{"guid":"7edaed35-e938-4a13-b21c-aac4bb0ebf94","title":"Doping your Fitbit","subtitle":"On Fitbit Firmware Modifications and Data Extraction","slug":"34c3-8908-doping_your_fitbit","link":"https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8908.html","description":"Security architectures for wearables are challenging. We take a deeper look into the widely-used Fitbit fitness trackers. The Fitbit ecosystem is interesting to analyze, because Fitbit employs security measures such as end-to-end encryption and authentication to protect user data (and the Fitbit business model). Even though this goes beyond security mechanisms offered by other fitness tracker vendors, reverse-engineering the trackers enables us to launch practical attacks against Fitbit. In our talk, we demonstrate new attacks including wireless malware flashing on trackers as well as “unlocking” the trackers to work independent from the Fitbit cloud.","original_language":"eng","persons":["jiska","DanielAW"],"tags":["34c3","8908","Security"],"view_count":9416,"promoted":false,"date":"2017-12-27T00:00:00.000+01:00","release_date":"2017-12-28T01:00:00.000+01:00","updated_at":"2026-04-15T04:30:02.562+02:00","length":1368,"duration":1368,"thumb_url":"https://static.media.ccc.de/media/congress/2017/8908-hd.jpg","poster_url":"https://static.media.ccc.de/media/congress/2017/8908-hd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/congress/2017/7edaed35-e938-4a13-b21c-aac4bb0ebf94-timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/congress/2017/7edaed35-e938-4a13-b21c-aac4bb0ebf94-thumbnails.vtt","frontend_link":"https://media.ccc.de/v/34c3-8908-doping_your_fitbit","url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_title":"34C3: TUWAT","conference_url":"https://api.media.ccc.de/public/conferences/34c3","related":[{"event_id":4762,"event_guid":"b036385c-ec1a-44e5-ae48-af703ce9b5d3","weight":154},{"event_id":4763,"event_guid":"2ef3b60f-6e5c-4c23-a145-d263685ec13e","weight":244},{"event_id":4764,"event_guid":"da934433-0092-4749-b606-56b65e84214f","weight":126},{"event_id":4765,"event_guid":"9326038b-f781-4707-b35a-9ef52f98d35a","weight":119},{"event_id":4766,"event_guid":"19b7e5d7-bba7-46da-afbc-f16d43fe395f","weight":218},{"event_id":4767,"event_guid":"f2ca3661-30c8-476e-9d6b-920bb20b21eb","weight":136},{"event_id":4770,"event_guid":"a890dbd3-8859-4788-a72f-ded5c5c08e5f","weight":119},{"event_id":4784,"event_guid":"65a25dfd-56dd-4e87-a910-334e2dc25a9c","weight":168},{"event_id":4790,"event_guid":"edd02e52-28f8-4f3e-8b17-75cffecb6d7f","weight":270},{"event_id":4791,"event_guid":"8d29d28d-a222-4731-bdfc-fde590385cae","weight":140},{"event_id":4793,"event_guid":"22027440-b3fb-49d5-a35b-b86e7d77cfb9","weight":147},{"event_id":4794,"event_guid":"a2887b4a-0c9d-4220-a52f-c65c20ae25d7","weight":267},{"event_id":4795,"event_guid":"722ce759-9cde-4e3b-8db5-5a97aa9673d9","weight":156},{"event_id":4805,"event_guid":"ed1d9ef6-23e1-4213-be8d-b97625ff20da","weight":111},{"event_id":4808,"event_guid":"acab4111-aba7-44f7-b56e-ef805dcacd00","weight":124},{"event_id":4821,"event_guid":"aed02b65-9a16-4a42-ac28-2883da680d0a","weight":108},{"event_id":4823,"event_guid":"bf924a39-2860-4e27-8741-b8fa0c010363","weight":145},{"event_id":4826,"event_guid":"16645200-2036-4a3c-a44d-a5ff44ac2991","weight":357},{"event_id":4832,"event_guid":"275f85de-d612-4440-8755-85dee5912f12","weight":337},{"event_id":4833,"event_guid":"e1a60f7b-6a56-4dce-ab3a-c686fa940aa8","weight":159},{"event_id":4840,"event_guid":"21127aeb-fe1f-4506-a3f0-d747e20419a5","weight":122},{"event_id":4855,"event_guid":"51b586be-500c-436e-b70c-fc433e65c4be","weight":319},{"event_id":4866,"event_guid":"117a52b4-f675-49dd-aafe-659c07b6bc9c","weight":238},{"event_id":4870,"event_guid":"2cb8f405-10be-40f5-ae95-579f024a0c84","weight":134},{"event_id":4876,"event_guid":"dec6a7e0-2651-4bb5-8300-977795e901ed","weight":109},{"event_id":4885,"event_guid":"956cf3ed-c342-4c1d-b636-29ec3d4578d2","weight":149},{"event_id":4903,"event_guid":"f68f2747-1c57-4531-a574-3ebe77d80135","weight":142},{"event_id":4909,"event_guid":"03ba9edb-1d3a-4774-9384-7548c0696df7","weight":195},{"event_id":4929,"event_guid":"8e222759-cd6b-403b-8fe1-3517bf7d2802","weight":171}],"recordings":[{"size":null,"length":null,"mime_type":"application/x-subrip","language":"eng","filename":"34c3-8908-eng-deu-Doping_your_Fitbit.en.srt","state":"complete","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2021-02-21T17:46:40.835+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/34c3-8908-eng-deu-Doping_your_Fitbit.en.srt","url":"https://api.media.ccc.de/public/recordings/44427","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":106,"length":1368,"mime_type":"video/mp4","language":"eng","filename":"34c3-8908-eng-Doping_your_Fitbit.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2017-12-28T16:06:54.514+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/h264-hd/34c3-8908-eng-Doping_your_Fitbit.mp4","url":"https://api.media.ccc.de/public/recordings/20977","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":106,"length":1368,"mime_type":"video/mp4","language":"deu","filename":"34c3-8908-deu-Doping_your_Fitbit.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2017-12-28T16:07:00.023+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/h264-hd/34c3-8908-deu-Doping_your_Fitbit.mp4","url":"https://api.media.ccc.de/public/recordings/20978","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":183,"length":1368,"mime_type":"video/mp4","language":"eng-deu","filename":"34c3-8908-eng-deu-Doping_your_Fitbit_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2017-12-28T16:07:05.996+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/h264-hd/34c3-8908-eng-deu-Doping_your_Fitbit_hd.mp4","url":"https://api.media.ccc.de/public/recordings/20979","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":71,"length":1368,"mime_type":"video/mp4","language":"eng-deu","filename":"34c3-8908-eng-deu-Doping_your_Fitbit_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2017-12-28T16:32:34.628+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/h264-sd/34c3-8908-eng-deu-Doping_your_Fitbit_sd.mp4","url":"https://api.media.ccc.de/public/recordings/21004","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":99,"length":1368,"mime_type":"video/mp4","language":"eng-deu","filename":"34c3-8908-eng-deu-Doping_your_Fitbit_hd-slides.mp4","state":"new","folder":"slides-h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2017-12-28T17:08:35.081+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/slides-h264-hd/34c3-8908-eng-deu-Doping_your_Fitbit_hd-slides.mp4","url":"https://api.media.ccc.de/public/recordings/21050","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":192,"length":1368,"mime_type":"video/webm","language":"eng-deu","filename":"34c3-8908-eng-deu-Doping_your_Fitbit_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2017-12-28T17:27:17.674+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/webm-sd/34c3-8908-eng-deu-Doping_your_Fitbit_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/21082","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":20,"length":1353,"mime_type":"audio/mpeg","language":"eng","filename":"34c3-8908-eng-Doping_your_Fitbit.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2017-12-28T20:29:07.384+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/mp3/34c3-8908-eng-Doping_your_Fitbit.mp3","url":"https://api.media.ccc.de/public/recordings/21157","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":14,"length":1353,"mime_type":"audio/opus","language":"eng","filename":"34c3-8908-eng-Doping_your_Fitbit.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2017-12-28T20:30:47.392+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/opus/34c3-8908-eng-Doping_your_Fitbit.opus","url":"https://api.media.ccc.de/public/recordings/21160","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":242,"length":1368,"mime_type":"video/webm","language":"eng-deu","filename":"34c3-8908-eng-deu-Doping_your_Fitbit_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2017-12-28T21:15:46.927+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/webm-hd/34c3-8908-eng-deu-Doping_your_Fitbit_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/21228","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":28,"length":1368,"mime_type":"video/mp4","language":"eng","filename":"34c3-8908-eng-Doping_your_Fitbit_sd-slides.mp4","state":"new","folder":"slides-h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2018-01-02T15:32:20.635+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/slides-h264-sd/34c3-8908-eng-Doping_your_Fitbit_sd-slides.mp4","url":"https://api.media.ccc.de/public/recordings/22281","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"},{"size":1,"length":null,"mime_type":"application/pdf","language":"eng","filename":"34c3-8908-doping_your_fitbit.pdf","state":"new","folder":"slides-pdf","high_quality":true,"width":null,"height":null,"updated_at":"2018-01-08T18:51:55.376+01:00","recording_url":"https://cdn.media.ccc.de/congress/2017/slides-pdf/34c3-8908-doping_your_fitbit.pdf","url":"https://api.media.ccc.de/public/recordings/22448","event_url":"https://api.media.ccc.de/public/events/7edaed35-e938-4a13-b21c-aac4bb0ebf94","conference_url":"https://api.media.ccc.de/public/conferences/34c3"}]}