Interception of BLE Communications in Wearables: An Application Case

Abstract

[Abstract] The number of people who care about their health and physical condition and who begin to practice different sports or activities related to the fitness field is increasing. This is the reason why, in recent years, the use of activity bracelets or smartbands has become popular. These are devices that allow us to monitor some parameters of our body such as heart rate, blood oxygen saturation or the quality of our sleep, among other things. Sometimes, the manufacturers and developers of this type of device are primarily concerned with improving the characteristics of communication and data transmission between the bracelets and the smartphones in which we can see the data collected, leaving aside the security of the same. This is a serious problem due to the fact that the information we are working with is very sensitive information about the user, related to their basic medical data. In this paper, we intend to carry out an in-depth study related to the operation of this type of devices, analyzing its level of security. With this, we have verified that the main point of failure of wearable devices is in the communication between them and the smartphones that control them. It is possible to carry out Man-in-the-Middle attacks, which allow us to intercept all the traffic sent between both devices in real time. In this document we show how to execute this attack and be able to listen to all the traffic transmitted between an smartband and the smartphone that manages it.