![\"Fitbit](\"https:\/\/c2.staticflickr.com\/6\/5734\/22375649651_5a6aeea2df.jpg\")
<\/p>\nSo it seems there is a Fitbit vulnerability involving the BlueTooth implementation that can be used to embed self replicating malware onto the wearable fitness tracker. I actually own a Fitbit, and have had previous models too, so this is quite interesting to me.<\/p>\n
<\/p>\n
The malware could spread to your PC\/Laptop if you’re using the syncing dongle, or to other Fitbit trackers. From what I’ve read of it though, it’s mostly theoretical. It could work under some circumstances, but there’s no real live code out there infecting Fitbit devices and spreading itself.<\/p>\n
A vulnerability in FitBit fitness trackers first reported to the vendor in March could still be exploited by the person you sit next to on a park bench while catching your breath.<\/p>\n
The athletic-achievement-accumulating wearables are wide open on their Bluetooth ports, according to research by Fortinet. The attack is quick, and can spread to other computers to which an infected FitBit connects.<\/p>\n
Attacks over Bluetooth require an attacker hacker to be within meters of a target device. This malware can be delivered 10 seconds after devices connect, making even fleeting proximity a problem. Testing the success of the hack takes about a minute, although it is unnecessary for the compromise.<\/p>\n
Fortinet researcher Axelle Apvrille (@cryptax) told Vulture South that full persistence means it does not matter if the FitBit Flex is restarted; any computer that connects with the wearable can be infected with a backdoor, trojan, or whatever the attacker desires.<\/p>\n
“An attacker sends an infected packet to a fitness tracker nearby at bluetooth distance then the rest of the attack occurs by itself, without any special need for the attacker being near,” Apvrille says.<\/p>\n
“[When] the victim wishes to synchronise his or her fitness data with FitBit servers to update their profile \u2026 the fitness tracker responds to the query, but in addition to the standard message, the response is tainted with the infected code.<\/p>\n
“From there, it can deliver a specific malicious payload on the laptop, that is, start a backdoor, or have the machine crash [and] can propagate the infection to other trackers (Fitbits).”<\/p>\n
It is the first time malware has been viably delivered to fitness trackers.<\/p><\/blockquote>\n