Study Finds Fitness Trackers are Leaking Data

February 2, 2016

Some of the more popular sports wearables are letting other people track you, according to a report on fitness-tracking devices from eight manufacturers, along with their companion mobile apps.

The revealing devices, the Basis Peak, Fitbit Charge HR, Garmin Vivosmart, Jawbone Up 2, Mio Fuse, Withings Pulse O2 and Xiaomi Mi Band, all make it possible for their wearers to be tracked using Bluetooth even when the device is not paired with or connected to a smartphone, said the report, “Every Step you Fake: A Comparative Analysis of Fitness Tracker Privacy and Security." It was published by Canadian nonprofit Open Effect, and researched with help from the Citizen Lab at the Munk School of Global Affairs, University of Toronto.

Only the Apple device used a feature of the Bluetooth LE standard to generate changing MAC addresses to prevent tracking, the report said.

In addition, the report said that companion apps for the wearables variously leaked login credentials, transmitted activity tracking information in a way that allowed interception or tampering, or allowed users to submit fake activity tracking information.

The apps are typically used to gather data from the fitness tracking device and upload it to a central server, where users can analyze their performance and perhaps compare it with that of other device wearers.

The report is at https://openeffect.ca/reports/Every_Step_You_Fake.pdf

You must login or register in order to post a comment.

ON DEMAND: DevSecOps creates an environment of shared responsibility for security, where AppSec and development teams become more collaborative. With the right training and tools, developers can become more hands-on with security and, with that upskilling, stand out among their peers... however, they need the security specialists on-side, factoring them into securing code from the start and championing this mindset across the company.

The insider threat—consisting of scores of different types of crimes and incidents—is a scourge even during the best of times. But the chaos, instability and desperation that characterize crises also catalyze both intentional and unwitting insider attacks. Learn how your workers, contractors, volunteers and partners are exploiting the dislocation caused by today's climate of Coronavirus, unemployment, disinformation and social unrest.

Security Magazine

2020 September

This month in Security magazine, we bring you our 2020 Most Influential People in Security annual report, where we highlight 22 industry leaders, their path to security, careers, goals and guidance for future security professionals. Industry experts discuss the evolution of ransomware, houses of worship security, cybersecurity standards, security careers in investigations and the unifying power of security. Diane Ritchey, past Editor-in-Chief, says goodbye and thank you to our readers.

View More Create Account

Study Finds Fitness Trackers are Leaking Data

Related Articles

Related Products

Related Events

Report Abusive Comment