Using the information below what could a security professional do to prevent this situation or use this information in a defense?
Fitness trackers are all the rage. But how secure is the data that these devices accumulate and transmit? And should we even care?
A relatively new class of mobile technology consists of devices that can be worn by the user instead of carried. Known as wearable technology, these devices can provide even greater flexibility and mobility. As the cost of wearable technology has decreased while the network speed of the devices has increased, sales of this technology have dramatically risen. Wearable device shipments worldwide totaled 26 million units in 2014 and increased 173 percent the following year to 72 million units. It is estimated that wearable device shipments worldwide will reach 175 million by 2020.
The most common type of wearable technology is a fitness tracker. These devices typically monitor movements by counting steps and distance traveled, record heart rates, provide location data, give alerts of incoming email, calls, or text messages, and even monitor sleep patterns. Another type of wearable technology is a smartwatch. This device can serve as an accessory to a smartphone so that users can easily glance at the watch to view messages without the need to remove the smartphone from a bag or pocket. The device also may have its own set of sensors and software features to function independently.
And as the technology continues to advance, fitness trackers are becoming that much more powerful. A project by the National Institutes of Health and the Berkeley Sensor and Actuator Center has recently designed a tracker that measures multiple chemicals in the user’s persperation and then calibrates the data according to the wearer’s body temperature. These “sweat trackers” check for lactate and glucose (the chemicals that are produced when our bodies burn fuel) as well as the electrolytes sodium and potassium (the chemicals that are needed to retain water). Too much lactate during a workout may indicate muscle fatigue, while low levels of potassium may mean dehydration is starting to occur.
But wait, there’s more. There is now a digital Bluetooth-based home pregnancy test. According to the vendor, the “[pregnancy test] stick syncs securely to the . . . app on the users’ mobile device via a small, low-power and disposable Bluetooth Smart module . . . The app offers step-by-step assurance through the testing process, as well as a three-minute countdown to the result. During this three-minute wait, the user is offered a variety of options to help ease anxiety . . . After three minutes, the test result will appear on the test stick, and can be displayed on the mobile device after a secure code is entered.”
So with all of this user fitness and health data being collected and transmitted, is it secure? Canadian researchers looked at fitness-tracking devices and their companion mobile apps from eight different fitness device manufacturers. All the devices, with the exception of the Apple Watch, transmitted a persistent and unique Bluetooth identifier, meaning that the user could be tracked by the beacons, even when the device is not paired with or connected to a smartphone. In addition, the companion smartphone apps for the wearables either exposed login authentication credentials transmitted the tracking information that allowed for a man-in-the-middle interception attacker, or allowed users to submit fake activity tracking information. And what security steps were taken were half-hearted. One fitness app used HTTPS only when the user was logging in with her password, but all other data was sent without any encryption, so that a snooper could easily read or alter the data.
Does it matter? Yes. Some health insurers are now using fitness tracker data to offer lower healthcare insurance premiums. And courts have admitted fitness app data as evidence in several cases. And imagine the ads you would receive once advertisers got their hands on your activity data. And think of what a stalker could do if he knew the route a victim takes every Friday afternoon while running. And on and on and on. Yes, it matters.
