Fitbit, Other Fitness Trackers Leak Personal Data: Study

10 iPhone Healthcare, Fitness Apps That Actually Work

Fitness trackers are not secure at all, claim researchers in a new study. Of eight devices tested, only one offers owners a modicum of protection. Wearables were found to share location data and leave personal fitness data open to pilfering from ne'er-do-wells. The study shines light on a new security angle to consider when strapping on wearables.

Compiled by Citizen Lab and the Munk School of Global Affairs, the study, titled "Every Step You Fake: A Comparative Analysis of Fitness Tracker Privacy and Security," was published by Canadian nonprofit Open Effect. It looked at several popular wearables, including the Apple Watch, the Basis Peak, the Fitbit Charge HR, Garmin's Vivosmart, the Jawbone Up 2, the Mio Fuse, the Withings Pulse O2, and the Xiaomi Mi Band. The researchers targeted the devices' Bluetooth radios to see what they could discover.

The authors wrote:

In the course of our technical investigations into transmission security, data integrity, and Bluetooth privacy, we discovered several issues that confirm concerns about the potential uses of fitness tracking data beyond the typical case of a user monitoring their own personal wellness.

Seven of the eight wearables revealed unique Bluetooth identifiers -- their MAC address -- which allowed them to be tracked by nearby Bluetooth beacons. Beacons are used more and more in stores and malls to profile shoppers and push tailored offers. Only the Apple Watch took advantage of Bluetooth LE's ability to generate random MAC addresses to thwart potential location tracking.

While the devices themselves gave up their owners' whereabouts, the accompanying apps leaked a greater amount of personal information. For example, apps spilled login credentials and failed to protect against interception and tampering when they were transmitting data between smartphone, wearable, and the wearable company's own servers. The researchers were able to use a man-in-the-middle attack to pilfer data sent to/from the companion app's servers. This could allow others to push false data into the wearable or the phone, they said.

Garmin's app, for example, relies on HTTPS at signup and login, but all other is data wide open. Users of the Jawbone and Withings apps can easily forge fitness data. That ability could lead to people hiding medical problems and injuries or misrepresenting their health to third-party observers (think insurance companies).

[Read Mobile, IoT Sales Hampered by Security Fears: Accenture.]

"The fitness data generated by several wearable devices can be falsified by motivated parties, calling into question the degree to which this data should be relied upon for insurance or legal purposes," noted the study.

Again, Apple's wearable app offered more protection than its counterparts. It's worth pointing out that the Apple Watch is the only true smartwatch among the eight devices tested. The rest are far simpler activity trackers that don't offer the third-party app compatibility the Apple Watch does. The researchers didn't include Android Wear. Smartwatches are slowly overtaking fitness trackers as the wearables of choice for many consumers.

The authors have yet to compile conclusions or recommendations, but the need to improve wearable security is fairly obvious. Makers of fitness trackers should be called on to do more to protect owners' data, both by securing the Bluetooth connections and by taking steps to shore up their companion apps.

Does your company offer the most rewarding place to work in IT? Do you know of an organization that stands out from the pack when it comes to how IT workers are treated? Make your voice heard. Submit your entry now for InformationWeek's People's Choice Award. Full details and a submission form can be found here.