Assessing pairing and data exchange mechanism security in the wearable internet of things

The consumer wearable economy is a rapidly growing sector with an ever increasingly number of use cases mostly focused on the quantified self. Whether used for fitness tracking, mobile health monitoring, or as remote controllers for connected smartphone apps, wearables typically come equipped with a wide variety of different sensors such as accelerometers, pulsometors, and thermometers to capture data such as, respectively, the user's movements, heart-rate, and temperature. Once data is captured it is then typically wirelessly transmitted, using Bluetooth LE (low energy) to an awaiting smartphone. Since the data may be sensitive and/or personally identifiable, it is critical that this exchange and the pairing mechanisms used to set up the connection remain secure and resilient to eavesdropping attacks. This paper empirically evaluates the data exchange mechanisms of a variety of major commercial wearable products to determine if, and how well, the products live up to this security constraint. As part of this effort, the work also investigates the three different types of Bluetooth LE pairing strategies at a packet and protocol level. The results show presumably secure pairing strategies have glaring security vulnerabilities that affect all of the devices examined. In addition to this publication, efforts are underway to report these vulnerabilities to US-CERT.