Limes
Inhalt <Mathematik>
Lineares Funktional
Bruchrechnung
App <Programm>
Schreiben <Datenverarbeitung>
Prozess <Informatik>
Computersicherheit
Softwarepiraterie
Firmware
Dateiformat
Mereologie
Ordnung <Mathematik>
Bit
Konfiguration <Informatik>
App <Programm>
Zyklische Redundanzprüfung
Adressraum
Nebenbedingung
Gruppenkeim
Versionsverwaltung
Firmware
Dicke
Dateiformat
ROM <Informatik>
Konfiguration <Informatik>
Spannweite <Stochastik>
Chiffrierung
Spannweite <Stochastik>
Chiffrierung
Adressraum
Speicherabzug
Wort <Informatik>
Versionsverwaltung
ATM
Telekommunikation
Lineares Funktional
Bit
Default
EEPROM
Applet
Firmware
ROM <Informatik>
Chiffrierung
Advanced Encryption Standard
Informationsmodellierung
Datensatz
Chiffrierung
Funktion <Mathematik>
Authentifikation
Festspeicher
ATM
Speicherabzug
Programmbibliothek
Default
Schlüsselverwaltung
Binärcode
Gruppenkeim
Fitnessfunktion
Firmware
Quellcode
Dateiformat
Framework <Informatik>
Quick-Sort
Temperaturstrahlung
Bildschirmmaske
Wärmeübergang
Firmware
Flash-Speicher
Smartphone
Verkehrsinformation
Lesen <Datenverarbeitung>
Videokonferenz
Demo <Programm>
Fitnessfunktion
Aggregatzustand
Einfach zusammenhängender Raum
Videospiel
ATM
Konfiguration <Informatik>
Mathematisierung
Firmware
ROM <Informatik>
Internetworking
Chiffrierung
ATM
Computersicherheit
Repellor
Modelltheorie
Versionsverwaltung
Drahtloses lokales Netz
Codierung
Hypermedia
Medianwert
Systemprogrammierung

Metadaten

Formale Metadaten

Titel Doping your Fitbit
Untertitel Firmware modifications faking you fitter
Serientitel 34th Chaos Communication Congress
Autor jiska
DanielAW
Lizenz CC-Namensnennung 4.0 International:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
DOI 10.5446/34791
Herausgeber Chaos Computer Club e.V.
Erscheinungsjahr 2017
Sprache Englisch

Inhaltliche Metadaten

Fachgebiet Informatik
Abstract Security architectures for wearables are challenging. We take a deeper look into the widely-used Fitbit fitness trackers. The Fitbit ecosystem is interesting to analyze, because Fitbit employs security measures such as end-to-end encryption and authentication to protect user data (and the Fitbit business model). Even though this goes beyond security mechanisms offered by other fitness tracker vendors, reverse-engineering the trackers enables us to launch practical attacks against Fitbit. In our talk, we demonstrate new attacks including wireless malware flashing on trackers as well as “unlocking” the trackers to work independent from the Fitbit cloud.
Schlagwörter Security

Zugehöriges Material

Folgende Ressource ist Begleitmaterial zum Video
Video wird in der folgenden Ressource zitiert

Ähnliche Filme

Loading...
Feedback